Devnull is the name of a
computer worm
A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. It often uses a computer network to spread itself, relying on security failures on the target computer to access it. It wi ...
for the
Linux
Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, which i ...
operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common daemon (computing), services for computer programs.
Time-sharing operating systems scheduler (computing), schedule tasks for ef ...
that has been named after ,
Unix
Unix (; trademarked as UNIX) is a family of multitasking, multiuser computer operating systems that derive from the original AT&T Unix, whose development started in 1969 at the Bell Labs research center by Ken Thompson, Dennis Ritchie, a ...
's null device. This worm was found on 30 September 2002.
This worm, once the host has been compromised, downloads and executes a
shell script from a web server. This script downloads a
gzip
gzip is a file format and a software application used for file compression and decompression. The program was created by Jean-loup Gailly and Mark Adler as a free software replacement for the compress program used in early Unix systems, and ...
ped executable file named from the same address, and then decompresses and runs the file.
This downloaded file appears to be an
IRC client. It connects to different channels and waits for commands to process on the infected host.
Then the worm checks for presence of the
GCC compiler on the local system and, if found, creates a directory called . Next, it downloads a compressed file called . After decompressing, two files are created: an
ELF binary file called and a source script file called . The latter gets compiled into the ELF binary .
The executable will scan for vulnerable hosts and use the compiled program to exploit a known
OpenSSL
OpenSSL is a software library for applications that provide secure communications over computer networks against eavesdropping or need to identify the party at the other end. It is widely used by Internet servers, including the majority of HT ...
vulnerability.
See also
*
Linux malware
External links
F-Secure's Website: Linux/Devnull
Computer worms
Linux malware
{{malware-stub