BASHLITE Malware Uses ShellShock to Hijack Devices Running BusyBox

A new version of the BASHLITE malware is designed to scan compromised networks for devices that use BusyBox and attempts to gain control of them by leveraging the recently disclosed GNU Bash vulnerability referred to as ShellShock.

The first variant of BASHLITE, detected as ELF_BASHLITE.A (ELF_FLOODER.W), was spotted by Trend Micro shortly after the existence of the ShellShock bug came to light. The threat, which was the payload of the ShellShock exploit code, had been used to launch distributed denial-of-service (DDoS) attacks.

ELF_BASHLITE.A checked to see if infected devices were running BusyBox, a set of programs needed to run a Linux system. BusyBox is designed for embedded operating systems such as the ones running on routers.

A newer version of BASHLITE spotted by Trend Micro researchers (ELF_BASHLITE.SMB) is designed not only to identify systems running BusyBox, but to also hijack them.

The malware first scans the network for BusyBox devices and attempts to access them by using a predefined list of usernames and passwords. The list of passwords includes “root,” “admin,” “12345,” “pass,” “password” and “123456.”

“Once a connection is established, it runs the command to download and run bin.sh and bin2.sh scripts, gaining control over the Busybox system,” Rhena Inocencio, threat response engineer at Trend Micro, wrote in a blog post on Thursday. “Remote attackers can possibly maximize their control on affected devices by deploying other components or malicious software into the system depending on their motive.”

Trend Micro advises administrators to make sure they change the default credentials on their network devices and disable remote shell if possible.

The ShellShock vulnerability was disclosed on September 24 and by September 30 security firms estimated that attacks using the exploit could top 1 billion. In mid-October, researchers reported that the Linux botnet known as Mayhem was also leveraging ShellShock to expand.

In the month following the disclosure of the flaw, several high-profile companies started releasing software updates to patch their products. However, as expected, many systems remain unpatched, allowing cybercriminals to abuse them.

Earlier this week, the cross-browser testing service BrowserStack revealed that cybercriminals breached an unpatched server using ShellShock and ultimately gained access to customer information. The hackers obtained email addresses which they used to tell customers that the service was shutting down.