New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks
A new malware called KATARU tries to break into Linux IoT devices by guessing passwords over Telnet, then uses known Linux flaws to take full control and turn them into DDoS weapons. Attackers can hijack routers, cameras, and other connected devices to flood websites with traffic.
- Report priority
- Medium
- Targets
- Linux
How it works
- Attackers send automated password guesses to devices that use Telnet (a remote login tool) without strong passwords.
- When they guess right, the malware tries to exploit known Linux flaws to gain full system control.
- Once inside, it installs code to turn the device into a DDoS bot, letting attackers flood websites with fake traffic.
What to do
Check if you have any Linux IoT devices (like routers, cameras, or smart devices) that use Telnet for remote access. Look for devices with default or weak passwords. If you find any, they are at risk. Also, check if your Linux devices run an older, unpatched kernel version, older kernels are more likely to be vulnerable to known exploits.
Disable Telnet on all Linux IoT devices if possible. Update your Linux kernel to the latest stable version. If you can't disable Telnet, change all passwords to strong, unique ones. Monitor your devices for unusual network activity or unexpected traffic spikes, as these could indicate compromise.
Technical details
Attackers scan the internet for Linux IoT devices with Telnet enabled and weak passwords. When they find one, they try common passwords like 'admin', 'root', or 'password'. If successful, they use a known Linux kernel exploit to escalate privileges to root. The malware then downloads additional code to join a DDoS botnet, waiting for commands to attack websites.
A newly observed IoT malware family dubbed KATARU targets internet-exposed devices through Telnet credential brute-forcing, then attempts to gain root privileges with publicly available Linux kernel exploits before enrolling compromised systems in a DDoS botnet.