This week, Akamai PLXsert Manager David Fernandez and I discuss the latest attack research from his team. David reviews the fallout from a recent advisory about0
As previously noted, Akamai InfoSec has been working to make its most sought after compliance documents publicly available. The goal is to make it easier for customers to access the answers they regularly seek, and also to show potential new customers how we operate.
We’re building the foundation in the form of a compliance page on the Akamai Security microsite, and hope to publish up to two fresh public docs a month. What follows is a list of what we’ve done so far.
Linux users have a new threat to worry about.
According to Akamai’s Prolexic Security Engineering Research Team (PLXsert), the bad guys have discovered a weakness in Linux systems they can exploit to expand their botnets and launch DDoS attacks. PLXsert released an advisory outlining the danger this morning.
The favored target in this attack is the entertainment industry, though other business sectors are at risk.
In this attack scenario, vulnerable Linux systems are infected with IptabLes and IptabLex malware. Attackers manage to compromise large numbers of Linux systems by exploiting vulnerabilities in Apache Struts, Tomcat and Elasticsearch.
Attackers use the Linux vulnerabilities on unmaintained servers to gain access, escalate privileges to allow remote control of the machine, then drop the malware into the system. This allows them to hijack those systems, which are then pulled into botnets used to launch DDoS attacks.
Stuart Scholly, senior vice president and general manager of Akamai’s Security Business Unit, calls this a significant development because the Linux operating system is rarely used in DDoS botnets.
“Linux admins need to know about this threat to take action to protect their servers,” he said.
Here are some of the raw details from the advisory:
A post-infection indication is a payload named .IptabLes or. IptabLex located in the /boot directory. These script files run the .IptabLes binary on reboot. The malware also contains a self-updating feature that causes the infected system to contact a remote host to download a file. In the lab environment, an infected system attempted to contact two IP addresses located in Asia.
Command and control centers (C2, CC) for IptabLes and IptabLex are currently located in Asia. Infected systems were initially known to be in Asia; however, more recently many infections were observed on servers hosted in the U.S. and in other regions. In the past, most DDoS bot infections originated from Russia, but now Asia appears to be a significant source of DDoS development.