New findings were published today on the “Gitpaste-12” worm, which uses GitHub and Pastebin to store component code and has at least 12 different attack modules available to exploit a range of vulns. It relies on GitHub and Pastebin to download payloads, two sites that aren’t usually blocked and their connection is encrypted, making it more difficult for traditional security measures to block this attack. Current targets are Linux based x86 servers, and Linux ARM and MIPS based IoT devices.
Juniper Threat Labs: Gitpaste-12: a new worming botnet with reverse shell capability spreading via GitHub and Pastebin – Gitpaste-12: a new worming botnet with reverse shell capability spreading via GitHub and Pastebin
Experts Comments
November 06, 2020
It's called Gitpaste-12 because of the usage of GitHub, Pastebin and 12 known attack modules and possibly more under development. It's a worm that attempts to use known exploits to compromise systems and may also attempt to brute force passwords.
Because some compromised systems have specific ports open, it spreads fast as you do not need to be an authorized user to send commands, and it can then spread to other devices on the same network or across the internet as well. Device and server.....Read More
Like(
November 06, 2020
The Gitpaste worm identified by Juniper Labs is interesting both in how it's deployed and it's targeting of Linux and IoT devices. By using Pastebin and GitHub, two services that many organizations allow access to, the attackers are trying to slip through firewall and proxy rules that might otherwise stop them. However, there are multiple tools, including behavioral analytics, that can identify and block these connections, dramatically reducing the threat from this attack vector.
November 09, 2020
These types of infections are extremely hard to block via enterprise security products. Enterprise development and security teams can’t just block GitHub and Pastebin, because they are tied to legitimate innovation pipelines. By taking advantage of these stalwart entities, Gitpaste-12 is exploiting the trust of open source software repositories and making detection and IOC-based blocks difficult.
Gitpaste-12 had been living quietly on GitHub since July 2020, until it was taken down last.....Read More
Submit Your Expert Comments
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.Be part of our growing Information Security Expert Community (1000+), please register here.
Linkedin Message
@Ax Sharma, Security Researcher, provides expert commentary at @Information Security Buzz.
"Sophisticated malware and cryptominer with a low or zero detection rate..."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/new-gitpaste-12-worming-botnet-spreads-via-github-and-pastebin-experts-perspectives
Facebook Message
@Ax Sharma, Security Researcher, provides expert commentary at @Information Security Buzz.
"Sophisticated malware and cryptominer with a low or zero detection rate..."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/new-gitpaste-12-worming-botnet-spreads-via-github-and-pastebin-experts-perspectives