Another Shellshock Vulnerability Targets SMTP Servers

Shellshock or Bash Bug

IT Security Lab Trend Micro has recently discovered another ShellShock attack or Bash Bug which mainly targets SMTP servers. The special thing about the attack is that it uses emails to spread the exploit. 

If the exploit code is executed successfully on a vulnerable SMTP server, It will start downloading  an IRC bot known as “JST Perl IrcBot” and execute it. To remain undetected, it will automatically delete itself.

Must Read: Verizon Tightens Its Cyber Security by Adding FireEye Tools

How Does the attack work (Image by Trend Micro)

How Does it Work?

There are some step by step method to successfully perform the attack. To to that 

• The attacker will create a custom email with Shellshock malicious code inserted in the Subject, From, To and CC fields.
• Then the email will be sent to any SMTP(Simple Mail Transfer Protocol) server
• When a vulnerable SMTP mail server receives this malicious email, the inserted Shellshock payload will be executed and an IRC bot will be downloaded and executed. At the same time a connection with the IRC server will also be established.
• Voila ! the attacker then easily can perform spam run, DDos Attack, send mail, scan ports, download files from URLs or run UNIX commands.

Must Read: *NIX OS FTP Client is Vulnerable To Remote Command Execution

Possible Vulnerable Mail Servers

• qmail Message Transfer Agent
• exim MTA ( version <4)
• PostFix using procmail (a Message Delivery Agent,used for shorting & filtering of incoming mails). 

IRC Bots Sources

According to Trend Micro report, the malicious email carrying the Shellshock payload will download the IRC Bots from the following URLs. Most of the IRC Bots are written in Perl.

• hxxp://{BLOCKED}.{BLOCKED}.31.165/ex.txt
• hxxp://{BLOCKED}.{BLOCKED}.251.41/legend.txt
• hxxp://{BLOCKED}.{BLOCKED}.175.145/ex.sh

ex.txt and ex.sh are the same file but with different file extensions, Trend Micro reports.They have identified as much as 44 IRC Bots till now.

Victim Countries

The attacks are mainly being noticed in Taiwan and Germany followed by US with 16% attack rate.

 Necessary Steps

 Trend Micro recommends IT administrators to block all related IPs and domains related to this attack.

Source: Trend Micro