The explosion of Internet of Things (IoT) devices has long served as a breeding ground for malware distribution. The inability for users to patch many IoT devices has only compounded this problem, as bad actors continue to evolve tactics to leverage botnets for DDoS attacks and other malicious behaviour. Black Lotus Labs tracks malware families that present new or distinct threats to the global community, and recently began tracking a new malware family called Mozi.
Mozi is evolved from the source code of several known malware families – Gafgyt, Mirai and IoT Reaper – that have been brought together to form a peer-to-peer (P2P) botnet capable of DDoS attacks, data exfiltration and command or payload execution. The malware targets IoT devices, predominantly routers and DVRs that are either unpatched or have weak telnet passwords. After a notable traffic increase in December was mistakenly attributed to other malware families by researchers, Black Lotus Labs reviewed entries in our reputation system for that timeframe, which revealed a different story. This traffic was not simply increased activity by a known family, but a new family altogether.
Black Lotus labs findings
In December 2019, Black Lotus Labs observed an increase of entries of compromised hosts in our reputation system labelled as IoT Reaper. Since this malware family has not changed in some time, the increase was unexpected, and led to further investigation of the increase. Upon review of these entries we began to see a pattern develop, each host had an http server listening on a random port that served a file which included "Mozi" in the name. File names such as "Mozi.m" and "Mozi.a" were seen throughout all of the identified hosts.
Research revealed that these hosts were part of a growing P2P botnet and were making the Mozi files available for distribution to newly infected hosts. While the increase in data began in December, our data shows that the use of the Mozi filename began earlier, in September. Further analysis revealed that the malware had been identified under many of its contributing families, including Mirai, Gafgyt, and IoT Reaper. The original spike consisted of 69 hosts, but a broader look revealed 4,216 hosts. Shortly after we began our research based on samples being detected as multiple families, Netlab360 shared their findings on this malware confirming our understanding.
The Mozi botnet is comprised of nodes that utilise a distributed hash table (DHT) for communication, similar to the code used by IoT Reaper and Hajime. These nodes also host the Mozi.m and Mozi.a malware binary files, passed during the compromise of new hosts, on a randomly chosen port. The standard DHT protocol is commonly used to store node contact information for torrent and other P2P clients. Using DHT allows the malware to bypass the use of standard malware command and control servers while hiding behind the large amount of typical DHT traffic. This makes it harder to track and impact the control infrastructure. As a P2P botnet, Mozi implements its own custom extended DHT described later.
To enumerate the botnet, Black Lotus Labs implemented a machine learning model trained on the observed unique DHT traffic implementation utilised by Mozi. This allows us to distinguish between Mozi nodes and benign hosts, and identify the IPs suspected of participating in the botnet. When we identify a new suspected Mozi node, our software attempts to confirm the suspicion by sending messages proprietary to the malware's p2p protocol, and looks for correctly formatted responses. When the correct response is seen, the host is validated as a member of the Mozi botnet.
The Mozi botnet is growing as the malware evolves
To get a view on the potential size of this new botnet we continue to review the data within our reputation system, and the IPs of the hosts confirmed as Mozi botnet nodes.
Looking at unique Mozi nodes hosting the malware during the initial spike witnessed, there were 323 unique nodes, by Dec. 27 unique nodes had grown to 1,205, then hitting a high point on Feb. 4 with 2,191 nodes. Our review showed a steady increase in the number of compromised hosts over a span of three months – then a decline beginning in late February. Overall, we have observed over 15,858 unique Mozi nodes over the last four months.
Throughout the life of the Mozi botnet, the bulk of the nodes have been located in Asia, with China hosting 71 per cent of infected hosts. Outside of Asia, the largest footprint has been the US, with 10 per cent of all nodes. A review of the data for just the month of March shows China increasing to 81 per cent of the botnet nodes and the United Stated dropping to less than 1 per cent.
Our first observations of the malware in December found only three distinct samples. As time as has passed, we've now seen 34 unique samples, suggesting the operators are continuing to manipulate the malware.
A deeper look into the Mozi malware
The Mozi samples analysed are ELF binaries with versions targeted for MIPS and ARM processor architectures. Once executed, the binary forks many versions of itself renamed as 'ssh' or 'dropbear'. The forked processes are responsible for setting up the DHT communications and closing ports to prevent infection by other malware. The forked processes can also set up HTTP on a randomly chosen port to host the Mozi binary.
Mozi uses a modified DHT protocol for communication. The bot initially DHT pings several nodes hardcoded in the binary to bootstrap the initial connection to the DHT network. For the nodes that respond, the bot then sends a DHT 'find_node' command to locate other bots on the Mozi botnet. It often takes several find_node attempts to locate an active Mozi peer.
Example find_node request:
If this request is sent to an active Mozi peer, the peer will often return the config of the contacted peer as the value to the 'nodes' key, alternatively it will return other nodes in the 'nodes' key. The config is XOR encrypted with a hardcoded key.
Eventually Mozi peers will return their XOR encoded config. Once decrypted the config contains (as described by Netlab360) a bot role and a DHT prefix. The bot roles that we have seen in our data are 'bot', 'sk', 'ftp', and 'sns'. The DHT prefix seems to always be '88888888', except in the case of the 'sns' bot role in which it is just '888'.
Decoded config samples:
[ss]sk[/ss][hp]88888888[/hp][count]http://ia.51[.]la/go1?id=20198527&pu=http per cent3a per cent2f per cent2fbaidu[.]com/[idp][/count]
[ss]bot[/ss][hp]88888888[/hp][count]http://ia.51[.]la/go1?id=19894027&pu=http per cent3a per cent2f per cent2fbaidu[.]com/[idp][/count]
Mozi is a fitting example of a new botnet ramping up virtually unnoticed or misattributed. What was initially viewed as small spike of a single family was actually a single, much larger, growing botnet. As evidenced by the rapid increase in size of this botnet, there are still large numbers of vulnerable IoT devices on the Internet. Black Lotus Labs continues to monitor the Mozi botnet and will continue to work to enumerate the P2P nodes. Black Lotus Labs has reached out to the most active nodes’ upstream providers in an attempt to disrupt and slow the botnet’s growth.
All the vulnerabilities targeted by the botnet are well known and are prevented by either proper patching or proper password management. Companies and individuals can follow these security best practices to help prevent these types of compromises in the future:
- Implement effective passwords on all IoT devices when possible.
- Restrict IoT devices access to the wide-open internet.
- Implement proper patching methodologies.
- Review this list of affected devices and their vulnerabilities.
Netlab360 shared a table of affected devices and their vulnerabilities:
Affected Device / Vulnerability
- Eir D1000 Router / Eir D1000 Wireless Router RCI
- Vacron NVR devices / Vacron NVR RCE
- Devices using the Realtek SDK / CVE-2014-8361
- Netgear R7000 and R6400 / Netgear cig-bin Command Injection
- DGN1000 Netgear routers / Netgear setup.cgi unauthenticated RCE
- MVPower DVR / JAWS Webserver unauthenticated shell command execution
- Huawei Router HG532 / CVE-2017-17215
- D-Link Devices / HNAP SoapAction-Header Command Execution
- GPON Routers / CVE-2018-10561, CVE-2018-10562
- D-Link Devices / UPnP SOAP TelnetD Command Execution
- CCTV DVR / CCTV/DVR Remote Code Execution
Top talking botnet nodes from most recent data
This information is provided "as is" without any warranty or condition of any kind, either express or implied. Use of this information is at the end user's own risk.
Mike Benjamin, Head, Black Lotus Labs