Linux botnet abuses log4j to attack Arm, x86-based devices

News
By published

New botnet shows log4j isn't going away any time soon

An abstract image of digital security.
(Image credit: Shutterstock) (Image credit: Shutterstock)

We’re months into the disclosure of the log4j vulnerability and new attacks are still popping up. Cybersecurity researchers from Qihoo 360, a Chinese cybersecurity company, have just discovered a new Linux botnet, taking advantage of the flaw to distribute rootkits and steal sensitive data. 

They named the botnet B1txor20, and claim it uses the log4j vulnerability to target Linux Arm and 64-bit x86 systems. 

"In addition to traditional backdoor functions, B1txor20 also has functions such as opening a Socket5 proxy and remotely downloading and installing a rootkit," the researchers said.

TechRadar needs you!

We're looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn't take more than 60 seconds of your time. Thank you for taking part.

>> Click here to start the survey in a new window <<

Buggy botnet

Besides installing rootkits, the botnet seeks to read and write files, run and terminate proxy services, as well as run reverse shells. It can also exfiltrate data from afflicted endpoints, and run commands, remotely, which could result in the distribution of dangerous malware. 

This is far from a perfect botnet, though, as researchers have also found bugs and non-functional features, as well. One of the bugs deletes the socket file after binding the domain socket making the socket unconnectable, and the whole function useless.

The researchers expect the threat actor will put in additional hours to iron out the kinks, making the botnet even more dangerous than it already is. 

"We presume that the author of B1txor20 will continue to improve and open different features according to different scenarios, so maybe we will meet B1txor20's siblings in the future," the group said.

Read more

> Log4j could be the most serious security threat ever seen, CISA head warns

> Log4j attacks are still a major threat, warns Microsoft

> FTC says it will come after firms who haven't patched Log4j flaws

The vulnerability, discovered in early December last year in Apache’s logging tool, log4j, has been dubbed one of the most dangerous ones - ever. Log4j is being widely used, and given that the flaw allowed third-party actors remote, full access, to the target device, its destructive potential is limitless. 

Once discovered, Apache rushed to develop a patch, making mistakes along the way. It took multiple attempts, and multiple patches, for the log4j vulnerability to finally be plugged. Administrators everywhere are urged to keep their systems up to date. 

Via: The Register

TOPICS
Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.