Story image

New version of SambaCry spotted in the wild: Linux users urged to update OS

21 Jul 2017

Trend Micro is warning all Linux users to update their systems immediately or fall prey to a new threat that takes advantage of a vulnerable in open-source protocol Samba.

The Samba vulnerability, named SambaCry because it took advantage of an SMB similar to the one used by WannaCry, allows an attacker to open a command shell in a vulnerable device and gain full control over it.

The vulnerability, CVE-2017-7494, affects all Samba versions since 3.5.0, and now SambaCry is being used for more nefarious purposes.

Earlier this year the SambaCry vulnerability was discovered when cryptocurrency minder EternalMiner went after Linux machines and mine Monero.

Now, Trend Micro researchers have discovered a newer version of the malware, named ELF-SHELLBIND.A. It also uses an open command shell but it also goes after IoT devices, including NAS devices that are often used by small businesses.

The new malware also goes after different architectures such as MIPS, ARM and PowerPC. Researchers say it’s the first time SambaCry has been used without EternalMiner as its payload.

“It is quite easy to find devices that use Samba in Shodan: searching for port 445 with a ‘samba’ string will turn up a viable IP list. An attacker would then simply need to create a tool that can automatically write malicious files to every IP address on the list. Once they write the files into the public folders, the devices with the SambaCry vulnerability could become ELF_SHELLBIND.A victims,” researchers explain.

The malware generally arrives in public folders as a shared object file. The attacker must then guess the absolute local filename and trigger an IPC request to trick the server into loading and running the file, which is now locally stored.

After a system of exports and Command & Control communication to a suspected server in East Africa, the attackers have gained the system’s IP address.

When the attacker connects to the right socket and enters the correct password, they now have an open command shell in the system.

Researchers also state that there is an OS patch for the CVE-2017-7494 vulnerability and users should update immediately.

“Since this vulnerability was patched in May, users who regularly update have no issue. However, Unix or Linux based devices (which comprise most IoT devices) are harder to protect. If Samba is enabled and the manufacturers have not sent out patches, then the devices are vulnerable. Users should proactively update or consult with the specific manufacturers.”

Interview: Culture and cloud - the battle for cybersecurity
ESET CTO Juraj Malcho talks about the importance of culture in a cybersecurity strategy and the challenges and benefits of a world in the cloud.
Enterprise cloud deployments being exploited by cybercriminals
A new report has revealed a concerning number of enterprises still believe security is the responsibility of the cloud service provider.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.