UPDATED x1: Mirai Scanning for Port 6789 Looking for New Victims / Now hitting tcp/23231

Published: 2016-12-19
Last Updated: 2016-12-21 16:29:31 UTC
by John Bambenek (Version: 2)
5 comment(s)

Early today, a reader reported they were seeing a big spike to inbound tcp/6789 to their honeypots. We have seen similar on DShield's data started on December 17.  It was actually a subject of discussion this weekend and this helpful data from Qihoo's Network Security Research lab attributes the large increase to Mirai, the default-password-compromising malware infected various IoT devices that are internet-connected.  It's hard to see in the graph as it is still not a huge (but still it is significant) portion of Mirai scanning traffic. Here is port-specific graphs from Qihoo as well showing the start time of the spike.  The command the it tries to execute once logged in is:

"`busybox telnetd -p 19058 -l /bin/sh`"

Current intelligence suggests this is an attempt to compromise DaHua devices and establishes a reverse shell on port 19508 if the compromise is successful.  The usual defenses apply here (keep this stuff off the public internet, manufacturer's please stop shipping devices with telnet and default passwords) but the amount of potential bandwidth Mirai operators have under their control could potentially swamp even the most robust DDoS defenses. 

Let us know if you see other interesting behavior and feel free to update your honeypots to capture some of the attack code if you can.

UPDATE 21 Dec 2016 @ 1623 UTC: In the last 24 hours another shift has been detected now going after port 23231.

--
John Bambenek
bambenek \at\ gmail /dot/ com
Fidelis Cybersecurity

Keywords: ddos mirai
5 comment(s)

Comments

I'm just now seeing an increase towards TCP/23231. This is not Mirai using HTTP POST and XML, but something similar to the telnet behaviour found on port 2323.

From the Cowrie log:

2016-12-20 20:49:40+0100 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 41.230.2.20:33048 (my.ip:2223) [session: TT85902]
2016-12-20 20:49:40+0100 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 41.230.2.20:33050 (my.ip:2223) [session: TT85903]
2016-12-20 20:49:48+0100 [CowrieTelnetTransport,85902,41.230.2.20] login attempt [admin/7ujMko0admin] failed
2016-12-20 20:49:48+0100 [CowrieTelnetTransport,85902,41.230.2.20] Warning: state changed and new state returned
2016-12-20 20:49:51+0100 [CowrieTelnetTransport,85903,41.230.2.20] login attempt [admin/7ujMko0admin] failed
2016-12-20 20:49:51+0100 [CowrieTelnetTransport,85903,41.230.2.20] Warning: state changed and new state returned
2016-12-20 20:50:00+0100 [CowrieTelnetTransport,85902,41.230.2.20] login attempt [enable\x00/system\x00] failed
2016-12-20 20:50:00+0100 [CowrieTelnetTransport,85902,41.230.2.20] Warning: state changed and new state returned
2016-12-20 20:50:02+0100 [CowrieTelnetTransport,85903,41.230.2.20] login attempt [enable\x00/system\x00] failed
2016-12-20 20:50:02+0100 [CowrieTelnetTransport,85903,41.230.2.20] Warning: state changed and new state returned
2016-12-20 20:50:07+0100 [CowrieTelnetTransport,85902,41.230.2.20] login attempt [shell\x00/sh\x00] failed
2016-12-20 20:50:07+0100 [CowrieTelnetTransport,85902,41.230.2.20] Warning: state changed and new state returned
2016-12-20 20:50:09+0100 [CowrieTelnetTransport,85903,41.230.2.20] login attempt [shell\x00/sh\x00] failed
2016-12-20 20:50:10+0100 [CowrieTelnetTransport,85903,41.230.2.20] Warning: state changed and new state returned
2016-12-20 20:50:43+0100 [CowrieTelnetTransport,85902,41.230.2.20] Connection lost after 63 seconds
2016-12-20 20:50:47+0100 [CowrieTelnetTransport,85903,41.230.2.20] Connection lost after 66 seconds
I was seeing a large number of port 23231 connections earlier but now I'm seeing more on TCP 23123 - several per minute from numerous source IPs, so far all in China. I'm not open on this port and don't run a honeypot but suspect it's part of the same thing.
the 23123 is very likely a false positive, at least that is not something botnet driven. On the backbone level, I do see there was a very short burst of flows on port 23123, but the number of total unique ips has no big change for the last few days
I started seeing port 23231 traffic at 0919 EST 12/20 on my home firewall, port 6789 started at 1400 EST 12/17. There was very little traffic on either of these ports previously.

I haven't seen one packet hit my firewall on port 23123 in this search.

This is the top several ports on packet count over the last 7 days.

DPT count
23 15359
68 3117
2323 1134
6789 581
7547 580
23231 563
5060 341
1433 328
I'm curious about a target that uses port 6789.

Is DaHua devices to use 6789?
yesterday, I was searched information about 6789 port in Google.
then, I've seen that smc use 6789 on port.

Diary Archives