Results 1 to 1 of 1
-
18th Jul 2014, 05:01 PM #1
Linux and FreeBSD Servers Infected to Function like a Windows Bot
Security researchers have found a new malware, dubbed Mayhem, that targets Linux and FreeBSD web servers in order to turn them into bots, without requiring root access.
Three security experts, Andrej Kovalev, Konstantin Ostrashkevich and Evgeny Sidorov, from Russia-based Yandex, discovered that the malicious attack is conducted via a more sophisticated PHP script.
Mayhem was first detected in April 2014, and the researchers say that it is continuing the “Fort Disco” brute-force campaign that was revealed by Arbor Networks in 2013.
In a paper published by security publication Virus Bulletin, the trio asserts that this piece of malware is a new type that can work under restricted privileges on the systems and has been created with multiple functionality in mind.
After being uploaded on VirusTotal, it was revealed that the initial PHP script had a low detection rate with the antivirus engines available.
As soon as the target is reached, the script proceeds to kill all “/usr/bin/host” processes, check for the system architecture and operating system, and then downloads a malicious object identified as “libworker.so.”
Apart from this, a variable is defined, “AU,” which includes the URL of the script that is executed. Another stage of the infection is to create a shell script that is then executed.
Communication is established with the command and control servers, which can send the malware different instructions. Since it is modular, Mayhem’s functions can be expanded through plug-ins; at the moment, eight have been discovered.
These range from cracking passwords on WordPress and Joomla CMSs using the brute-force technique, crawling web pages to collect information and finding a remote file inclusion (RFI) vulnerability, to enumerating users on WordPress websites.
The team analyzed the command and control servers used for managing the botnet and successfully retrieved some statistics from two of them, which together managed 1,400 infected servers.
It seems that the geographical areas with most infections are the U.S., Russia, Germany, and Canada.
The cybercriminals have not enabled the full functionality of the master machines, since they host additional components that had not been delivered to the bots.
In the technical analysis of Mayhem, the researchers say they found “a plug-in that exploits the recently identified ‘Heartbleed’ vulnerability and collects data from vulnerable servers.”
On the bright side, they discovered security glitches in the code of the command and control scripts, which might be leveraged to dismantle the Mayhem botnets.
“During our analysis, we found some common features shared between Mayhem and some other *nix malware. The malware is similar to ‘Trololo_mod’ and ‘Effusion’ [11] – two injectors for Apache and Nginx servers respectively,” reads the analysis paper.
UNIX-like web servers are gaining the interest of cybercriminals more and more lately, due to the monetization potential they have. These machines can be used to direct users to online locations delivering malware.
Additionally, the automatic update mechanisms and anti-virus products are generally not used by the administrators of these systems, which creates an opportunity for cybercriminals.Kepler Reviewed by Kepler on . Linux and FreeBSD Servers Infected to Function like a Windows Bot http://i1-news.softpedia-static.com/images/news-700/Linux-and-FreeBSD-Servers-Infected-To-Function-Like-A-Windows-Bot.jpg Security researchers have found a new malware, dubbed Mayhem, that targets Linux and FreeBSD web servers in order to turn them into bots, without requiring root access. Three security experts, Andrej Kovalev, Konstantin Ostrashkevich and Evgeny Sidorov, from Russia-based Yandex, discovered that the malicious attack is conducted via a more sophisticated PHP Rating: 5
Sponsored Links
Thread Information
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)
Similar Threads
-
DynaBoot.com ? Xen Linux and FreeBSD, 20GB HDD, 512 RAM, from $4.5 [NL]
By xelak in forum VPS Hosting OffersReplies: 9Last Post: 17th Nov 2012, 10:24 AM -
how to make like and follow buttons in a widget?
By mazzo in forum WordpressReplies: 3Last Post: 24th Sep 2012, 08:46 PM -
need help for linux and windows vps server.
By wakaski in forum Server ManagementReplies: 4Last Post: 29th Apr 2012, 05:01 PM -
A movie streaming site where to register and which server to host?
By sxrjs in forum Webmaster DiscussionReplies: 16Last Post: 14th Jan 2012, 11:06 PM -
New to Junction, not new to webhosting and dedicated servers
By Miss Nancy in forum IntroductionsReplies: 5Last Post: 28th Dec 2011, 07:34 AM
themaPoster - post to forums and...
Version 5.15 released. Open older version (or...