JPCERT-AT-2011-0002
JPCERT/CC
2011-02-08
<<< JPCERT/CC Alert 08.02.11 >>>
Security settings of Internet servers (mainly UNIX / Linux servers)
https://www.jpcert.or.jp/at/2011/at110002.txt
I. Overview
JPCERT/CC has received reports of cases where servers with
insufficient security measures have been intruded and have been used
to attack third parties.
The attacker installs a program onto a server into which the attacker
has intruded through some method, and then conducts a scan or
dictionary attack on the 5060/Udp port (mostly used by the SIP protocol)
of SIP devices such as SIP servers operated by a third party.
The attacker may send out SIP account information it has obtained
using this program via mail, and may possibly use the information to
make illicit calls such as international calls.
JPCERT/CC has observed increase of scans on the 5060/Udp port since
July 2010 through its Internet Scan Data Acquisition System
(ISDAS/TSUBAME).
This time, JPCERT/CC has decided to issue this Alert for the purpose
of implementing security measures on servers that have been compromised
as well as preventing similar damages, since the sequence of events of
the attack has been revealed as a result of investigation performed
based on relevant information as well as a sample of the program
installed by the attacker provided from an informant, and since many
of the source IP addresses observed by the Internet Scan Data
Acquisition System (ISDAS/TSUBAME) exist inside Japan.
II. Details of Attack
1. The attacker seems to have modified a publicly available
vulnerability verification tool to prepare a program that
eventually collects information for the attacker.
2. The attacker uses some sort of method to intrude into a server
connected to the internet and installs the program.
(onto a server where vulnerable software is operating, the login
account information is vulnerable, etc.)
3. The server executes the program on the compromised server and
attempts a scan on a third party's SIP device such as a SIP server
which is publicly accessible over the Internet. Furthermore, the
attacker identifies the SIP device from the results of the scan,
and mounts a dictionary attack of approximately 130 thousand lines
upon the SIP device in order to obtain SIP account information.
If vulnerable SIP account information is identified, the
information is sent externally to the attacker.
* The target SIP device includes Asterisk devices mentioned in the
Alert below:
JPCERT/CC Alert 2010-12-09
Improperly setup Asterisk may be exploited for malicious purposes
https://www.jpcert.or.jp/english/at/2010/at100032.txt
The sequence of events from 1 through 3 is shown in Figure 1.
Figure 1: Sequence of events of the attack
If SIP account information of SIP servers, etc. are stolen by an
attacker, the attacker may make illicit calls to third parties over
the Internet, and may result in being billed large amounts for
international calls, etc.
III. Observations from the Internet Scan Data Acquisition System
Scans considered as performed by the reported program have been
observed since around July 2010 (see Figure 2). In areas other than
Japan (see Figure 3), similar trends have also been observed by the
APAC Internet Threat Monitoring Data Sharing Project (TSUBAME) for
which JPCERT/CC serves as the secretariat.
Figure 2: Trend observed of scans on 5060/Udp in Japan
Figure 3: Trend observed of scans on 5060/Udp in the APAC region
Scan trends from July 8, 2010 to July 11, 2010 (WMV movie)
https://www.jpcert.or.jp/at/2011/at110002_tsubame.wmv
* Time is displayed on the upper right of the movie. Increase is
observed from around 3 AM, July 9, 2010.
Comparison of the packets captured when running the program provided
by the informant in a verification environment and those that were
collected with the Internet Scan Data Acquisition System of JPCERT/CC
is shown in Figure 4.
Figure 4: Comparison of captured packets
The number of scans indicated in Figures 2 and 3 may include scans
that do not originate from the program, but from the characteristics
of the scan, around 80% is suspected to have originated from computers
running this program. The program may be running in Unix / Linux
environments.
The case reported by the informant was that a Linux server was
intruded and the program was installed.
IV. Solution
From the reported case, the program installed by the attacker may be
located in the path shown below.
Check whether or not these programs are running as well as whether
there are any traces of scans performed on the 5060/Udp port in the logs of firewalls and IDSs.
File path: /.old/aloha
File names: svmap, svwar, svcrack, svreport, svcrash, etc.
(programs for scanning SIP, identifying PBX, cracking SIP passwords, etc.)
It is also recommended to check the following with regard to the
servers that are in operation:
- The operating system and applications are not vulnerable versions
- The web applications (PHP applications, etc.) running on the
server are not vulnerable versions
- For those of the latest versions which have unfixed vulnerabilities,
apply workarounds or mitigations provided by the vendors
- Configure appropriate access restrictions on servers and firewalls
- Do not leave fields empty or use simple character strings in login
account information or SIP account information
(numbers up to 10 digits, words with letters substituted with
numbers are also already included in the dictionary used for the attack)
V. References
JPCERT/CC Alert 2010-12-09
Improperly setup Asterisk may be exploited for malicious purposes
https://www.jpcert.or.jp/english/at/2010/at100032.txt
If you have any further questions or information regarding this
alert, please contact JPCERT/CC.
Furthermore, if you have any information of similar attack cases or
compromises, please report using the following web form or via e-mail.
Web form: https://form.jpcert.or.jp/
e-mail: info@jpcert.or.jp
======================================================================
JPCERT Coordination Center (JPCERT/CC)
MAIL: info@jpcert.or.jp
TEL: +81-3-3518-4600 FAX: +81-3-3518-4602
https://www.jpcert.or.jp/english/
Top