Virenbibliothek

Dank der Analyse der von Cyber-Kriminellen verwendeten Technologien können Schlussfolgerungen zu möglichen Entwicklungsrichtungen gezogen werden. Somit können auch zukünftige Bedrohungen bekämpft werden. Erfahren Sie mehr darüber, wie Schädlinge in infizierten Systemen agieren und wie Sie diesen Widerstand leisten können.

Linux.UbntFM in virus library:

A family of worms for different versions of Linux, including Air OS that is developed by Ubiquiti Networks and installed on its devices. It is implemented as bash scripts.

Initially, the Trojans of this family were distributed via a vulnerability in the firmware of devices produced by Ubiquiti. Later version received a function for connection to remote devices via the SSH protocol (ports 22, 2222), with the use of logins “root”, “admin”, “ubnt” and the following passwords:

admin
root
ubnt
ubnt123
password
abcd1234
abcdefgh
qwerty
abc123
111111
123456
123123
123qwe
12345678
admin1
!@#$%^&*
ubiquiti
000000
1q2w3e4r
!Q@W#E$R
1qaz2wsx

In case of successful compromise, new user is added to the system (such logins as “mother ” and “moth3r ” are known) and a key for the access via the SSH protocol. They also install themselves on the compromised device to folder “/etc/persistent/.mf” and get registered in the autorun by modifying file /etc/persistent/rc.poststart.