New Mirai variant targets Tea LaTeX 1.0

Introduction

Avira’s IoT Labs continues to look for new variants of the Mirai botnet. Recently we identified one that has evolved to target only one thing; the web interface of the LaTex editing tool.

LaTeX is an editing tool commonly used in the preparation of scientific documents, particularly in the fields of  mathematics, statistics, computer science, and engineering.

The malware sample we identified is based on Mirai, and our analysis shows that it causes unauthenticated remote code execution in the web interface for LaTeX.

The exploit is documented in exploit-db published on 11 September 2020, but is already being used.

Analysis of new Mirai variant

The core functionality of Mirai does not change in this version. Like other Mirai samples, it also contains the following attack functions, shown in the table below:

Tea LaTeX version 1.0  suffers from an unauthenticated remote code execution vulnerability, and this new Mirai variant generates network traffic that targets this vulnerability.

We show the exploit traffic below:

Further detail of the exploit payload:

Bot binds to a fixed source port 60274 before a plain UDP flood attack is executed.

We show this in system calls below:

You can see from the graph that the exploit_init function looks the same as any other exploit function in Mirai.

However, we found that there is only one exploit in this particular sample. Consequently, we believe that it is not a mainstream Mirai sample. It appears that someone is only interested in targeting the LaTeX web interface.

Pre-infection traffic appears similar to any other Mirai variant. The sample is downloaded from 193[.]169[.]254.116.

Below is a list of the pre-infection commands executed:

The botnet scans the TCP port 80 of random hosts and delivers a payload once the vulnerability is identified.

During our analysis, the malware tries to contact multiple IPs to launch an attack. A few of them are below:

• 156[.]249.56.195:80
• 250.142[.]111:80
• 240.204[.]232:80
• 228.12[.]230:80

Conclusion

Mirai continues to be a platform used to exploit vulnerable devices and interfaces. Although we most often associate it with leveraging insecure home IoT devices to disrupt internet services, here we see an evolution that attacks a specific vulnerable web interface used by the scientific community. It is interesting to note that this variant has emerged when many research institutions, particularly in the pharmaceutical industry, have been under cyber-attack.

IoT device manufacturers are responsible for ensuring that the technologies they manufacture are inherently secure and can be easily patched. Consumers need to understand the importance of securing their home by buying IoT devices that are properly secured, and home-routers that can protect their connected homes.

The Avira IoT Research team continuously monitors the threat landscape for new malware families and variants. Our research helps the cyber-security industry maintain the best threat intelligence, build award-winning anti-malware solutions, and develop IoT protection technologies such as Avira SafeThings.

IOCs

List of Mirai variants: