On this ISC article on DVR compromise the author talks about the compromise of an embedded system. In particular, the attacker executes a series of
echo commands on the remote host, and:
This DVR has no "upload" feature. There is no wget nor is there an ftp or telnet client.
The first echo writes 51 bytes to "/var/run/rand0-btcminer-arm" and the second echo returns "done", indicating that the system is ready for the next echo command.
Unlike the name implies, "rand0-btcminer-arm" is not a bitcoin miner. Instead, it just appears to be a version of "wget".
I do not understand how could even the basic fundamentals of wget fit in 51 bytes. The article contains a packet dump, so I guess I could write it to file and try to reverse engineer the binary but I suspect there's something else going on here.
Could anyone help me understand how is this happening? Is the "binary" doing a library call to network functionalities?