Vulnerability that lets hackers SSH into Linux devices is under active exploitation
Hackers are actively exploiting a recently discovered critical vulnerability that allows them to log in to privileged accounts on many Linux systems, multiple researchers are reporting.
Key points
- The vulnerability, tracked under the name *sshole, arises from the interaction between OpenSSH and a code library known as musl.
- Attackers conducting "mature intrusions" Security firm Greynoise said Monday that honeypots it maintains in Southeast Asia have come under attack by a group it’s tracking as GT10.
- Greynoise subsequently gained access to a GT10 server that revealed potential other victims and some of the tools used in the campaign.
Linux systems that use both of these packages and meet certain other requirements can be hacked to give unauthenticated access to high-privilege accounts in a matter of seconds.
*sshole became publicly known last Thursday and quickly stoked concerns it could lead to widespread compromise of Linux machines.
Additional details
- The group conducted “mature intrusions" into the systems, which Greynoise uses to detect attempted or successful attacks in real time.
- A backdoor the group is using in the attacks contains Chinese language comments and appears to be generated with the use of AI.
- Four days later, the prediction shows signs of becoming real.
How this summary was made: extractive summary — built from the sources' own reporting. It is drawn only from the reporting of the sources listed below — read the originals for full detail. How we summarize →
Advertisement
Every article behind this summary — 1 article from 1 outlet
Get stories like this in your inbox.
Subscribe — it's freeOne free email at 6am — your topics, deduplicated, five minutes. No account, no paywall.