Akamai Diversity

The Akamai Blog

Linux Systems Exploited for DDoS Attacks

Linux users have a new threat to worry about.

According to Akamai's Prolexic Security Engineering Research Team (PLXsert), the bad guys have discovered a weakness in Linux systems they can exploit to expand their botnets and launch DDoS attacks. PLXsert released an advisory outlining the danger this morning.

  • The full advisory is available HERE.
  • Also read Akamai Security Advocate Dave Lewis' CSOonline blog post about the threat.

The favored target in this attack is the entertainment industry, though other business sectors are at risk.

In this attack scenario, vulnerable Linux systems are infected with IptabLes and IptabLex malware. Attackers manage to compromise large numbers of Linux systems by exploiting vulnerabilities in Apache Struts, Tomcat and Elasticsearch. 

Attackers use the Linux vulnerabilities on unmaintained servers to gain access, escalate privileges to allow remote control of the machine, then drop the malware into the system. This allows them to hijack those systems, which are then pulled into botnets used to launch DDoS attacks.

Stuart Scholly, senior vice president and general manager of Akamai's Security Business Unit, calls this a significant development because the Linux operating system is rarely used in DDoS botnets. 

"Linux admins need to know about this threat to take action to protect their servers," he said.

Here are some of the raw details from the advisory:

A post-infection indication is a payload named .IptabLes or. IptabLex located in the /boot directory. These script files run the .IptabLes binary on reboot. The malware also contains a self-updating feature that causes the infected system to contact a remote host to download a file. In the lab environment, an infected system attempted to contact two IP addresses located in Asia.

Command and control centers (C2, CC) for IptabLes and IptabLex are currently located in Asia. Infected systems were initially known to be in Asia; however, more recently many infections were observed on servers hosted in the U.S. and in other regions. In the past, most DDoS bot infections originated from Russia, but now Asia appears to be a significant source of DDoS development.

Patching and hardening Linux servers and antivirus detection can prevent an IptabLes or IptabLex infestation on Linux systems. Meanwhile, PLXsert is providing customers with bash commands to clean infected systems.

PLXsert also shares a YARA rule in the threat advisory to identify the ELF IptabLes payload used in an observed attack campaign.