Tips to Protect Your Linux Systems From RapperBot Malware

In this post, we are talking about a new malware that most likely affects Linux systems. Researchers from FortiGuard Labs from Fortinet, a well know enterprise security firm, have been monitoring a fast-growing IoT malware family known as “RapperBot.” since mid-June 2022. The malware is said to be capable of brute forcing SSH servers to capture their credentials. Since remote attackers use this malware to gain control of vulnerable Linux systems, it is highly critical to know more about RapperBot malware and take all the precautions o protect your Linux systems from RapperBot malware.

Before we see how to protect your Linux systems from RapperBot Malware, let’s see some key extracts from the report with its working and, finally, some of the protection methods.

Key Extracts from the Report:

About RapperBot Malware:

RapperBot belongs to IoT malware families whose source code is expected to be imported from the Mirai botnet. The thing that keeps RapperBot different from its source Mirai is that RapperBot targets SSH credentials on vulnerable Linux servers instead of Telnet service. Attackers use this malware to compromise the victim and take control of the victim system with root privileges. 

Researchers say the recent new samples clearly show that the malware keeps evolving with additional code to maintain persistence and work covered under the radar. Additionally, the malware has developed capabilities of importing new credentials from the new C2 servers instead of using hardcoded credentials in its earlier variants to brute force the victim. In the brute force attack, if the malware finds a successful match of username and password, it writes back the successful login credentials to the C2 server and stores them in its global database. 

This allows the threat actors to continually add new SSH credentials without having to update infected devices with new samples. This port number ranges from 4343 to 4345 in the latest samples.

– FortiGuard Labs

in the latest samples, the malware has started adding the root user and SSH keys that further allows malware authors to take complete control of the device and keep their presence even after the reboot or removal of the malware. Please read the complete technical details about the RapperBot malware here. 

RapperBot execution flow Published by FortiGuard Labs

Tips to Protect Your Linux Systems from Rapp

There are a number of ways to protect your SSH credentials from brute force attacks. The most common and effective way is to use a strong password. A strong password should be at least eight characters long and should include a mix of letters, numbers, and symbols. It should also be changed regularly.

Another way to protect your SSH credentials from brute force attacks is to use two-factor authentication. Two-factor authentication requires users to provide both a password and a code generated by an authenticator app or device in order to log in. This makes it much more difficult for attackers to gain access to your account, even if they have your password.

You can also protect your SSH credentials by limiting the number of failed login attempts. After a certain number of failed login attempts, the account will be locked and the user will need to contact an administrator in order to regain access.

Finally, you can use a tool like fail2ban to automatically ban IP addresses that are associated with brute force attacks. This will prevent the attacker from even attempting to log in, as their IP address will be blocked.

By following these steps, you can protect your SSH credentials from brute force attacks and keep your account safe.