ShellBot: A New Breed of Linux SSH Server Cracker Emerges

Cyberattackers Targeting Linux SSH Servers with ShellBot Malware

According to researchers at the AhnLab Security Emergency Response Center (ASEC), cyberattackers are using a new method to hide their malicious activity while targeting Linux SSH servers with the ShellBot malware. By using hexadecimal IP (Hex IP) addresses, threat actors are evading behavior-based detection systems, making it difficult for URL-based detection signatures to identify and flag their activities.

The Method of Attack

The attackers are translating the familiar “dot-decimal” command-and-control URL formation into a Hex IP address format. The dot-decimal notation (e.g., hxxp://39.99.218[.]78) is replaced with a hexadecimal notation (e.g., hxxp://0x2763da4e/). This change in IP address format allows the attackers to bypass detection systems that rely on parsing and analyzing dot-decimal IP addresses.

The ShellBot malware, also known as PerlBot, is a well-known botnet that primarily uses dictionary attacks to compromise Linux servers with weak SSH credentials. Once installed, the compromised servers can be utilized to launch distributed denial-of-service (DDoS) attacks, deliver payloads like cryptominers, or function as a backdoor for installing additional malware or launching various types of attacks.

The Implications of Hex IP Attacks

Hex IP attacks pose a significant threat to Linux SSH servers as they exploit vulnerabilities in password hygiene and weak authentication mechanisms. The use of hexadecimal IP addresses allows attackers to remain under the radar by evading traditional detection methods that rely on dot-decimal IP addresses.

While the Hex IP technique itself is not new, its usage in conjunction with ShellBot malware highlights the need for enhanced security measures and password hygiene practices among organizations relying on Linux SSH servers. The ability of threat actors to compromise and weaponize servers for malicious activities raises concerns about the overall security of systems and networks.

Protecting against ShellBot Attacks

To protect their organizations from ShellBot attacks and similar threats, administrators should implement the following measures:

1. Strong Passwords: Ensure that all SSH credentials have strong, unique passwords. Passwords should be complex, containing a mix of uppercase and lowercase letters, numbers, and special characters. Avoid using commonly used passwords or dictionary words.
2. Rotation of Credentials: Regularly rotate and update SSH credentials to prevent unauthorized access. Implement a password rotation policy that requires users to change their passwords periodically.
3. Multi-Factor Authentication (MFA): Enable MFA for SSH access to add an extra layer of security. MFA requires users to provide additional verification, such as a unique code generated on their mobile device, in addition to their password.
4. Intrusion Detection and Prevention Systems (IDPS): Deploy IDPS solutions that can detect and block suspicious activity, including dictionary attacks and anomalous SSH connections.
5. Regular Updates and Patching: Keep Linux systems and SSH servers up to date with the latest security patches and updates. Regularly monitor and apply patches to mitigate any vulnerabilities that threat actors might exploit.

Conclusion

The evolving methods employed by cyberattackers, such as the use of Hex IP addresses to evade detection, highlight the continuous arms race in the cybersecurity landscape. As organizations increasingly rely on Linux SSH servers, it is crucial to prioritize security measures, including strong passwords, regular credential rotation, and the implementation of multi-factor authentication.

Furthermore, organizations should stay informed about emerging threats, such as ShellBot malware, by monitoring security advisories and collaborating with cybersecurity experts. By adopting a proactive approach to security, organizations can minimize their risk of falling victim to ShellBot attacks and other similar threats.

Disclaimer: The views and opinions expressed in this report are those of the author and do not necessarily reflect the official policy or position of The New York Times or any of its affiliates.