Rare Linux virus on the loose

It has emerged in the last week that another of those rare Linux viruses may be on the loose. And this one has strong similarities to October's Remote Shell Trojan (RST) that was largely dismissed by the Linux community.

In a posting to a security mailing list at the end of December, SecurityFocus brought 'RST.b' to the internet community's attention.

The researchers warned that the culprit carrying the virus is likely to be "some exploit being passed around, possibly a Secure Shell one". Linux users are advised not to run exploits from unknown sources.

Once it has gained a foothold into the system, it installs a back door and attempts to escalate its permissions to root privileges.

The basic differences to the October version are that the new virus tries to communicate with a machine on a different IP address to the original RST, and the backdoor operates on the Exterior Gateway Protocol instead of the User Datagram Protocol.

Like the original RST, the virus infects binary files in the Linux Executable and Linking Format (ELF).

RST.b infects the start address in ELF headers with an address that points to its own code. So when an infected program is run, a parent string forks off to run the original code so as to avoid suspicion, while a child string "takes care of the evil stuff", according to researchers at Lockeddown.net.

"Not only do we have a virus spreading, but it is opening up the infected boxes to attackers," they added.

A SecurityFocus researcher who attempted to contact the host of the web server that had infected the machines said: "The response I got indicated that 'his account was terminated a few weeks ago'. I received no response to a later request for clarification."

See also:

Complex Linux virus warning

'Zeitgeist of new interest', says expert  11 Jun 2002

Experts warn of Linux/Windows virus

Polymorphic, entry-point-obfuscating worm hits the web  05 Jun 2002

Jac virus targets Linux

First to hit the platform in three months  13 Mar 2002

Desktop Linux still remote

Operating system is still no threat to Microsoft.  16 Jan 2002

Linux Mutt in the dog house

Buffer overflow warning sent to users  08 Jan 2002

Users lose confidence in AV software

Gokar worm highlights fallibility of current antivirus systems  04 Jan 2002

Linux users warned of new Trojan danger

Remote Shell worm could cause more damage than Code Red  07 Sep 2001

Linux based Trojan gets a closer look

Details of Remote Shell worm uncovered  07 Sep 2001

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!