Linux systems are no stranger to malware attacks, but it’s still a bit surprising to see the kind of organized mayhem that’s been taking place over the past few months. Security firm Sophos published an interesting blog post recently detailing a spate of recent attacks against Linux web servers, which it called “a mini epidemic.
The infections were all similar and appeared to be hand-installed, not automated. They don’t do anything particularly noteworthy other than leave behind instructions for the attacker to get back in touch with the server at some later date.
Linux systems also terrorized by malware
Linux-targeting malware is nothing new, of course, but it’s a bit surprising to see the kind of organized mayhem that’s been taking place over the past few months.
This is nothing new, of course. Malware has always been a part of the landscape, and it’s not the first time Linux has been targeted by malware. But what we’re seeing now is an organized kind of mayhem that hasn’t been seen before and as with any emerging threat, it’s important to get ahead of this trend rather than wait until something goes wrong.
The first thing you should know is that there are two main types of malware: those designed to take over your computer and those designed to steal data from it (like credit cards or other financial information).
A mini epidemic
Sophos is a security company. It published a blog post recently detailing a spate of recent attacks against Linux web servers, which it called “a mini epidemic.”
The malware was not automated; instead, it was manually created by attackers who wanted to target specific sites with malicious code. The most common attack vector involved compromising DNS records and using them as backdoors into Linux servers; in some cases, this led to complete compromise of the server itself (Sophos says there were no signs of any data being stolen).
The infections were all similar and appeared to be hand-installed, not automated.
The malware was not being spread automatically via infected emails or links in social media posts, but rather by a person hosting the files on their own computer.
What makes them different from most Linux malware is that they’re mostly passive. The infections were all similar and appeared to be hand-installed, not automated.
But this doesn’t mean you can’t protect yourself from these types of attacks.
They don’t do anything particularly noteworthy other than leave behind instructions for the attacker to get back in touch with the server at some later date.
The malware is designed to be used in a coordinated attack against Windows users. However, it doesn’t do anything particularly noteworthy other than leave behind instructions for the attacker to get back in touch with the server at some later date.
The malware itself does not perform any malicious activity on its own; instead, it simply checks whether or not there are any open ports on your computer and if so, closes them all down so that no one can access your system anymore (or at least until they get their hands on another machine).
It’s likely that those instructions will be used to conduct ongoing attacks against Windows users who visit those compromised sites, so if you’re running a legitimate Linux server somewhere and want to make sure it’s not part of this mess, you might want to check it out.
If your system has been compromised by malware or some other attack that allows for remote access and control via the Internet (that’s pretty much all viruses), then I suggest calling in a professional security company as soon as possible.
Conclusion
So there you have it: Linux systems are also being targeted by malware. It’s not a huge shocker, but it’s still worth keeping in mind. And if you’re running a legitimate Linux server somewhere and want to make sure it’s not part of this mess, you might want to check it out.