Hello, welcome to the Wednesday, June 16th, 2021 edition of the Sandtonet Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida, and still teaching virtually in Paris, France.

Of course, more than abilities in perimeter security devices are all the rage these days, so no real

big surprise that we also have some botnets jump on the bandwagon.

Have observed the Mirai botnet, at least one version that is associated with some of the

original Mirai code using a relatively reasoned kind of

sonic wall vulnerability for the last couple days in order to look for new victims.

The vulnerability here well is not new in the sense that it is a shell shock. Shell shock, of course,

has been around since 2014. Sonic Wall has released updates in 2015 with firmware SMA 8004,

but apparently there are devices that were left out or not patched, and that sort of became news again a couple months

ago with the rediscovery of these flaws. We now have this particular version of Mirai

scanning for this vulnerability. This particular version has a number of other sort of tricks up its sleeve and it seems to be going sort of for, for example, for dealing firewalls as well, also for Cisco Hyperflex.

It does have an exploit that we observed scanning for a Ruby Webric vulnerability. In addition to a number of additional warn abilities that it's

scanning for based on the data from the binary that it's downloading, but actually observed

in our logs, we only saw a couple of these vulnerabilities. So some of them may only get scanned for if the server does provide a specific response.

Other than that, really just, no, Mirai, as usual, it first downloads a little shell file

that will then download a number of binaries for different architectures and run them and basically

see what sticks, see what runs, and that will then be continuing the scanning.

As far as defenses go for this particular botnet, don't really worry about it.

You either are warnable and have been exploited a long time ago,

or you are already patched.

And I've got some interesting new open source software from Google, and that's a homomorphic

...