Full Report
Cado Security Labs discovered two campaigns exploiting misconfigured Selenium Grid instances to deploy malware, including an exploit kit, cryptominer, and proxyjacker. Selenium Grid is widely used for browser automation and testing, but its default configuration lacks authenti...
Analysis Summary
# Tool/Technique: Exploitation of Misconfigured Selenium Grid
## Overview
An attack vector involving the exploitation of improperly secured Selenium Grid instances, which are commonly used for automated browser testing. The lack of authentication in default configurations allows attackers to inject and execute arbitrary code, leading to the deployment of various malicious payloads, including cryptominers, proxyjackers, and reverse shells.
## Technical Details
- Type: Technique/Exploitation Workflow
- Platform: Linux (inferred by ELF binaries, Docker, cron jobs)
- Capabilities: Remote code execution via HTTP/POST requests against the vulnerable Grid interface, subsequent lateral movement, and payload deployment.
- First Seen: Discovered across campaigns noted around September 2024.
## MITRE ATT&CK Mapping
- TA0001 - Initial Access
- T1190 - Exploit Public-Facing Application
- T1190.004 - Exploit Cloud Instance
- TA0002 - Execution
- T1059 - Command and Scripting Interpreter
- T1059.006 - Python
- T1059.004 - Unix Shell
- TA0004 - Privilege Escalation
- T1068 - Exploitation for Privilege Escalation (via PwnKit usage mentioned in the second campaign)
- TA0011 - Command and Control
- T1090 - Proxy
## Functionality
### Core Capabilities
- Initial access gained by sending malicious commands/scripts through the Selenium Grid's exposed interface.
- Execution of base64-encoded Python scripts for initial payload staging.
- Deployment of utilities like **GSocket** (reverse shell) and **IPRoyal** (proxyjacking).
- Disabling system logging by setting the `HISTFILE` variable.
### Advanced Features
- **Persistence**: Using cron jobs for long-term execution.
- **Privilege Escalation**: Utilizing the **PwnKit** exploit to gain elevated rights.
- **Evasion**: Employing **UPX packing** on ELF binaries to complicate static analysis.
- **C2 Obfuscation**: Connecting to **Tor nodes** for command and control traffic.
- **Containerization Abuse**: Installing and utilizing **Docker** to deploy infrastructure (e.g., Traffmonetizer, WatchTower).
## Indicators of Compromise
*Note: Specific hashes/IPs are not provided in the context, but indicators relate to the deployed tools.*
- File Hashes: [Unknown - ELF binary packed with UPX]
- File Names: `pl` (second-stage script), `top` (SHC compiled ELF binary/cryptominer)
- Registry Keys: [Not applicable/Observed on Linux]
- Network Indicators: Connections involving **Tor nodes** for C2 data exfiltration/command reception. Use of **Traffmonetizer** mechanisms.
- Behavioral Indicators: Setting of `$HISTFILE` to null or `/dev/null`, execution of base64 decoded commands via web automation frameworks, execution of downloaded ELF binaries, spawning of Docker containers for specific malware infrastructure.
## Associated Threat Actors
- Unknown (Described as two distinct campaigns, suggesting activity from multiple unattributed groups leveraging readily available exploitation vectors).
## Detection Methods
- **Signature-based detection**: Signatures for known UPX packed binaries, presence of the IPRoyal or common cryptominer binaries.
- **Behavioral detection**: Monitoring HTTP requests against Selenium Grid endpoints containing suspicious base64 encoded commands or shell artifacts. Detection of processes modifying the `HISTFILE` environment variable. Monitoring for known privilege escalation techniques like PwnKit usage post-exploitation.
- **YARA rules**: Rules targeting the unique strings or structural elements of the downloaded secondary scripts or the UPX-packed ELF binaries.
## Mitigation Strategies
- **Prevention**: Never expose Selenium Grid instances to the public internet without robust authentication and authorization mechanisms.
- **Hardening recommendations**: Implement strong authentication (e.g., using basic auth or service meshes) for all Selenium Grid endpoints. Follow the principle of least privilege for the user running the Selenium service. Regularly patch systems against known vulnerabilities like PwnKit.
- **Network Segmentation**: Ensure Selenium Grid instances reside on isolated networks where possible, preventing easy pivoting or data exfiltration.
## Related Tools/Techniques
- **GSocket**: Used as a reverse shell payload.
- **IPRoyal Pawns**: Used for proxyjacking (reselling victim bandwidth).
- **PwnKit (CVE-2021-4034)**: Used for privilege escalation.
- **Traffmonetizer**: Deployed via Docker for potential traffic monetization/abuse.
- **WatchTower**: Deployed via Docker, often used for automatic container updates, potentially maintained by the threat actor.