Emerging IoT Threat: Exploitation of DigiEver DS-2105 Pro DVRs

The rise of IoT (Internet of Things) devices in security and surveillance systems has revolutionized the way we protect our assets and spaces. However, with these advancements come vulnerabilities that can be exploited by malicious actors. The recent exploitation of DigiEver DS-2105 Pro Digital Video Recorders (DVRs) by Mirai-based malware is a stark reminder of the evolving cyber threats targeting IoT infrastructure.

Understanding the DigiEver DS-2105 Pro DVR and Its Role

The DigiEver DS-2105 Pro DVR is a commonly used device in surveillance systems, designed to record and manage video streams from connected cameras. Its robust capabilities make it a cornerstone for organizations relying on video surveillance. Unfortunately, its pivotal role also makes it an attractive target for cybercriminals.

In this incident, the DigiEver DVR was found to have a critical Remote Code Execution (RCE) vulnerability in its /cgi-bin/cgi_main.cgi endpoint. This flaw allowed attackers to execute unauthorized commands, effectively compromising the device and enlisting it into a botnet orchestrated by a variant of the infamous Mirai malware.

Details of the Attack

The attack begins with the exploitation of the RCE vulnerability, enabling the installation of a Mirai variant. This malware, notorious for building botnets from IoT devices, leveraged the compromised DVRs to:

• Participate in Distributed Denial of Service (DDoS) attacks: By flooding targeted systems with traffic, these botnets can incapacitate websites and services.
• Collect System Information: The malware gathers details about the infected DVR to optimize its malicious activities.
• Encrypt Data for Ransomware: In some instances, the malware encrypts files, demanding ransom for their recovery.

Indicators of Compromise (IoCs)

To assist organizations in identifying potential infections, the following IoCs have been observed:

• File Hashes (SHA256):
• fa0f85e37cf4ebaacefd7f2e8cd686915b04efeb76eaed4205c17d95cdc07957
• bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85cf0138
• Malicious Hostname:
• afb83dd09526a6517.awsglobalaccelerator.com
• Exploited CVE:
• CVE-2017-9841: A well-documented vulnerability exploited in this campaign.

Tactics, Techniques, and Procedures (TTPs)

The attackers utilized sophisticated methods to maximize their impact:

• System and File Discovery (T1082, T1083): Scanning for valuable information on infected devices.
• PowerShell Execution (T1059.001): Employing scripts to maintain persistence and control.
• Data Encryption for Impact (T1486): Deploying ransomware-like tactics.

Impact of the Incident

The compromised DigiEver DVRs served as launch points for malicious activities, including:

• Network Disruption: DDoS attacks caused widespread outages for targeted organizations.
• Data Exfiltration: Sensitive surveillance footage and system data were at risk.
• Operational Downtime: Organizations relying on these DVRs faced service interruptions and increased recovery costs.

Sentry’s Recommendations

At Sentry Intelligence Services, we emphasize the importance of proactive measures to secure IoT devices and prevent incidents like this from impacting your operations. Here’s how you can protect your systems:

1. Patch Vulnerabilities:

• Ensure all DigiEver DS-2105 Pro DVRs are running the latest firmware versions to address known vulnerabilities.

1. Change Default Credentials:

• Replace factory-set usernames and passwords with strong, unique combinations to limit unauthorized access.

1. Network Segmentation:

• Isolate IoT devices from critical infrastructure to minimize potential lateral movement by attackers.

1. Regular Monitoring:

• Use advanced network monitoring tools to detect and mitigate unusual traffic patterns associated with IoCs.

1. Adopt Comprehensive Security Practices:

• Employ intrusion detection systems, firewalls, and regular security audits to enhance defenses.

1. Incident Response Readiness:

• Develop and maintain an incident response plan to handle breaches effectively.

Conclusion

The DigiEver DS-2105 Pro DVR exploitation highlights the urgent need for organizations to prioritize IoT security. By addressing vulnerabilities, adopting strong cybersecurity practices, and leveraging the expertise of Sentry Intelligence Services, organizations can mitigate risks and safeguard their digital assets.