New Worm Attacks Linux Devices
Symantec says Linux-Darlloz burrows in through PHP.
Symantec has announced the discovery of a new worm that attacks Linux systems. The potential targets include Linux computers, as well as home routers, set-top boxes, and other devices running embedded Linux. The Linux.Darlloz worm spreads by exploiting a vulnerability in php-cgi. Security experts have been aware of this exploit for over a year, and patches have been available for Linux systems since May 2012; however, unpatched home computers and embedded devices that rarely see updates are potentially vulnerable to attack.
According to Symantec's Kaoru Hayashi, who announced the worm on his blog, “...the worm generates IP addresses randomly, accesses a specific path on the machine with well known ID and passwords, and sends HTTP POST requests, which exploit the vulnerability. If the target is unpatched, it downloads the worm from a malicious server and starts searching for its next target.”
Hayashi states that the ultimate target for this attack could be the “Internet of Things.” Although the variant discovered in the lab is designed for attacking x86 systems, it appears the attacker has other versions of the worm tailored for ARM, PPC, MIPS, and MIPSEL architectures.
To keep the worm away, Symantec recommends the usual precautions, such as installing the latest software versions and patches and using stronger passwords. Also, Hayashi's blog post recommends configuring the gateway to block incoming HTTP POST requests to -/cgi-bin/php and several other specific paths related to php-cgi.
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Arch Linux Available for Windows Subsystem for Linux
If you've ever wanted to use a rolling release distribution with WSL, now's your chance.
-
System76 Releases COSMIC Alpha 7
With scores of bug fixes and a really cool workspaces feature, COSMIC is looking to soon migrate from alpha to beta.
-
OpenMandriva Lx 6.0 Available for Installation
The latest release of OpenMandriva has arrived with a new kernel, an updated Plasma desktop, and a server edition.
-
TrueNAS 25.04 Arrives with Thousands of Changes
One of the most popular Linux-based NAS solutions has rolled out the latest edition, based on Ubuntu 25.04.
-
Fedora 42 Available with Two New Spins
The latest release from the Fedora Project includes the usual updates, a new kernel, an official KDE Plasma spin, and a new System76 spin.
-
So Long, ArcoLinux
The ArcoLinux distribution is the latest Linux distribution to shut down.
-
What Open Source Pros Look for in a Job Role
Learn what professionals in technical and non-technical roles say is most important when seeking a new position.
-
Asahi Linux Runs into Issues with M4 Support
Due to Apple Silicon changes, the Asahi Linux project is at odds with adding support for the M4 chips.
-
Plasma 6.3.4 Now Available
Although not a major release, Plasma 6.3.4 does fix some bugs and offer a subtle change for the Plasma sidebar.
-
Linux Kernel 6.15 First Release Candidate Now Available
Linux Torvalds has announced that the release candidate for the final release of the Linux 6.15 series is now available.