Mirai 'botmasters' now exploiting Hadoop flaw to target Linux servers

Cyber criminals who used a botnet malware that took large parts of the internet offline in 2016 are now abusing Linux servers at scale.

Mirai, an open source malware, was conventionally used to target Internet of Things (IoT) devices like wireless cameras and routers. Malicious actors infamously used Mirai to construct a botnet that led to a devastating distributed denial of service (DDoS) attack against major online platforms.

But researchers have found evidence that certain strains are now targeting Linux servers, with a handful of attackers using custom tools to exploit a Hadoop YARN vulnerability and deliver malware instead of relying on bots to spread.

This is the first time security researchers have spotted non-IoT Mirai "in the wild", according to Network performance management firm Netscout.

"Mirai is no longer solely targeting IoT devices. While the techniques used to deliver Mirai to both IoT and Linux servers may be similar, it's much easier for attackers to attack the x86 monoculture of Linux servers than the wide array of CPUs used in IoT devices," said Netscout researcher Matthew Bing.

"The limited number of sources we've seen continually scanning for the Hadoop YARN vulnerability may indicate this activity is the work of a small group of attackers. Their goal is clear - to install the malware on as many devices as possible."

YARN (Yet Another Resource Negotiator) is a technology deployed as a resource management and job scheduling system for Apache Hadoop. It's responsible for allocating system resources to various applications running a Hadoop cluster, as well as scheduling tasks to execute on different nodes.

The vulnerability manifests as a command injection flaw that allows an attacker to execute arbitrary shell commands and resembles many flaws seen in IoT devices. It's for this reason Mirai attackers see Linux servers as a viable target.

His team's global network of 'honeypot' servers of recorded tens of thousands of attempts to exploit the vulnerability per day, indicating the flaw is being abused "at scale", with attackers sending exploits to as many vulnerable servers as they possibly can.

"Once gaining a foothold, Mirai on a Linux server behaves much like an IoT bot and begins brute-forcing telnet usernames and passwords," Bing continued.

"What's different now is that among the small, diminutive devices in the botnet lurk fully powered Linux servers."

Data centre-based Linux servers present a greater opportunity to launch DDoS attacks as they have more bandwidth than IoT devices, he explained, with attackers able to build a powerful botnet from just a handful of servers.

Mirai was behind one of the most disruptive DDoS attacks the world has sustained, with cyber criminals sending tens of millions of access requests to domain name system (DNS) provider Dyn from compromised IoT devices.

Dyn is used by a host of industry giants like Twitter, Spotify and Github to name a few, meaning all these services were taken offline when the DNS provider was targeted.