To make things easy to quickly scroll through this post to the bits you're interested in, I've made a handy table of contents^.

Introduction

So this week has been an interesting one on the Internet, and what started as a spontaneous project following a patch release(CVE-2020-1350) quickly gained traction becoming one of my most successful GitHub repositories/posts to date. However it has also sparked an accidental research project which in turn has been dubbed a honeypoc which is easier to say than fake-CVE-2020-1350-not-so-malicious-just-a-rick-roll-on-steroids.

Winding back for just a second, if you're reading this thinking what am I on about, you might want to check out the other blog post I made about the fallout. The original post currently has received around half a million reads which is a little insane, so thanks everyone for picking it up and having a gander.

None of this analysis would be possible without the following awesome folks:

• TJ Null
• ZoomerX

Disclaimer: I'm not a data analyst at all. However, here are some of the stats that we were able to collect from the canary tokens that were placed in our POC repository.

Blog Stats

The graph below is all the requests to the blog in the last few weeks, the peak is the week that the honeypoc was tweeted.

The repository contained four canary tokens, one in the PoC.exe binary, one in the CVE-2020-1350.exe binary, one in the README.PDF and one in the repository README.md. Below are the stats for the repository in terms of clones, views and page visits:

Additional information about the repository includes the sites that were referrers:

Timeline of Events from Original Post

2020-07-14 20:00 GMT+1: Original blog post created by checkpoint
2020-07-14 20:04 GMT+1: PoC Repository first created
2020-07-14 20:09 GMT+1: PoC Tweeted from https://twitter.com/CVE20201350/status/1283116416191934467
2020-07-14 20:33 GMT+1: First retweet of the vuln
2020-07-14 20:48 GMT+1: PoC link hits vulnmon TI feed
2020-07-14 21:06 GMT+1: First canary token hit from IP located in Brussels
2020-07-14 21:29 GMT+1: Tweet started gaining traction
2020-07-14 23:45 GMT+1: TinkerSec's PoC published
2020-07-15 09:09 GMT+1: Cert-IST posted False PoC
2020-07-15 16:10 GMT+1: This blog post posted :-)
2020-07-16 01:50 GMT+1: Stats updated

As we all know data is beautiful, so to start with here is a breakdown of the pings per token, these are unique IPs that pinged back and have been parsed from all of the alert emails.

It is important that we mention that amount of clicks/executes from exes could be higher but there are some security defences that block canary tokens by blocking the domain or the executable etc.  

Geo-IP Breakdown

As that's per token how about a breakdown of per-country and a nice map to follow?

The World as a whole:

Breakdown per continent:

Europe, Middle East and a little bit of Russia:

North America:

South America

Africa(oh hey Angus ;) ):

Asia:

Oceania:

In addition to the countries a few other key pieces of info were brought to attention such as 'interesting' IP addresses and other interesting data.

User Agent Breakdown

Onto user agents,  we observed 43 unique user agents and many occurrences of each as shown in the table below:

The most common user agent was Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36 indicating that most users running the binary were on Windows 10.

IP Blocks

There is a lot of analysis that can be done with a big list of IP addresses, one of the suggestions was to look at the most common IP blocks. In total the traffic sources were from 132 unique autonomous system number (ASN) IP blocks. Here's the amount of hits per block!

'Interesting' IPs & Hostnames

Out of the list above there are a few that stick out as 'interesting':

• The Federal Guard Service of the Russian Federation (AS43797).

• CHINANET-BACKBONE - China...
• Siam Commercial Bank - Some bank in Thailand!
• AS23028 Team Cymru Inc. - Threat Intel company, didn't pick up the poc and run with it though, so probably just a lookup.
• Some VPN traffic through TOR exit nodes: We've found user agents that link to North Korea (Mozilla/5.0 (X11; U; Linux i686; ko-KP; rv: 19.1br) Gecko/20130508 Fedora/1.9.1-2.5.rs3.0 NaenaraBrowser/3.5b4), Naenara Browser is the DPRK’s version of Firefox that comes built into Red Star OS, the official operating system of North Korea.

There's a lot of security vendors in there too but I assume they're in there for writing signatures etc:

I also ran the IPs found against Alexa top 500 domains, however not many returned anything interesting, the most common domains were AWS and GCP domains.

Remember Folks Rick is Malicious😉

All in all it has been a pretty interesting accidental research project and I can already hear the salty folks who got burned running it 😉.  I'll update the post if I get any more interesting info about the IPs in future!