Makers Benign Router-Malware Publish Source Code

The creators of the benign malware routers, IP cameras and other Internet devices infects, and then secures the source code of their creation have been released and explained their motives. The malware came last week in the news and was released by security company Symantec Wifatch mentioned.

Last year, another researcher had already discovered the malware, which gave it the name ifwatch. The malware spreads via Telnet and uses weak passwords. Once active Wifatch disable the Telnet daemon, so that other attackers can not access anymore. The malware also leave a message for the owner behind to change the password, disable Telnet and update the firmware. Wifatch also has a module to remove other malware on the device.

After Symantec made ​​a blog posting on the malware creators published on Gitlab the source code, including their motivation. They also decided to Symantec approach. She says she developed the malware to learn from it and the project has no malicious intent. The authors regret that she unsolicited infect the machines of others, but argue that the benefits outweigh the disadvantages.

This relates to the amount saved bandwidth for other malware, the routers can use to scan ports or devices, power conservation because malware installed bitcoin miners are removed, any failures and reboots that are prevented by the routers and devices do not overheat and all passwords and money that criminals do not have to steal.

With regard to the source code is now published which partially complete. The part that creates is in fact removed before the infection, as well as the code for creating the malware. This should prevent others can use it, even though the makers warn that sensitive devices can be accessed via Telnet with a default password can be acquired by anyone. Even if they do not have the Wifatch malware.

Cyber ​​Spies Added Linux Support To Allow Malware

A group of cyber spies who is held responsible for attacks on the Belgian government , the White House and a variety of other businesses , government agencies and institutions in Europe and the United States has developed new malware that also features Linux support.

The group is "Duke" and has been active for several years. Recently, a new instance of malware from the group discovered called "Seaduke". It is a Trojan designed to steal information and will be used against a small number of valuable objectives.According to both Symantec and Palo Alto Networks involves highly sophisticated malware.

Linux

Finland's F-Secure analyzed the malware and also saw that the Trojan is written in Python and supports both Windows and Linux. According to the virus fighter Seaduke is the first "cross-platform" malware of the Duke group. The first thing is to use the popular scripting language Python. Earlier malware cyber spies were written in the programming languages ​​C and C ++. In addition, the Python code for both Windows and Linux proves to be developed. "We therefore suspect that the Duke group same Python code Seaduke used to attack Linux users," says researcher Artturi Lehtiö.

Lehtiö leaves in front Security.NL know that there are no attacks against Linux users in the "wild" are found. "But it is safe to assume that they have added Linux support to the use," he notes. The question remains how Linux users would be attacked.The Duke group, for example, used a funny movie monkeys to attack Windows users, which in reality was an exe file. There are PDF documents containing exploits for vulnerabilities in Adobe Reader used to infect computers with malware.

Adding Linux support to malware is not new. Earlier this year it was discovered another group of cyber spies who had done this. The group decided to use social engineering to infect Linux users. Attacked users received a rogue HTML5 plugin offered which turned out to be in reality spyware.

IBM Sees Weather DDoS Attacks From Bill Gates Linux Botnet

A botnet that infects Linux computers and used to carry out DDoS attacks is active again, says IBM. It's the "Bill Gates botnet" which last year was first detected, reports IBM . The bot-amplification uses DNS to carry out the DDoS attacks.

With DNS amplification open DNS servers are used to enhance the traffic to the attacked websites or services. An interesting feature of this malware, according to the Russian anti-virus company Dr. Web together with the Finnish F-Secure paid attention to the last year malware. According to the Russian virus fighter is the Gates-malware also allegedly found because of a sophisticated modular structure that never experienced Linux malware.

At the time, it was unknown how the malware was spreading. Something where IBM still has no answer. It is not known who is behind the botnet. However, the company argues that there has been observed a significant increase in traffic, which are used forged packets and the destination IP address in China.

18 Virus Scanners For Linux Systems Tested

The Austrian test lab AV-Comparatives tested for the first virus for Linux. According to the test organ Linux is often considered a more secure platform than Windows, but does exist malware for Linux. In addition, Linux systems are often used as a file server, and can therefore come into contact with Windows Malware.

By installing a virus scanner can this malware are detected and thus prevent Windows computers become infected. The test report indicates AV-Comparatives also explain why so few Linux malware in circulation. That would relate to the large number of Linux Kernels and Linux distributions. The large number of different software configurations makes it more difficult for an attacker to produce malware that is compatible with a large part of the configurations.

Another factor that AV-Comparatives is pointing to is the small market share of Linux, which makes no lucrative target for attackers. This low proportion may also explain the small number of virus scanners for Linux compared to Windows. Unlike an earlier test of Virus Bulletin , AV-Comparatives decided not to test with malware but only to see the operation and features of the programs. For example, for each program discussed the installation and user interface.