Post Now

Exploit Code Used in Satori Botnet Attack made Public By Hackers

Image

Hackers have posted publicly the exploit code used in Mirai malware variant Satori which was used to exploit a zero day vulnerability in Huawei devices

Hackers have posted publicly the exploit code used in Mirai malware variant Satori which was used to exploit a zero day vulnerability in Huawei devices.Ankit Anubhav, a researcher at NewSky Security discovered the code first which was publicly posted in pastebin.com.

Read more on: Bug in MacOS 10.13.2 Allows to Unlock App Store Preferences Without any Password
The zero day vulnerability (CVE-2017–17215) was discovered by checkpoint researchers and is targeted specifically on Huawei HG532 devices. They found that TR-064 ( Technical report standard) implementation in the Huawei devices allowed remote attackers to execute arbitrary commands to the device.TR-064 is application layer protocol which is used to implement basic device configuration,  firmware upgrades, etc from within the internal network.Attackers used this flaw to download and execute malicious payload on Huawei routers.“CVE-2017–17215, a vulnerability in Huawei HG532 devices, was discovered during a zero-day Satori attack by Checkpoint and was discreetly reported to Huawei for a fix. The proof of concept code was not made public to prevent attackers from abusing it. However, with the release of the full code now by the threat actor, we expect its usage in more cases by script kiddies and copy-paste botnet masters.” said in the blog post published by NewSky Security.Researchers also have discovered usage of this exploit in another malware Brickerbot which was discovered in April 2017.When analysed the code of both Satori and Brickerbot, the researchers discovered that the exploit source code has been copied from the same source.NewSky Security researchers said that they will not share the link to prevent it from misused by attackers.Huawei has already released a security advisory for the vulnerability CVE-2017–17215 and it can be accessed here.Users can take the following measures to circumvent or prevent the exploit of this vulnerability in your Huawei devices:
  1. Configure the built-in firewall function.
  2. Change the default password.
  3. Deploy a firewall at the carrier side.
For more details you can visit security advisory published by the company.  
Read more on: Vulnerability in AMD Secure Processor Disclosed Online