DShield Sensor Captures Self-Propagating SSH Worm Exploit Using Credential Stuffing and Multi-Stage Malware
## Cybersecurity: New Self-Propagating SSH Worm Exploit
Cybersecurity: New Self-Propagating SSH Worm Exploit
A newly identified self-propagating worm poses a significant threat to Linux systems by utilizing SSH brute-force attacks. This malware can compromise systems in as little as four seconds through credential stuffing techniques combined with cryptographic command verification.
This worm targets devices with weak authentication mechanisms, particularly those with default credentials left unchanged, such as Internet of Things (IoT) devices like Raspberry Pi. Upon gaining access, the malware uploads and executes a 4.7-kilobyte bash script that establishes persistence, removes competing malware, and connects to command and control infrastructure via Internet Relay Chat (IRC) networks.
Researchers at the Internet Storm Center identified this threat by analyzing data from DShield honeypot sensors designed to detect SSH-based attacks. The investigation traced the malware's origin to a compromised Raspberry Pi device in Germany.
The worm propagates rapidly by authenticating with common default credentials, allowing it to spread across vulnerable systems connected to the internet. After accessing a device, the script modifies system files and schedules tasks to maintain control, while terminating processes linked to other botnets and cryptocurrency miners.
A newly identified self-propagating worm poses a significant threat to Linux systems by utilizing SSH brute-force attacks.
This malware distinguishes itself from typical SSH worms through the use of cryptographically signed command verification. An embedded RSA public key ensures that only authorized commands from the control operator are executed, preventing unauthorized access to the botnet.
Compromised devices join multiple IRC networks, listening for further instructions. The worm uses tools like Zmap and sshpass to scan random IP addresses, facilitating its spread.
Organizations are advised to disable password-based SSH authentication and implement key-based alternatives. Additional security measures include removing default user accounts on Raspberry Pi devices, deploying fail2ban for brute-force protection, and implementing network segmentation to isolate IoT devices from critical infrastructure.
Based on reporting by Cyber Security News.