New Worm Attacks Linux Devices
Symantec says Linux-Darlloz burrows in through PHP.
Symantec has announced the discovery of a new worm that attacks Linux systems. The potential targets include Linux computers, as well as home routers, set-top boxes, and other devices running embedded Linux. The Linux.Darlloz worm spreads by exploiting a vulnerability in php-cgi. Security experts have been aware of this exploit for over a year, and patches have been available for Linux systems since May 2012; however, unpatched home computers and embedded devices that rarely see updates are potentially vulnerable to attack.
According to Symantec's Kaoru Hayashi, who announced the worm on his blog, “...the worm generates IP addresses randomly, accesses a specific path on the machine with well known ID and passwords, and sends HTTP POST requests, which exploit the vulnerability. If the target is unpatched, it downloads the worm from a malicious server and starts searching for its next target.”
Hayashi states that the ultimate target for this attack could be the “Internet of Things.” Although the variant discovered in the lab is designed for attacking x86 systems, it appears the attacker has other versions of the worm tailored for ARM, PPC, MIPS, and MIPSEL architectures.
To keep the worm away, Symantec recommends the usual precautions, such as installing the latest software versions and patches and using stronger passwords. Also, Hayashi's blog post recommends configuring the gateway to block incoming HTTP POST requests to -/cgi-bin/php and several other specific paths related to php-cgi.
Issue 269/2023
Buy this issue as a PDF
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Find SysAdmin Jobs
News
-
Ubuntu Flatpak Remix Adds Flatpak Support Preinstalled
If you're looking for a version of Ubuntu that includes Flatpak support out of the box, there's one clear option.
-
Gnome 44 Release Candidate Now Available
The Gnome 44 release candidate has officially arrived and adds a few changes into the mix.
-
Flathub Vying to Become the Standard Linux App Store
If the Flathub team has any say in the matter, their product will become the default tool for installing Linux apps in 2023.
-
Debian 12 to Ship with KDE Plasma 5.27
The Debian development team has shifted to the latest version of KDE for their testing branch.
-
Planet Computers Launches ARM-based Linux Desktop PCs
The firm that originally released a line of mobile keyboards has taken a different direction and has developed a new line of out-of-the-box mini Linux desktop computers.
-
Ubuntu No Longer Shipping with Flatpak
In a move that probably won’t come as a shock to many, Ubuntu and all of its official spins will no longer ship with Flatpak installed.
-
openSUSE Leap 15.5 Beta Now Available
The final version of the Leap 15 series of openSUSE is available for beta testing and offers only new software versions.
-
Linux Kernel 6.2 Released with New Hardware Support
Find out what's new in the most recent release from Linus Torvalds and the Linux kernel team.
-
Kubuntu Focus Team Releases New Mini Desktop
The team behind Kubuntu Focus has released a new NX GEN 2 mini desktop PC powered by Linux.
-
KDE Plasma 5.27 Slated for a Valentine's Day Release
The next version of the KDE Plasma desktop is prepped and ready with numerous improvements and plenty of bug fixes.