Slingshot APT

Update:
If you want to check if you are infected then you can use the Loki scanner:

GitHub page Neo23x0: https://github.com/Neo23x0/
Download Loki: https://github.com/Neo23x0/Loki/releases

Information from Mikrotik: https://forum.mikrotik.com/viewtopic.php?f=2&t=131748&p=647104#p647661

Before doing that please read the complete thread!

I just read an article on a Dutch site how Mikrotik routers are compromised to spy on users. This goes with the help of Winbox lower than 3.12 and a modified DDL file loaded from the router with the name ipv4.dll, when Winbox starts.

Source:
https://www.security.nl/posting/553185/Spionageaanval+via+gehackte+MikroTik-routers+ontdekt

Kapersky PDF report with details:
https://s3-eu-west-1.amazonaws.com/khub-media/wp-content/uploads/sites/43/2018/03/09133534/The-Slingshot-APT_report_ENG_final.pdf

Update:
After reading more in the report Mikrotik states up to RouterOS version 6.38.4 was vulnerable for injecting unwanted software into a PC.

Translation from Dutch to English:

Anti-virus company Kaspersky Lab has detected a spy attack through hacked MikroTik routers that has made victims mainly in Africa and the Middle East. According to the virus fighter, it is an attack that is comparable in complexity to two previously discovered espionage attacks known as Regin and Sauron .

Slingshot, as the group behind the attack is called, uses compromised MikroTik routers to infect victims. MikroTik offers customers a program called WinBox to manage routers. This program, which is on the router, downloads a number of dll files from the router’s file system and loads them directly into the computer’s memory.

To infect administrators of MikroTik routers, the attackers have placed a malicious version of the dll file named ipv4.dll on the compromised routers. After being added, this dll file is downloaded and executed by WinBox. According to the researchers, this DLL is a Trojan downloader that installs additional malware on the system. How the attackers managed to hack the MikroTik routers and provide the malicious dll file is unknown.

What the researchers do know is that the dll file downloads various modules, including a kernel module and a user-mode module. These modules are designed to collect and steal data and keep the system compromised. To run code in kernel mode, Slingshot loads signed vulnerable drivers. Through the vulnerabilities in these drivers, the malware executes its own code. Because the code with kernel rights is executed, it has full control over the system and can hide itself for anti-virus software.

Cyber ​​espionage
The goal of Slingshot is cyber espionage. The research shows that the malware collects screenshots, keyboard data, network data, passwords, USB connections, desktop activity, the contents of the clipboard and other data and sends them back to the attackers. What is remarkable about the malware is that it disables the software for defragmenting the hard drive. Slingshot uses its own encrypted file system that can be in an unused part of the hard drive. When defragmenting the hard disk, data can be written to this part, which can damage the virtual file system.

According to Kaspersky Lab, Slingshot has been active since 2012 and is still operational. The anti-virus company has seen about 100 victims in Kenya, Yemen, Afghanistan, Libya, Congo, Jordan, Turkey, Iraq, Sudan, Somalia and Tanzania. Most victims are individuals rather than organizations, but various government organizations and institutions are also affected by the malware. Most victims were observed in Kenya and Yemen. MikroTik told Kaspersky Lab in a comment that the latest version of WinBox no longer downloads the ipv4.dll file to the computer, with which this attack vector is closed. In this report ( pdf ), Kaspersky Lab provides information and hashes of files and domains that the malware uses.

Here’s a bleepingcomputer.com article on it: https://www.bleepingcomputer.com/news/security/cyber-espionage-group-infects-victims-through-microtik-routers/

There is also a Wired article.

I can see why all wifi/router/switch devices would become targets..

Edit: also found Wired’s “Kaspersky, Russia and the Antivirus Paradox”. Also worth reading.

Would be lovely to receive an updated statement from Mikrotik on this.

\

The Wired article includes our comment and is pretty accurate. As far as we know, somebody exploited the already fixed chimayred vulnerability in open (no firewall) routers before we patched it in March 2017 (RouterOS v6.38.5). Upgrading RouterOS fixes the vulnerability and removes any malicious files.

Also worth noting, that Winbox no longer downloads any DLL files from your device anyway, since even before the above mentioned version.

Always keep your router up to date.
https://www.wired.com/story/router-hacking-slingshot-spy-operation-compromised-more-than-100-targets/

Hi,

I am in Kenya, and have deployments of a few hundred devices, though most of them sit inside private MPLS WANs. As far as I know we have not been exposed to this. How do I know if I have? By reading the Kaspersky report, it seems that even if I sort out the router, the issue still remains on any windows machines already exploited. Have I understood this correctly?

In all our cases our devices were up to date, but part of Normis comment makes me wonder:
Normis: “exploited the already fixed chimayred vulnerability in open (no firewall) routers”

My questions is what firewalling is required to prevent the exploit? Is it simply blocking / preventing winbox port 8291 (or whatever custom port is defined) from outside? Or are there other known entry points for the exploit that we need to firewall against?

I look forward to some advice.

Thanks,

Alex

Simply upgrading your RouterOS device will make sure nothing can be installed into it and will remove any rogue files.

The vulnerability exploited open port 80 from Internet side. Don’t leave any open ports on the input chain unless you limit access to your own IP.

Also having some sort of antivirus in your windows machine will remove any residual DLL files, if Kaspersky already says they have identified it.

Simply upgrading easy said but users can have reasons to stay on a version that works for them.

Maybe implement very restrictive setting as default and not just as default firewall rules but as hard setting that can disabled/enabled like services.

Look, you guys cannot ask Mikrotik to fix a problem they already fixed a year ago and then complain the solution of upgrading is off the table because you need to sit on a 12 month or older version of RouterOS that you can’t take the time to update properly because your config is “complicated”.

I have “complicated” configs and I’ve updated to the 6.41+ versions which meant I had to do a lot more with my configs than going from 6.38.x to 6.40.x.

It is not that the configs are complicated. In my case it is the performance dropping under lpt2/ipsec in the new bridge implementation. I will have to wait until this is solved.

Then it is wise to learn from errors and learn from them to avoid current and new errors.

Thanks, this is clear.


\

Issue was solved long before new bridge

For non-experts, how can somebody test that the vulnerability isnt there? Has Winbox particularly ever been audited?
When I launch winbox under wine it seems to be loading plugins and also the wine log (or window if its been launched from a shell) keeps repeating “IPV6_ADD_MEMBERSHIP:” (string) even though IPv6 has been disabled on all the linux machines on the network which is to say everything besides the router.

I think my first few launches of winbox were before the current version. Is there some simple way somebody can check for the presence of whatever files are involved by name or hex signature?

Their report gives hex signatures, presumably for their own products? Can they be used with some other scanning method?

I know that and I was anticipating for the next one that is certainly to come.

Can you elaborate on how this was solved? This particular exploit was fixed, but are there any measures in place to prevent this happening again? Does winbox now verify the files downloaded from the router with a digital signature? Are all the files now client-side?

Winbox no longer downloads anything from the router (if using new winbox and new RouterOS). Also, the router now checks all internal file signatures itself.

That’s good to hear. The self-integrity check seems a bit pointless though, if the device is exploited an attacker could easily bypass or disable such a feature.

I hope work is also being made to enable host verification for winbox connections, since in its current form it is vulnerable to a MITM attack.

If Winbox is downloading DLL files, it means your device hasn’t been upgraded and you are running an outdated Winbox version. Please upgrade both RouterOS and Winbox.

Another thing to note. This “malware” did not spread. It was installed manually to very specific targets, through a now-closed vulnerability. They have discovered only a handful affected devices.

Hi, from which version of Winbox specifically does not download anything from RouterOS?

Many thanks