'Bashlite' Malware Leverages ShellShock In BusyBox Attack
Researchers at Trend Micro are warning that a new version of the Bashlite malware is using the ShellShock vulnerability (CVE-2014-6271) to gain control of devices using BusyBox.
BusyBox is built on top of the Linux kernel and is used by devices such as routers. According to Trend Micro, recent samples of Bashlite (ELF_BASHLITE.SMB) scan networks for devices and machines running on BusyBox, logs in using a set of usernames and passwords, and then runs a command to download and run bin.sh and bin2.sh scripts to gain control over the BusyBox system.
"Remote attackers can possibly maximize their control on affected devices by deploying other components or malicious software into the system depending on their motive," blogs Rhena Inocencio, threat response engineer at Trend Micro.
