Linux botnet abuses log4j to attack Arm, x86-based devices
New botnet shows log4j isn’t going away any time soon
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
We’re months into the disclosure of the log4j vulnerability and new attacks are still popping up. Cybersecurity researchers from Qihoo 360, a Chinese cybersecurity company, have just discovered a newLinuxbotnet, taking advantage of the flaw to distribute rootkits and steal sensitive data.
They named the botnet B1txor20, and claim it uses the log4j vulnerability to target LinuxArmand 64-bit x86 systems.
“In addition to traditional backdoor functions, B1txor20 also has functions such as opening a Socket5 proxy and remotely downloading and installing a rootkit,” the researchers said.
We’re looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn’t take more than 60 seconds of your time. Thank you for taking part.
Click here to start the survey in a new window«
Buggy botnet
Besides installing rootkits, the botnet seeks to read and write files, run and terminate proxy services, as well as run reverse shells. It can also exfiltrate data from afflicted endpoints, and run commands, remotely, which could result in the distribution of dangerousmalware.
This is far from a perfect botnet, though, as researchers have also found bugs and non-functional features, as well. One of the bugs deletes the socket file after binding the domain socket making the socket unconnectable, and the whole function useless.
The researchers expect the threat actor will put in additional hours to iron out the kinks, making the botnet even more dangerous than it already is.
“We presume that the author of B1txor20 will continue to improve and open different features according to different scenarios, so maybe we will meet B1txor20’s siblings in the future,” the group said.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Log4j could be the most serious security threat ever seen, CISA head warns>Log4j attacks are still a major threat, warns Microsoft>FTC says it will come after firms who haven’t patched Log4j flaws
The vulnerability, discovered in early December last year in Apache’s logging tool, log4j, has been dubbed one of the most dangerous ones - ever. Log4j is being widely used, and given that the flaw allowed third-party actors remote, full access, to the target device, its destructive potential is limitless.
Once discovered, Apache rushed to develop apatch, making mistakes along the way. It took multiple attempts, and multiple patches, for the log4j vulnerability to finally be plugged. Administrators everywhere are urged to keep their systems up to date.
Via:The Register
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
A new form of macOS malware is being used by devious North Korean hackers
Scammers are using fake copyright infringement claims to hack businesses
Google puts Nvidia on high alert as it showcases Trillium, its rival AI chip, while promising to bring H200 Tensor Core GPUs within days
