hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015Linux malwareUsually, when we discuss malware, the focus is on Windows malware. This is due to thepopularity of the platform for desktop users and the use of Windows as the main platformin many corporate environments. However, if we consider server infrastructure—especiallythe servers that serve the majority of Internet content—we see that the picture is somewhatdifferent. Apache server is the most common 86 HTTP server application today and servescontent on almost 60 percent of all websites, usually running on a Linux server distribution.The second most common HTTP server application, nginx, accounts for more than 22 percentof HTTP servers and usually also runs on a non-Windows platform. It is safe to assume thatover 80 percent of Internet HTTP content is served by servers that are running some flavorof Linux, which makes Linux-based systems, and especially server applications, an attractivetarget for attackers.In the last couple of years there has been a renewed interest in malware written for Linux, andwe felt that it was important to examine this in our report.Top Linux malwareWe tend to hear more about Linux when a major vulnerability in software is connected withit, such as was the case with CVE-2014-6271 (Shellshock). The majority of Linux malwarebelongs to categories that allow attackers to use affected systems as platforms for launchingDistributed Denial of Service (DDoS) attacks.Figure 11. Top Linux ELF (Executable and Linking Format) malware discovered by ReversingLabs in 2014, by family66%9%6%4%4%3%3%2%1%1%1%ElknotMaydayTsunamiRstGaniwRoopreFlooderSharkDoflooAidraOthersHowever, in the top 10 Linux ELF-based malware discovered in 2014, there are a couple ofexceptions to the DDoS theme. The first of the exceptions is RST, a parasitic virus that’s beenaround for more than 10 years. It infects other ELF executable files; this is an older style ofmalware and its inclusion in the list of top Linux malware is an indication that there is littleawareness of the need to run anti-malware software on Linux systems.The second exception is the Aidra 87 worm, accounting for more than 1 percent of all discoveredELF samples. Aidra, together with its counterpart Darlloz, is designed to scan the Internetfor small office or home Internet routers and other devices and to spread by exploitingvulnerabilities or using default credentials if the telnet service on the target is running.Aidra and Darlloz belong to a relatively new class of malware that exposes some of the risksposed by different Linux implementations on small devices. With the development of theInternet of Things, many non-obvious computing devices will run Linux and connect to theInternet so we can expect more attacks like this in the next few years.86http://w3techs.com/technologies/overview/web_server/all.87http://now.avg.com/war-of-the-worms/.32