Linux generals command Windows grunts in botnet battlefield

Veteran virus still recruiting for zombie army
Page:

Linux servers infected with a mutating virus are commanding huge Windows botnets six years after the malware was discovered, according to security researchers.

The Linux.RST.B virus infects the working directory/bin and its ELF (executable and linkable format) executable files. It can also create a backdoor by opening a socket and listening for a packet containing the attackers origin and the command to be executed..

SophosLabs United Kingdom research director Billy McCourt said Linux boxes are valuable targets as botnet controllers because they are typically remain online as servers.

"Linux computers are very valuable to hackers. A bot army, similar to real armies, needs a general and infantry [and] Linux boxes are often used as servers, which means they have a high up-time - essential for a central control point," McCourt said.

"A Windows computer, on the other hand, is found at home or as a desktop machine in an office, and these computers are regularly switched off [which] makes them less attractive as controllers, but ideal for infantry, or zombies.

"We run various honeypots [and] as you might also expect, our Windows honeypots are attacked more frequently than our Linux ones, but Linux malware is far more interesting."

Linux systems, once compromised, are ideal platforms to unleash all sorts of nastiness.
Peter Linich, senior network administrator for the University of NSW
McCourt said the virus, discovered in February 2002, is unique among Linux malware because it can replicate across current distributions.

University of New South Wales senior network administrator for the school of computer science and engineering Peter Linich told Computerworld Linux servers are extremely valuable to hackers since they are typically online more than 10 months are year.

"Just yesterday I was watching our incoming network traffic and noticed an ADSL host in Greece scanning through all our machines and running an SSH (Secure Shell) password-guessing attack on all the SSH servers it found," Linich said, adding such attacks occur multiple times a day.

"Such activity is a real threat in our environment where we have hundreds of Linux systems running 24x7.Linux systems, once compromised, are ideal platforms to unleash all sorts of nastiness.

We can't make sure users who need to administer their own computers use good passwords; a bad password choice is a damn good way to risk getting their machine compromised no matter how attentive they are to keeping their machines patched."

Page:
More about: APT, Debian, Exposure, Linux, Socket, Sophos, SSH, Symantec, University of New South Wales, University of New South Wales, University of NSW, VIA
References show all

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the Computerworld comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Whitepapers
Latest Stories
Community Comments
Whitepapers
All whitepapers
Sign up now to get free exclusive access to reports, research and invitation only events.
Featured Download
/downloads/product/149/dropbox/

Dropbox

Dropbox is a sharing tool that allows you to synchronize your documents, as well share files with others. It automatically uploads the files to the ...

Computerworld newsletter

Join the most dedicated community for IT managers, leaders and professionals in Australia