New Linux Malware Exploits Sambacry Flaw To Silently Backdoor Nas Devices

Remember SambaCry?

Almost ii months ago, nosotros reported most a 7-year-old critical remote code execution vulnerability inward Samba networking software, allowing a hacker to remotely accept sum command of a vulnerable Linux in addition to Unix machines.

We dubbed the vulnerability equally SambaCry, because of its similarities to the Windows SMB vulnerability exploited yesteryear the WannaCry ransomware that wreaked havoc across the basis over ii months ago.

Despite beingness patched inward belatedly May, the vulnerability is currently beingness leveraged yesteryear a novel slice of malware to target the Internet of Things (IoT) devices, especially Network Attached Storage (NAS) appliances, researchers at Trend Micro warned.

For those unfamiliar: Samba is open-source software (re-implementation of SMB/CIFS networking protocol), which offers Linux/Unix servers alongside Windows-based file in addition to impress services in addition to runs on the bulk of operating systems, including Linux, UNIX, IBM System 390, in addition to OpenVMS.

Shortly afterwards the populace revelation of its existence, the SambaCry vulnerability (CVE-2017-7494) was exploited generally to install cryptocurrency mining software—"CPUminer" that mines "Monero" digital currency—on Linux systems.

However, the latest malware drive involving SambaCry spotted yesteryear researchers at Trend Micro inward July generally targets NAS devices used yesteryear minor in addition to medium-size businesses.

SHELLBIND Malware Exploits SambaCry to Targets NAS Devices

Dubbed SHELLBIND, the malware industrial plant on diverse architectures, including MIPS, ARM in addition to PowerPC, in addition to is delivered equally a shared object (.SO) file to Samba populace folders in addition to loaded via the SambaCry vulnerability.

Once deployed on the targeted machine, the malware establishes communication alongside the attackers' command in addition to command (C&C) server located inward East Africa, in addition to modifies firewall rules to ensure that it tin communicate alongside its server.

After successfully establishing a connection, the malware grants the attackers access to the infected device in addition to provides them alongside an opened upwards command trounce inward the device, hence that they tin number whatever number in addition to type of arrangement commands in addition to eventually accept command of the device.

In lodge to honor the affected devices that role Samba, attackers tin leverage the Shodan search engine in addition to write the master malware files to their populace folders.

"It is quite tardily to honor devices that role Samba inward Shodan: searching for port 445 alongside a 'samba' string volition plow upwards a feasible IP list," researchers said acre explaining the flaw. 

"An assailant would hence merely bespeak to practise a tool that tin automatically write malicious files to every IP address on the list. Once they write the files into the populace folders, the devices alongside the SambaCry vulnerability could larn ELF_SHELLBIND.A victims."

However, it is non clear what the attackers practise alongside the compromised devices in addition to what's their actual motive behind compromising the devices.

The SambaCry vulnerability is hell tardily to exploit in addition to could hold upwards used yesteryear remote attackers to upload a shared library to a writable percentage in addition to hence own the server to charge in addition to execute the malicious code.

The maintainers of Samba already patched the number inward Samba versions 4.6.4/4.5.10/4.4.14, hence you lot are advised to acre your systems against the vulnerability equally shortly equally possible.

Just brand certain that your arrangement is running updated Samba version.

Also, attackers bespeak to own got writable access to a shared place on the target arrangement to deliver the payload, which is roughly other mitigating element that mightiness lower the charge per unit of measurement of infection.

Share This :