SSH Keys Harvested To Launch Linux Attacks

Security Professionals at SANS are warning users about a new surge of Linux attacks that are employing SSH (Stolen Secure Shell) keys. According to them, the attack is associated with a malicious rootkit called Phalanx2.

Security professionals point out that the SSH protocol is employed as an arrangement to conduct secured communications among networked systems. The arrangement was initially used as a substitute for the Telnet protocol that is not so secured.

However, explaining the rootkit attack, a security advisory from US-CERT (US Computer Emergency Response Team) stated that the malicious rootkit has been derived from an older malware sample, and it stores itself on a directory named "/etc/khubd.p2/" tha...

» SPAMfighter News - 9/5/2008