Linux servers infected with a mutating virus are commanding huge Windows botnets six years after the malware was discovered, according to security researchers.

The Linux.RST.B virus infects the working directory/bin and its ELF (executable and linkable format) executable files. It can also create a backdoor by opening a socket and listening for a packet containing the attackers origin and the command to be executed..

SophosLabs United Kingdom research director Billy McCourt said Linux boxes are valuable targets as botnet controllers because they are typically remain online as servers.

"Linux computers are very valuable to hackers. A bot army, similar to real armies, needs a general and infantry [and] Linux boxes are often used as servers, which means they have a high up-time - essential for a central control point," McCourt said.

"A Windows computer, on the other hand, is found at home or as a desktop machine in an office, and these computers are regularly switched off [which] makes them less attractive as controllers, but ideal for infantry, or zombies.

"We run various honeypots [and] as you might also expect, our Windows honeypots are attacked more frequently than our Linux ones, but Linux malware is far more interesting."

McCourt said the virus, discovered in February 2002, is unique among Linux malware because it can replicate across current distributions.

University of New South Wales senior network administrator for the school of computer science and engineering Peter Linich told Computerworld Linux servers are extremely valuable to hackers since they are typically online more than 10 months are year.

"Just yesterday I was watching our incoming network traffic and noticed an ADSL host in Greece scanning through all our machines and running an SSH (Secure Shell) password-guessing attack on all the SSH servers it found," Linich said, adding such attacks occur multiple times a day.

"Such activity is a real threat in our environment where we have hundreds of Linux systems running 24x7.Linux systems, once compromised, are ideal platforms to unleash all sorts of nastiness.

We can't make sure users who need to administer their own computers use good passwords; a bad password choice is a damn good way to risk getting their machine compromised no matter how attentive they are to keeping their machines patched."