Multiple DDoS Botnets Exploited 0-Day Flaws in LILIN DVR Surveillance Systems

The findings come from Chinese security firm Qihoo
360^[2]‘s Netlab team, who say
different attack groups have been using LILIN DVR zero-day
vulnerabilities to spread Chalubo^[3], FBot^[4], and Moobot^[5] botnets at least since
August 30, 2019.

Netlab researchers said they reached out to LILIN on January 19,
2020, although it wasn’t until a month later the vendor released a
firmware update
(2.0b60_20200207) addressing the vulnerabilities.
^[6]

The development comes as IoT devices are increasingly being used as
an attack surface
to launch DDoS attacks and as proxies to engage in various forms of
cybercrime.

What Are the LILIN Zero-Days About?

The flaw in itself concerns a chain of vulnerabilities that make
use of hard-coded login credentials (root/icatch99 and
report/8Jg0SR8K50), potentially granting an attacker the ability to
modify a DVR’s configuration file and inject backdoor commands when
the FTP or NTP server configurations are synchronized.

The newly patched version addresses the flaws by validating the
hostname so as to prevent command execution.

Enforce Strong Passwords

Netlab said the operators behind Chalubo botnet were the first to
exploit the NTPUpdate vulnerability to hijack LILIN DVRs last
August. Subsequently, FBot botnet was found using the FTP / NTP
flaws earlier this January. Two weeks later, Moobot began spreading
through the LILIN 0-day FTP vulnerability.
The researchers said they reached out to LILIN twice, first after
the FBot attacks, and then a second time after the Moobot
infections happened.

Although Netlab didn’t go into specifics of the motives behind
the infections, it wouldn’t be surprising if they were used by
threat actors to perform distributed denial-of-service (DDoS)
attacks on websites and DNS services.

“LILIN users should check and update their device firmwares in a
timely fashion, and strong login credentials for the device should
be enforced,” Netlab researchers said.

^[1][7]