BASHLITE Malware Uses ShellShock to Hijack Devices Running BusyBox

Conocimiento pertenece al mundo
Tweet about this on TwitterShare on FacebookShare on LinkedInShare on Google+Share on StumbleUponShare on TumblrShare on RedditPin on PinterestEmail this to someone

The first variant of BASHLITE, detected as ELF_BASHLITE.A (ELF_FLOODER.W), was spotted by Trend Micro shortly after the existence of the ShellShock bug came to light. The threat, which was the payload of the ShellShock exploit code, had been used to launch distributed denial-of-service (DDoS) attacks.

ELF_BASHLITE.A checked to see if infected devices were running BusyBox, a set of programs needed to run a Linux system. BusyBox is designed for embedded operating systems such as the ones running on routers.

Malware Uses ShellShock

A newer version of BASHLITE spotted by Trend Micro researchers (ELF_BASHLITE.SMB) is designed not only to identify systems running BusyBox, but to also hijack them.

The malware first scans the network for BusyBox devices and attempts to access them by using a predefined list of usernames and passwords. The list of passwords includes “root,” “admin,” “12345,” “pass,” “password” and “123456.”

Source:http://www.securityweek.com/bashlite-malware-uses-shellshock-hijack-devices-running-busybox

Conocimiento pertenece al mundo
Tweet about this on TwitterShare on FacebookShare on LinkedInShare on Google+Share on StumbleUponShare on TumblrShare on RedditPin on PinterestEmail this to someone

Add a Comment