P19 - A moose once bit my honeypot - A story of an embedded Linux botnet

# Overview Olivia Belo, a malware researcher at EET (now at Ghost Secure), presents analysis of Linux Moose, an embedded Linux botnet discovered in November 2014 and thoroughly analyzed in early 2015. Named after the French word "élan" found in the malware binary, Linux Moose targets embedded systems like consumer routers, DVRs, and IP cameras across ARM and MIPS architectures. The botnet operates a proxy service on port 10,073 to facilitate social media fraud operations.

# Key Topics The talk covers embedded Linux malware characteristics, reverse-engineering challenges, botnet architecture, operational capabilities, and incident response lessons. Linux Moose is a statically linked, stripped ELF binary that propagates via Telnet credential brute-forcing using a hardcoded list of 300+ username/password combinations. The malware lacks persistence—rebooting an infected router cleanses the infection—but can perform cross-architecture infection and kills competing malware processes hourly.

# Technical Details Reverse-engineering statically linked strip binaries proved extremely difficult because library code and malware code are indistinguishable. The solution involved recreating the exact build environment (uclibc 0.9.33 using OpenWRT toolchain), compiling libraries with symbols, and using bindiff to map over 225 library functions with high confidence. This enabled analysts to focus on actual malware logic rather than attempting to trace through hundreds of internal function calls.

Linux Moose exhibits sophisticated network capabilities: STUN-based NAT traversal allows it to bypass firewalls, a custom SOCKS4/5 proxy serves authorized clients only (identified by IP whitelist), and DNS hijacking capabilities enable network manipulation. The malware includes a remote configurable packet sniffer and worm-like propagation that dedicates multiple threads to scanning nearby IP ranges—bypassing some firewall rules more effectively than wide internet scanning.

The compromised protocol involves victim information transmission to the command-and-control server, which returns encrypted commands. Two payload delivery mechanisms exist: wget (vulnerable to replay attacks) and echo with x-escape characters (prevents binary extraction without full packet capture). Version 2 introduced CNC server specification via command-line argument instead of hardcoding, plus obfuscated integer encoding and 404 responses to unknown hosts.

# Operations & Discoveries Monitoring the live botnet revealed the malware's true purpose: social media fraud, not Bitcoin mining as initial AV classifications suggested. Analysis of HTTP/HTTPS traffic showed 18% operator HTTP traffic, with remaining traffic targeting Twitter, Instagram, Vine, YouTube, Yandex, and SoundCloud. The operators created new social accounts that rapidly accumulated followers through coordinated following patterns, targeting business/modeling accounts with minimal legitimate internet presence. Stolen social media cookies enabled this fraud infrastructure.

The botnet exhibits unexpected operational constraints: despite possessing VPN-capable proxy infrastructure, operators used it exclusively for social media fraud requests. The CNC server remains a critical single point of failure—when offline, all new infections cease immediately.

# Lessons Learned Analysts should avoid assuming custom protocols when standard ones suffice (the complex proxy description turned out to be standard SOCKS). String-based analysis and AV variant names can be misleading—the "Bitcoin miner" classification missed the malware's process-killing features. Most importantly, passive reverse engineering proved insufficient; deploying honeypots (QEMU VMs on cloud infrastructure) enabled understanding of actual attacker intent and botnet operations that binary analysis alone could not reveal.

# Updates & Takeaways The CNC server went dark weeks after the May 2015 research publication. Version 2 appeared before VB conference with new ports and command-line CNC specification. The authors released research artifacts including Python/shell script dissectors, fake server code, Tshark wrappers, Yara rules, and IOCs on EET's GitHub. Prevention remains simple: changing default router credentials eliminates the primary attack vector. The talk emphasizes that embedded Linux malware lacks the complexity of Windows threats, but insufficient visibility into infected device populations hampers impact assessment and threat prioritization. Awareness-raising about router security remains critical.