Protect your corporate IT network from hackers and other unwanted intruders with Proxy Sentinel™. Click here for all the details and get the peace of mind you deserve.
Back to our Homepage Proxy Sentinel™ high performance Internet proxy server and secure firewall solution Firewall Sentinel™ secure & powerful Internet firewall solution About Internet Security.ca and GCIS Frequently Asked Questions on Internet security issues Internet Security Industry News - Stay informed of what's happening Contact Internet Security.ca today and order your Proxy Sentinel™ or Firewall Sentinel™ server now!

New internet security flaw discovered in Linux operating system

If you need reliability when it comes to SMTP servers, get the best, get Port 587.

Get a powerful Linux Dual-Core dedicated server for less than $2.67 a day!

Share on Twitter.

July 27, 2015

Click here to order the best deal on a HP enterprise dedicated server and at a great price.

In an effort to infect users, hackers have bundled together a new Linux backdoor in the OS. Fortunately, the botnet agent, which packs very nasty code, is only partially functional, but caution is still advised nevertheless.

The backdoor, dubbed DKLKT-1 was designed to be a cross-platform capable of infecting both Windows and Linux machines and servers.

Overall, cyber criminals planned to equip the backdoor with a large number of functions typical of SOCKS proxy servers, remote shells, file managers, email spammers and so on.

But at the moment, the malware ignores the majority of incoming commands due to programming mistakes made by the hackers.

It's now obvious to the Linux community that the program was quickly put together without much consideration for the design and programming process.

For one thing “the disassembled code contains some strange constructions that have absolutely nothing to do with Linux”, according to an advisory on the malware by security software firm Doctor Web.

Nevertheles, other elements of the malicious code suggest those behind the backdoor were far removed from malware coders, and this must still be handled with care.

If successfully implemented into a system, the malware will try to register itself in the operating system as a daemon system service.

Thereafter, it uses LZO compression and the Blowfish encryption algorithm to then send message commands to remote control servers.

Every single packet contains a checksum, so that the recipient could verify data integrity, in an effort to further confuse the user.

The DKLKT-1 malware then waits for incoming commands that can include launching a DDoS attack, starting a SOCKS proxy server, running a specified application, rebooting the affected machine, or turning it off completely.

Other commands are either ignored or processed incorrectly. The trojan, in its present implementation, basically lends compromised proxies to a variety of volumetric DDoS attacks-- eg. SYN Flood, ICMP Flooding and UDP Flooding, for example.

Detection for the DKLKT-1 Linux backdoor has been added to the Dr Web virus database. Other security companies are expected to follow suit in the next few days.

Source: Dr Web.

Get a powerful Linux Dual-Core dedicated server for less than $2.67 a day!

Share on Twitter.


Home | Proxy Sentinel™ | Firewall Sentinel™ | FAQ | News | Sitemap | Contact
Copyright © Internet Security.ca    Terms of use    Privacy agreement    Legal disclaimer