We’re months into the disclosure of the log4j vulnerability and new attacks are still popping up. Cybersecurity researchers from Qihoo 360, a Chinese cybersecurity company, have just discovered a new Linux botnet, taking advantage of the flaw to distribute rootkits and steal sensitive data.
They named the botnet B1txor20, and claim it uses the log4j vulnerability to target Linux Arm and 64-bit x86 systems.
“In addition to traditional backdoor functions, B1txor20 also has functions such as opening a Socket5 proxy and remotely downloading and installing a rootkit,” the researchers said.
TechRadar needs you!
We’re looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn’t take more than 60 seconds of your time, and entrants from the UK and US will have the chance to enter a draw for a £100 Amazon gift card (or equivalent in USD). Thank you for taking part.
>> Click here to start the survey in a new window
Buggy botnet
Besides installing rootkits, the botnet seeks to read and write files, run and terminate proxy services, as well as run reverse shells. It can also exfiltrate data from afflicted endpoints, and run commands, remotely, which could result in the distribution of dangerous malware.
This is far from a perfect botnet, though, as researchers have also found bugs and non-functional features, as well. One of the bugs deletes the socket file after binding the domain socket making the socket unconnectable, and the whole function useless.
The researchers expect the threat actor will put in additional hours to iron out the kinks, making the botnet even more dangerous than it already is.
“We presume that the author of B1txor20 will continue to improve and open different features according to different scenarios, so maybe we will meet B1txor20’s siblings in the future,” the group said.
Read more
> Log4j could be the most serious security threat ever seen, CISA head warns
> Log4j attacks are still a major threat, warns Microsoft
> FTC says it will come after firms who haven’t patched Log4j flaws
The vulnerability, discovered in early December last year in Apache’s logging tool, log4j, has been dubbed one of the most dangerous ones – ever. Log4j is being widely used, and given that the flaw allowed third-party actors remote, full access, to the target device, its destructive potential is limitless.
Once discovered, Apache rushed to develop a patch, making mistakes along the way. It took multiple attempts, and multiple patches, for the log4j vulnerability to finally be plugged. Administrators everywhere are urged to keep their systems up to date.
- Protect yourself with the best antivirus software right now
Via: The Register
