OMNI Bot variant discovered in Polycom devices.

Overview:

Internet of Things (IoT) devices are targeted by cybercriminals to launch a variety of attacks on the Internet. Cybercriminals prefer to build botnets — which are a collection of compromised machines controlled via centralized command and control (C&C) servers. IoT botnets are on the rise in recent years. Mirai was the most advanced IoT botnet that came to exist. Mirai botnet was also the primary source of launching DDoS against Dyn DNS solution provider.

IoT botnets are formed by compromising IoT devices by exploiting inherent security flaws such as vulnerabilities, weak configurations, insecure authentication, etc. The compromised IoT devices are then used to perform nefarious operations such as Brute-force attacks, Distributed Denial of Service (DDoS) attacks, transforming IoT device into a proxy server and many others.

In this research note, WootCloud detected the presence of OMNI  bot (a variant of Mirai) in the Polycom video conferencing systems that were exposed on the Internet. The research has been a collaborative effort between the WootCloud threat research team and the Polycom security team.

Analysis: OMNI Bot Indicators of Compromise

WootCloud performed analysis on the compromised Polycom HDX systems.  Generally, these systems have a built-in debug interface that provides information about the activities occurred on the device in the log format.  The debug flags have to be enabled in the configuration settings so that the device can log all the messages. Further, WootCloud performed log analysis and forensics on the infected machine to detect threats. A number of Polycom devices were found to be running Omni bot which performed brute-force and password cracking operations from the device via telnet interface.

It has been noticed that the Polycom devices are shipped with binaries such as BusyBox, Wget, and others.  Presence of these binaries on the device itself provides an attacker with a capability to launch operations stealthily without downloading additional binaries from the C&C server.  Omni bot extensively uses the binaries such as BusyBox, Wget, and others for performing a different set of operations.

OMNI bot brute-force attack is detected via DEBUG logs generated from the compromised Polycom device. The attack is dissected below:

1. The OMNI bot triggers the “enable” command
2. After that, “system” command is executed
3. Once the “system” command is executed, the “sh” command is triggered to obtain the shell access rights so that specific payload can be executed
4. After entering the shell with “sh”,  The OMNI bot calls its main functions by loading the “/bin/busybox” with OMNI payload as “/bin/busybox/ OMNI”

The communication is highlighted below:

1. Once the primary “/bin/busybox/ OMNI” is loaded, it triggers the brute-force attack as explained below:
   1. A command is executed as “execwithoutecho systemsetting telnet_client_”
      • The “execwithoutecho” executes the command without throwing any notification or output via echo.
      • The command executed is “telnet_client” which opens connection to remote IP running telnet service
      • The “OMNI” bot then uses combination of username and password as strings to launch authentication attempts. In the DEBUG logs presented below, it started with “root:root”, “zlxx:zlxx” as username and password combination.

The communication logs are shown below:

After trying few combinations of username and password, the process is repeated again as shown below:

If the DEBUG logs are dissected in detail, it can be noticed that the “appcom:ap_command”, “appcom:legacy_api_command”, “appcom:java_api_command” primarily belongs to the AVC binary.

The log analysis and forensics performed on the compromised device highlights the presence of OMNI bot infections on the Polycom HDX devices.

Countermeasures

• Always configure passwords for the interfaces such as Telnet, Web, SNMP, etc.  on the Polycom devices.
• Always update the password from default string to more complex string
• Implement WootCloud solution in the enterprise which has built-in detection and prevention algorithms to subvert the OMNI bot infections
• Always configure network policies in accordance with the VLAN segmentation to restrict the ingress and egress network traffic  to the IoT device

Inference

• Polycom HDX devices for audio/video conferencing have been found infected with OMNI botnet, a variant of MIRAI
• The attackers are harnessing the power of open-source software packages such as “BusyBox”, WGet”, and others that are shipped with the embedded firmware of the Polycom devices
• Compromised Polycom devices  are used to launch brute-force attacks, potential DDoS attacks and also been used as proxy devices for routing malicious communications such as Command and Control (C&C)
• APIs supported by Polycom devices are abused by the attackers for performing unauthorized operations on the device

Responsible Disclosure

Under the responsible disclosure guidelines,  the findings have been reported to the Polycom Security team. Polycom has released the associated bulletin highlighting the best security practices to reduce the impact of OMNI bot and handling infections accordingly. The bulletin can be fetched at

• Security center
• Security bulletin

WootCloud thanks Polycom security team to work in collaboration and releasing the guidelines for customers to detect and prevent  OMNI bot infections.