The Proliferation of the Cling Botnet via Realtek SDK Exploits

In a significant development for network security, cyber threat actors have been observed actively exploiting a critical vulnerability within the Realtek Jungle Software Development Kit (SDK) to propagate a new botnet variant known as Cling. This campaign leverages a now-patched security flaw, specifically CVE-2021-35394, which impacts numerous IoT and networking devices relying on the Realtek SDK, underscoring the persistent challenges in securing the vast landscape of connected devices.

Exploiting a Critical Flaw

The Realtek Jungle SDK is widely deployed across a multitude of devices, from routers and access points to IP cameras, making any vulnerability within it a high-stakes target for malicious actors. The exploited flaw allows for remote code execution, granting attackers unauthorized access and control over compromised devices. Once a device is breached, the Cling botnet malware is deployed, integrating the device into a larger malicious network capable of launching further attacks, such as Distributed Denial of Service (DDoS) campaigns or cryptocurrency mining.

Cling Botnet's Innovative Command-and-Control Mechanism

What distinguishes the Cling botnet from many of its contemporaries is not its initial propagation method, which relies on a known exploit, but rather its ingenious use of the Session Traversal Utilities for NAT (STUN) protocol for its command-and-control (C2) communications. Traditionally, STUN is employed to enable devices behind Network Address Translators (NATs) to establish direct peer-to-peer connections, commonly seen in VoIP, video conferencing, and online gaming applications.

Security researchers at Nozomi Networks highlighted this unique approach, noting that Cling repurposes ordinary STUN behavior into a practical C2 channel. Instead of relying on conventional C2 servers that can be easily identified and blocked, Cling leverages STUN servers to relay commands to compromised devices. This method offers several advantages for the attackers: it can bypass traditional firewall rules designed to block suspicious outbound traffic, blend in with legitimate network traffic, and make C2 infrastructure more resilient and difficult to disrupt. By masquerading C2 traffic as legitimate STUN requests, Cling enhances its stealth and operational longevity.

Implications for IoT Security

The emergence of the Cling botnet serves as a stark reminder of the ongoing security vulnerabilities present in IoT ecosystems. The slow patching cycles for many consumer and enterprise IoT devices leave them exposed to exploits long after vulnerabilities are discovered and patched by vendors. This campaign highlights the need for:

• **Prompt Patching:** Device manufacturers and users must prioritize the timely application of security updates.
• **Network Segmentation:** Isolating IoT devices on separate network segments can limit the lateral movement of threats.
• **Enhanced Monitoring:** Advanced network monitoring solutions capable of detecting anomalous STUN traffic patterns are becoming increasingly crucial.
• **Supply Chain Security:** Greater scrutiny is needed across the supply chain to ensure components like SDKs are secure by design.

Summary

The exploitation of the Realtek Jungle SDK to deploy the Cling botnet, particularly its innovative STUN-based command-and-control mechanism, represents an evolving threat landscape. While the initial vulnerability has been addressed, the sheer volume of unpatched devices remains a significant concern. The repurposing of standard network protocols like STUN for malicious purposes illustrates the continuous adaptation of cybercriminals, necessitating equally adaptive and proactive defensive strategies from organizations and individuals alike.

Resources

• Nozomi Networks Report on Cling Botnet
• The Hacker News Article on Cling Botnet
• CVE-2021-35394 Details