Hackers Launching Millions of Attacks to Exploit Critical Realtek SDK Vulnerability

Within the latter half of of 2022, a first-rate exchange of cyber attacks utilizing a miles-off code execution vulnerability in Realtek Jungle SDK had been reported. These attacks, numbering 134 million, aimed to compromise shapely devices.

The vulnerability in question grants unauthorized get entry to to affected devices, enabling attackers to carry out code and accomplish entire aid watch over over them.

The vulnerability has been identified by the Unit 42 researchers as CVE-2021-35394, with a excessive severity score of 9.8 out of 10, and has been centered by various malicious actors.

Palo Alto Networks detected a first-rate lengthen in exploitation makes an strive for the vulnerability in question, tracked as accounting for bigger than 40% of all incidents, one day of the months of August to October in the earlier yr.

In total 190 devices of devices had been laid low with the CVE-2021-35394, as heaps of of comparatively just a few kinds of devices utilize Realtek’s RTL8xxxx chips. And right here below we secure mentioned the inclined ones:-

• Routers
• Residential gateways
• IP cameras
• Wi-Fi repeaters from 66 comparatively just a few manufacturers (Like Asus, Belkin, D-Hyperlink, Huawei, LG, Logitech, Netgear, ZTE, and Zyxel)

Vulnerability Profile

• CVE ID: CVE-2021-35394
• Imperfect Ranking: 9.8
• Severity: Serious
• Description: Realtek Jungle SDK version v2.x up to v3.4.14B offers a diagnostic system known as ‘MP Daemon’ that’s generally compiled as ‘UDPServer’ binary. The binary is laid low with a lot of reminiscence corruption vulnerabilities and an arbitrary converse injection vulnerability which may perchance presumably well also simply even be exploited by a long way-off unauthenticated attackers.

The Exploitation of the Vulnerability

The emergence of a extremely effective botnet malware, dubbed “RedGoBot,” became seen in the wild starting in September 2022. While this malware particularly targets IoT devices that are inclined to CVE-2021-35394.

As a outcomes of these attacks, three comparatively just a few kinds of payloads had been delivered, and right here below we secure mentioned them:-

• An executable script that downloads malware to the purpose server by executing a shell converse.
• An injectable converse that writes and executes a binary payload.
• A converse became injected into the server which caused the server to reboot.

There are just a few botnet malware households to blame for comparatively just a few these attacks, and right here they are mentioned below:-

• Mirai
• Gafgyt
• Mozi

In September, RedGoBot additionally exploited this vulnerability to behavior DDoS attacks. To boot to the flooding programs that the botnet supports, it is a long way able to performing DDoS attacks on the following protocols:-

• HTTP
• ICMP
• TCP
• UDP
• VSE
• OpenVPN

Attack Origins

By ability of the origins of the attack, there secure been bigger than thirty international areas involved. A Forty eight.3% a part of all attacks accomplish from the United States, making it the country that generates essentially the most attacks.

There just isn’t this kind of thing as a doubt that these countries are in the tip seven countries from where security consultants secure seen threat actors taking part in these attacks, at the side of the following:-

• Vietnam
• Russia
• The Netherlands
• France
• Luxembourg
• Germany

On August 15, 2021, Realtek took motion to condominium a exchange of crucial security vulnerabilities, at the side of the flaw identified as CVE-2021-35394.

Sadly, this vulnerability, alongside with others like CVE-2021-35395, became snappy centered by malicious actors. As no longer too long ago as December, botnets had been still exploiting these vulnerabilities.

Suggestions

The excessive quantity of attacks which secure been seen leveraging CVE-2021-35394 is a sure indication that cybercriminals are actively in quest of out vulnerabilities within a firm’s offer chain.

These kinds of vulnerabilities may perchance presumably well even be no longer easy for folk to detect and fix, highlighting the significance of offer chain security.

Here below we secure mentioned the suggestions offered by the consultants:-

• Implement phenomenal security protections with Subsequent-Expertise Firewalls.
• Construct sure to discover the patches continuously.
• All the time aid the devices up-to-date with the most recent upgrades.
• In case of an infection discover a manufacturing facility reset on the system.