Katana: a new variant of the Mirai botnet

Avira’s IoT research team has recently identified a new variant of the Mirai botnet. It has been named Katana, after the Japanese sword.

Although the Katana botnet is still in development, it already has modules such as layer 7 DDoS, different encryption keys for each source, fast self-replication, and secure C&C. There are indications that katana may be associated with an  HTTP banking botnet in the future.

We’ve previously looked at how Mirai, an IoT botnet, has evolved since its source code became public. A recent analysis of IoT attacks and malware trends shows that Mirai’s evolution continues. For example, variants of Mirai can be bought, sold, or sourced via YouTube channels, in this case, VegaSec. These, and other changes, enable unskilled attackers to create malicious botnets, resulting in an increase in attacks.

Analysis

The Katana botnet attempts to exploit old vulnerabilities via Remote Code Execution/Command Injection vulnerabilities such as LinkSys and GPON home routers. For the last two weeks, a surge of malware binaries has been captured by our honeypot, and it was this that encouraged us to have a closer look.

Although Katana uses old exploits (we assume it is in the testing/development stage), it still attracted our attention because:

• It is actively infecting hundreds of devices daily,
• There are interesting features associated with this botnet

Over a period of time, the botnet is being downloaded with different IPs. The figures below show how it is downloaded:

05-10-2020

08-10-2020 

12-10-2020 

During our analysis, we found that the botnet runs as a single instance by binding different ports, i.e., 53168, 57913, 59690, 62471, and 63749. One such example is shown below:

The botnet tries to manipulate the watchdog and prevents the device from restarting. The figure below shows as follow:

In short, Katana retains several Mirai features. These include running a single instance, random process name, manipulating the watchdog to prevent the device from restarting, and DDoS commands. The botnet also configures the iptables to drop access to port 37215 of an affected device.

Similar to Mirai, the botnet also supports DDoS commands:

attack_app_http suggests that the botnet is in fact an http botnet. Furthermore, the functions (highlighted bold above) apparently are new commands that this new botnet leverages for its attack.

Network Analysis

Like Mirai, this new botnet targets home routers like GPON and LinkSys via Remote Code Execution/Command Injection vulnerabilities.

During our analysis, we discovered that it is possible to bypass authentication by simply appending “?images” to any URL of the device that requires authentication. In this way, an intruder can manage the device. Traffic below shows how this happens:

During our analysis, we observed that there is a binary CGI executable (tmUnblock.cgi) found in some LinkSys routers. This has multiple security holes that permit various attacks on the router. The malware tries to exploit the router via a vulnerable CGI script, as shown below:

The authentication is base64 encoded that is decoded as login: password.

The botnet also tries to exploit different devices that use the RealTek SDK with miniigd deamon, which is vulnerable to OS command Injection in the UPnP SOAP Interface. Traffic is shown below:

The Katana botnet also tries to communicate to its following C2 servers:

• 100cnc[.]r4000[.]net
• 1280x1024cnc[.]r4000.net

At this time, the Katana botnet is actively infecting hundreds of devices each day. The following are the top 3 as per our stats until now.

• DSL-7740C DLink
• DOCSIS 3.1 Wireless Gateway
• Dell PowerConnect 6224 Switch

Conclusion

It is important to safeguard IoT endpoints installed in consumer environments. The industry needs to start adopting best practices to improve device security to ensure that their IoT devices are reliable products and are regularly patched.

The Avira IoT Research team monitors such new malware families or variants and provide detections for them. Integrating Avira SafeThings and anti-malware technologies can help protect customers from such attacks.

IoCs