BASHLITE (also known as Gafgyt, Lizkebab, PinkSlip, Qbot, Torlus and LizardStresser) is
malware
Malware (a portmanteau for ''malicious software'') is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, depri ...
which infects
Linux
Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, which ...
systems in order to launch
distributed denial-of-service attack
In computing, a denial-of-service attack (DoS attack) is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connec ...
s (DDoS). Originally it was also known under the name
Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400
Gbps
In telecommunications, data-transfer rate is the average number of bits (bitrate), characters or symbols (baudrate), or data blocks per unit time passing through a communication link in a data-transmission system. Common data rate units are multi ...
.
The original version in 2014 exploited a flaw in the
bash
Bash or BASH may refer to:
Arts and entertainment
* ''Bash!'' (Rockapella album), 1992
* ''Bash!'' (Dave Bailey album), 1961
* '' Bash: Latter-Day Plays'', a dramatic triptych
* ''BASH!'' (role-playing game), a 2005 superhero game
* "Bash" ('' ...
shell - the
Shellshock software bug - to exploit devices running
BusyBox
BusyBox is a software suite that provides several Unix utilities in a single executable file. It runs in a variety of POSIX environments such as Linux, Android, and FreeBSD, although many of the tools it provides are designed to work with in ...
. A few months later a variant was detected that could also infect other vulnerable devices in the local network. In 2015 its source code was leaked, causing a proliferation of different variants,
and by 2016 it was reported that one million devices have been infected.
Of the identifiable devices participating in these botnets in August 2016 almost 96 percent were
IoT
The Internet of things (IoT) describes physical objects (or groups of such objects) with sensors, processing ability, software and other technologies that connect and exchange data with other devices and systems over the Internet or other com ...
devices (of which 95 percent were cameras and
DVRs), roughly 4 percent were
home routers - and less than 1 percent were compromised
Linux servers.
Design
BASHLITE is written in
C, and designed to easily cross-compile to various
computer architecture
In computer engineering, computer architecture is a description of the structure of a computer system made from component parts. It can sometimes be a high-level description that ignores details of the implementation. At a more detailed level, t ...
s.
Exact capabilities differ between variants, but the most common features
generate several different types of DDoS attacks: it can hold open
TCP connections, send a random string of junk characters to a TCP or a
UDP port
A port is a maritime facility comprising one or more wharves or loading areas, where ships load and discharge cargo and passengers. Although usually situated on a sea coast or estuary, ports can also be found far inland, such as Ham ...
, or repeatedly send TCP
packets with specified flags. They may also have a mechanism to run arbitrary shell commands on the infected machine. There are no facilities for
reflected or
amplification attacks.
BASHLITE uses a
client–server model
The client–server model is a distributed application structure that partitions tasks or workloads between the providers of a resource or service, called servers, and service requesters, called clients. Often clients and servers communicate over ...
for command and control. The protocol used for communication is essentially a lightweight version of
Internet Relay Chat
Internet Relay Chat (IRC) is a text-based chat system for instant messaging. IRC is designed for group communication in discussion forums, called ''channels'', but also allows one-on-one communication via private messages as well as chat and ...
(IRC).
Even though it supports multiple command and control servers, most variants only have a single command and control IP-address
hardcoded
Hard coding (also hard-coding or hardcoding) is the software development practice of embedding data directly into the source code of a computer program, program or other executable object, as opposed to obtaining the data from external sources or ...
.
It propagates via
brute forcing, using a built-in dictionary of common usernames and passwords. The malware connects to random IP addresses and attempts to login, with successful logins reported back to the command and control server.
See also
*
Low Orbit Ion Cannon
Low Orbit Ion Cannon (LOIC) is an open-source network stress testing and denial-of-service attack application written in C#. LOIC was initially developed by Praetox Technologies, however it was later released into the public domain and is cur ...
– a stress test tool that has been used for DDoS attacks
*
High Orbit Ion Cannon
High Orbit Ion Cannon (HOIC) is an open-source network stress testing and denial-of-service attack application designed to attack as many as 256 URLs at the same time. It was designed to replace the Low Orbit Ion Cannon which was developed by Pr ...
– the replacement for LOIC used in DDoS attacks
*
Denial-of-service attack
In computing, a denial-of-service attack (DoS attack) is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connect ...
(DoS)
*
Fork bomb
In computing, a fork bomb (also called rabbit virus or wabbit) is a denial-of-service attack wherein a process continually replicates itself to deplete available system resources, slowing down or crashing the system due to resource starvation. ...
*
Mirai (malware)
Mirai (from the Japanese word for "future", 未来) is a malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks. It primarily targets online consumer d ...
*
Hajime (malware)
Hajime (Japanese for "beginning") is a malware which appears to be similar to the Wifatch malware in that it appears to attempt to secure devices.
Hajime is also far more advanced than Mirai, according to various researchers.
The top countries ...
*
Slowloris (computer security)
Slowloris is a type of denial of service attack tool which allows a single machine to take down another machine's web server with minimal bandwidth and side effects on unrelated services and ports.
Slowloris tries to keep many connections to th ...
*
ReDoS A regular expression denial of service (ReDoS)
is an algorithmic complexity attack that produces a denial-of-service by providing a regular expression and/or an input that takes a long time to evaluate. The attack exploits the fact that many reg ...
References
{{IoT Malware
Denial-of-service attacks
Botnets
IoT malware
Linux malware