THE CRUNCH
A recently disclosed critical vulnerability that lets attackers log in to privileged accounts on many Linux systems is now being actively exploited, according to multiple researchers. The flaw, tracked as *sshole, stems from the interaction between OpenSSH, the standard tool for secure remote logins, and musl, a lightweight code library some Linux systems use instead of the more common glibc. Systems running both packages, and meeting certain other requirements, can be compromised to give unauthenticated access to high-privilege accounts within seconds.
The vulnerability became publicly known last Thursday and quickly raised concerns that it could lead to widespread compromise of Linux machines. Four days on, those concerns show signs of materialising. Security firm Greynoise said on Monday that honeypots it operates in Southeast Asia, which it uses to detect attempted or successful attacks in real time, had been targeted by a group it tracks as GT10.
Greynoise described the intrusions as "mature intrusions" and said it subsequently gained access to a GT10 server, which revealed potential additional victims and some of the tools used in the campaign. The backdoor deployed in the attacks contains Chinese-language comments and appears to have been generated with the help of AI, per Greynoise's assessment.
Earlier on this story
Crunchy Tech briefs on this story.