How Can You Protect Your Linux Infrastructure From XorDdos Malware

Microsoft has recently published a study on XorDdos malware. The report alarms a drastic rise in the activities of XorDdos malware. According to the report shared by Microsoft, there has been a surge of 254% in the past six months. This shows there is a worst waiting to happen. So, it’s time to learn about the XorDdos malware, its capabilities, infection method, detection, and the most important protection tips. Since the malware targets Linux-based operating systems deployed on cloud infrastructures and Internet of Things (IoT) devices, it is important to protect your Linux infrastructure from XorDdos malware.

Let’s see how to protect your Linux infrastructure from XorDdos malware in this post.

About The XorDdos Malware:

The XorDdos malware is a type of malicious software that is designed to launch distributed denial-of-service (DDoS) attacks. The malware was first discovered in 2014 by the research group MalwareMustDie, and has since been used in a number of high-profile DDoS attacks, including against KrebsOnSecurity, OVH, and Dyn. The malware was named XorDdos as it was active in denial of service activities on Linux infrastructure with the use of XOR function for encrypted communication with its command and control servers.

XorDdos Malware’s Initial Infection Method:

XorDdos malware predominantly targets Secure Shell (SSH) logins. Since SSH is the most commonly used protocol used by administrators for remote access because it allows encrypted communications over insecure networks. XorDdos initially tries to brute force the targets to gather valid login credentials. Once it has valid SSH keys, then it runs a script with root privileges to download and install XorDdos malware on the target device.

The study report describes two of XorDdos’ methods for initial access. The first method involves copying a malicious ELF file to temporary file storage /dev/shm and then running it. Later the files written to the /dev/shm will be deleted during system restart for covert operation.

In the second access method, the malware executes a bash script that performs the below actions.

1. Identifies the writable directory out of this list:

• /bin

• /home

• /root

• /tmp

• /usr

2. Once it identifies the writable directory, it changes to that directory and then downloads the ELF file payload from an external domain ‘hxxp://Ipv4PII_777789ffaa5b68638cdaea8ecfa10b24b326ed7d/1[.]txt‘ using curl command and saves the downloaded file as ygljglkjgfg0.

3. Then the malware makes it executable using the ‘chmod’ command and then executes it. The full technical details are published at this URL, and please visit the post for the original report.

How Can You Protect Your Linux Infrastructure From XorDdos Malware?

There are a number of steps you can take to protect your Linux infrastructure from XorDdos malware:

1. Block the IoCs across the network: Block all the indicators of compromise on your security defense systems like firewalls, web proxies, Endpoint solutions, network devices, and wherever it is possible to block.
2. Identify the infected endpoints: Query for the IoCs on your SIEM or any centralized security/log management systems across the network. Isolate or go for reimage process if you see a device associated with the identified IoCs.
3. Analyze Failed Logins: Since XorDdos malware primarily performs SSH brute force on Linux machines, it is good to capture all the login failed events and analyze them to locate malicious activity related to XorDdos malware.
4. Keep your operating system and software up to date: Make sure you are running the latest version of your operating system, as well as all security updates. This will help to ensure that your server is not vulnerable to known exploits.
5. Harden your server: There are a number of ways to harden your server, such as disabling unneeded services and using a firewall.
6. Use a DDoS protection service: A DDoS protection service can help to identify and filter out malicious traffic before it reaches your server.
7. Monitor your network traffic: Monitoring your network traffic can help you to identify unusual or suspicious activity.

Microsoft created a Microsoft 365 Defender query for advanced detections. Run this query in Microsoft Defender Security Center to hunt the malware:

DeviceLogonEvents
| where InitiatingProcessFileName == "sshd"
    and ActionType == "LogonFailed"
| summarize count() by dayOfYear = datetime_part("dayOfYear", Timestamp)
| sort by dayOfYear
| render linechart

IoCs Of XorDdos Malware:

Please see the captured IoCs of XorDdos malware:

File information

Dropped files

Download URLs

• www[.]enoan2107[.]com:3306
• www[.]gzcfr5axf6[.]com:3306
• hxxp://aa[.]hostasa[.]org/config.rar

Conclusion

XorDdos is a malware that allows attackers to launch distributed denial of service (DDoS) attacks. In order to protect your Linux infrastructure from XorDdos malware, you should keep your operating system and software up to date, harden your server, use a DDoS protection service, and monitor your network traffic.

We hope this post will help you know how to protect your Linux infrastructure from XorDdos malware. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this.

• How A Threat Group Carried Out Linux Cryptojacking Campaign From Romania?
• Three Different Ways To Boot A Raspberry Pi From a USB Drive:
• The Simplest Way To Install WordPress On Linux, Windows, And Cloud Servers!
• Boot A Raspberry Pi From a USB Drive:
• Understanding Indicator Of Compromise (IoC)