New Linux Malware Steals Call Details from VoIP Softswitch Systems

“The primary goal of the malware is to exfiltrate various
private data from a compromised softswitch, including call detail
records (CDR^[1]),” ESET researchers said
in a Thursday analysis^[2].

“To steal this metadata, the malware queries internal MySQL
databases used by the softswitch. Thus, attackers demonstrate a
good understanding of the internal architecture of the targeted
platform.”

ESET’s research uncovered that CDRThief targeted a specific
Linux VoIP platform, namely the VOS2009 and 3000 softswitches from
Chinese company Linknat, and had its malicious functionality
encrypted to evade static analysis.

The malware starts off by attempting to locate the Softswitch
configuration files from a list of predetermined directories with
the goal of accessing the MySQL database credentials, which are
then decrypted to query the database.

ESET researchers say the attackers would have had to reverse
engineer the platform binaries to analyze the encryption process
and retrieve the AES key used to decrypt the database password,
suggesting the authors’ “deep knowledge” of the VoIP
architecture.

Besides scooping up basic information about compromised Linknat
system, CDRThief exfiltrates details of the database (username,
encrypted password, IP address) and executes SQL queries directly
to the MySQL database in order to capture information pertaining to
system events, VoIP gateways, and call metadata.

“Data to be exfiltrated from the e_syslog, e_gatewaymapping, and
e_cdr tables is compressed and then encrypted with a hardcoded
RSA-1024 public key before exfiltration. Thus, only the malware
authors or operators can decrypt the exfiltrated data,” ESET
said.

In its current form, the malware appears to be focused only on
gathering data from the database, but ESET warns that could easily
change should the attackers decide to introduce more advanced
document stealing features in an updated version.

That said, the ultimate goal of the malware authors or
information about the threat actor behind the operation still
remains unclear.

“At the time of writing we do not know how the malware is
deployed onto compromised devices,” ESET’s Anton Cherepanov said.
“We speculate that attackers might obtain access to the device
using a brute-force attack or by exploiting a vulnerability.”

“It seems reasonable to assume that the malware is used for
cyberespionage. Another possible goal for attackers using this
malware is VoIP fraud. Since the attackers obtain information about
activity of VoIP softswitches and their gateways, this information
could be used to perform International Revenue Share Fraud (IRSF^[4]).”

^[3]