The Internet of Things was always set to be a trend that would interest hackers and today researchers have described a piece of Linux malware that appears to be targeting machine-to-machine devices.
The Darlloz worm was seen using an old PHP vulnerability to spread, according to Symantec. Although the fix was issued in March 2012, it’s unclear how well patched machine-to-machine systems are. A Proof of Concept (PoC) exploit which the attacker appears to be using was publicised in late October.
No attacks have been reported in the wild, but given the niche area the Linux worm is operating in, many may simply not know they have been infected.
Linux is the operating system of choice on many automated, connected devices, from routers to industrial control systems, many of which also use interfaces delivered via Apache Web servers and PHP servers. Intel x86 systems appear to be the main target of Darlloz.
But the attacker is also sitting on variants for other architectures including ARM, PPC, MIPS and MIPSEL. That would indicate the attacker is highly interested in the Internet of Things.
“Vendors of devices with hidden operating systems and software, who have configured their products without asking users, have complicated matters. Many users may not be aware that they are using vulnerable devices in their homes or offices,” Symantec added.
“Another issue we could face is that even if users notice vulnerable devices, no updates have been provided to some products by the vendor, because of outdated technology or hardware limitations, such as not having enough memory or a CPU that is too slow to support new versions of the software.”
The security giant recently said it believes 2014 will be the year the Internet of Things becomes the Internet of Vulnerabilities. Many have concerns around the drive to connect everything and its impact on privacy.
What do you know about Internet security? Find out with our quiz!
X's global affairs head, Nick Pickles, confirms departure after a decade working at the platform…
British competition regulator closes investigation into Microsoft's hiring of Inflection AI staff, which it deems…
First public response made by Telegram CEO Pavel Durov, after arrest in France over alleged…
US authorities probe fatal four-vehicle crash caused by Ford Mustang Mach-E electric vehicle using BlueCruise…
Margrethe Vestager set to step down as EU competition commissioner after a decade in office…
EU regulators to seek views from industry players on Google's DMA compliance plans ahead of…
View Comments
Very simple , why do you need to connect things to the internet? I mean really? A toaster? A fridge? A garage? I don't care. These are not utilities that we need.