Mozi bot… Tricking IOT devices

The explosion of Internet of Things devices has long served as a breeding ground for malware distribution.

The explosion of Internet of Things (IoT) devices has long served as a breeding ground for malware distribution. The inability for users to patch many IoT devices has only compounded this problem, as bad actors continue to evolve tactics to leverage botnets for DDoS attacks and other malicious behaviour. Black Lotus Labs tracks malware families that present new or distinct threats to the global community, and recently began tracking a new malware family called Mozi.

Mozi is evolved from the source code of several known malware families – Gafgyt, Mirai and IoT Reaper – that have been brought together to form a peer-to-peer (P2P) botnet capable of DDoS attacks, data exfiltration and command or payload execution. The malware targets IoT devices, predominantly routers and DVRs that are either unpatched or have weak telnet passwords. After a notable traffic increase in December was mistakenly attributed to other malware families by researchers, Black Lotus Labs reviewed entries in our reputation system for that timeframe, which revealed a different story. This traffic was not simply increased activity by a known family, but a new family altogether.

Black Lotus labs findings

This malware family has not changed in some time, the increase was unexpected, and led to further investigation of the increase. Upon review of these entries we began to see a pattern develop, each host had an http server listening on a random port that served a file which included “Mozi” in the name. File names such as “Mozi.m” and “Mozi.a” were seen throughout all of the identified hosts.

The Mozi botnet is comprised of nodes that utilise a distributed hash table (DHT) for communication, similar to the code used by IoT Reaper and Hajime. These nodes also host the Mozi.m and Mozi.a malware binary files, passed during the compromise of new hosts, on a randomly chosen port. The standard DHT protocol is commonly used to store node contact information for torrent and other P2P clients. Using DHT allows the malware to bypass the use of standard malware command and control servers while hiding behind the large amount of typical DHT traffic. This makes it harder to track and impact the control infrastructure. As a P2P botnet, Mozi implements its own custom extended DHT described later.

To enumerate the botnet, Black Lotus Labs implemented a machine learning model trained on the observed unique DHT traffic implementation utilised by Mozi. This allows us to distinguish between Mozi nodes and benign hosts, and identify the IPs suspected of participating in the botnet. When we identify a new suspected Mozi node, our software attempts to confirm the suspicion by sending messages proprietary to the malware’s p2p protocol, and looks for correctly formatted responses. When the correct response is seen, the host is validated as a member of the Mozi botnet.

A deeper look into the Mozi malware
The Mozi samples analysed are ELF binaries with versions targeted for MIPS and ARM processor architectures. Once executed, the binary forks many versions of itself renamed as ‘ssh’ or ‘dropbear’. The forked processes are responsible for setting up the DHT communications and closing ports to prevent infection by other malware. The forked processes can also set up HTTP on a randomly chosen port to host the Mozi binary.

Mozi uses a modified DHT protocol for communication. The bot initially DHT pings several nodes hardcoded in the binary to bootstrap the initial connection to the DHT network. For the nodes that respond, the bot then sends a DHT ‘find_node’ command to locate other bots on the Mozi botnet. It often takes several find_node attempts to locate an active Mozi peer.

All the vulnerabilities targeted by the botnet are well known and are prevented by either proper patching or proper password management. Companies and individuals can follow these security best practices to help prevent these types of compromises in the future:

IOC’s

006965027c1f636295b5011a46905121

1bd4f62fdad18b0c140dce9ad750f6de

2560a86361257837b78d7ba289a031fb

2d2ffa0422db66640561c46b8e428267

2f8d6c0c6a449f3c074cfc0d6c8dbfc6

300f850c0186077550830fa35edddc4e

39434e0d800b62a72e8dfa202e2da9cd

3a103ab0da4d13ccc9ed2d612de71441

4dde761681684d7edad4e5e1ffdb940b

5b9b2a796c88da82d75553c48488b63f

635d926cace851bef7df910d8cb5f647

649e482199c9eb826fa0fca7016c325d

68bf06fb2a8cef72a61b01dcd10fd10d

6aa92a03083a19783ddf4e4913c230d3

781228e0a889c0624a5f1d8e9f5b0b30

849b165f28ae8b1cebe0c7430f44aff3

868180d3f78ae330c8ab4e6c20045930

8bfbda4203cfb4bb7aaeafe7afe9748a

8d207e2b6d13ebd5fc4430ef3670558f

8e81f08432ba7d64c67032a2a5580a48

92defd440acfd41595ce20c9107c3262

93be88ab0908a9359d7e5472ace22fe5

9a111588a7db15b796421bd13a949cd4

9c6539c9f5b3e831d5bcb1357d51d049

b08d4099b14e37ceda1923681a2f70f2

c16feda9ad177c8f7e6a07f57d84851f

c46327a65a1f9bf9c367fbda95f1bd22

c89a06d5b3a55a45b7d508e6b9152aa8

d107c5dc752cd262cd4d6c461c8583c4

d2b8a429bcf9e0eca54939e2cd4408dc

d71d01d469414e992ded9038ea761564

d96bbc2b1e5cc6b085bf04a8e487632e

dd4b6f3216709e193ed9f06c37bcc389

eda730498b3d0a97066807a2d98909f3

Top talking botnet nodes from most recent data

177.128.34.146

122.165.131.7

80.92.189.5

78.187.20.244

85.105.104.74

94.156.57.84

112.196.16.26

185.101.27.48

82.209.9.181

187.85.255.194

103.123.46.51

213.174.31.77

103.97.244.22

103.41.56.62

187.85.248.209

103.59.134.156

88.247.16.223

89.160.95.67