Linux worm discovered in "internet of Things" devices

Worm could target unpatched routers, set-top boxes and security cameras.

A security researcher has found a piece of malware that appears to target the "internet of things".

Kaoru Hayashi, a security researcher at Symantec discovered the worm called Linux.Darlloz, which he claims is capable of attacking a range of small, internet-enabled devices in addition to traditional computers.

Hayashi said that no attacks against devices such as home routers, set-top boxes and security cameras have been found in the wild but warned that most users would not realise they were at risk as they would be unaware that their own devices ran on Linux.

The worm exploits a PHP vulnerability to propagate itself in the wild and uses an old PHP vulnerability that was patched in May last year, according to the researcher's blog posting. The attacker recently created the worm based on the proof of concept (PoC) code released in late Oct 2013.

On execution, the worm generates IP addresses randomly, accesses a specific path on the machine with well-known ID and passwords, and sends HTTP POST requests, which exploit the vulnerability. If the target is unpatched, it downloads the worm from a malicious server and starts searching for its next target.

"Currently, the worm seems to infect only Intel x86 systems, because the downloaded URL in the exploit code is hard-coded to the ELF binary for Intel architectures," said Hayashi.

He said that because Linux has been ported to various architectures other than Intel, there is a chance that the worm could spread to other small devices with different processors.

"The attacker is apparently trying to maximise the infection opportunity by expanding coverage to any devices running on Linux. However, we have not confirmed attacks against non-PC devices yet," he said.

Symantec has verified that the attacker already hosts some variants for other architectures including ARM, PPC, MIPS and MIPSEL on the same malicious server.

The firm warned users to verify all devices connected to the network, update their software to the latest version and update their security software when it is made available on their devices.

Featured Resources

Security analytics for your multi-cloud deployments

IBM Security QRadar SIEM solution brief

Download now

Five reasons to move to the cloud

Join the enterprises moving their workloads to the cloud

Download now

Architecting hybrid IT and edge for digital advantage

Why business leaders should consider a hybrid IT strategy

Download now

Six reasons to accelerate remote asset monitoring with AI

How to optimise resources, increase productivity, and grow profit margins with AI

Download now

Recommended

Lazarus APT hacking group is targeting the defense industry
Security

Lazarus APT hacking group is targeting the defense industry

26 Feb 2021
Microsoft open sources CodeQL queries used in Solorigate inquiry
Security

Microsoft open sources CodeQL queries used in Solorigate inquiry

26 Feb 2021
CISA warns of ongoing Accellion File Transfer Appliance attacks
hacking

CISA warns of ongoing Accellion File Transfer Appliance attacks

25 Feb 2021
What is a Trojan?
Security

What is a Trojan?

25 Feb 2021

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

26 Feb 2021
How to connect one, two or more monitors to your laptop
Laptops

How to connect one, two or more monitors to your laptop

25 Feb 2021
How to use Chromecast without Wi-Fi
Mobile

How to use Chromecast without Wi-Fi

26 Feb 2021