A security researcher has found a piece of malware that appears to target the "internet of things".
Kaoru Hayashi, a security researcher at Symantec discovered the worm called Linux.Darlloz, which he claims is capable of attacking a range of small, internet-enabled devices in addition to traditional computers.
Hayashi said that no attacks against devices such as home routers, set-top boxes and security cameras have been found in the wild but warned that most users would not realise they were at risk as they would be unaware that their own devices ran on Linux.
The worm exploits a PHP vulnerability to propagate itself in the wild and uses an old PHP vulnerability that was patched in May last year, according to the researcher's blog posting. The attacker recently created the worm based on the proof of concept (PoC) code released in late Oct 2013.
On execution, the worm generates IP addresses randomly, accesses a specific path on the machine with well-known ID and passwords, and sends HTTP POST requests, which exploit the vulnerability. If the target is unpatched, it downloads the worm from a malicious server and starts searching for its next target.
"Currently, the worm seems to infect only Intel x86 systems, because the downloaded URL in the exploit code is hard-coded to the ELF binary for Intel architectures," said Hayashi.
He said that because Linux has been ported to various architectures other than Intel, there is a chance that the worm could spread to other small devices with different processors.
"The attacker is apparently trying to maximise the infection opportunity by expanding coverage to any devices running on Linux. However, we have not confirmed attacks against non-PC devices yet," he said.
Symantec has verified that the attacker already hosts some variants for other architectures including ARM, PPC, MIPS and MIPSEL on the same malicious server.
The firm warned users to verify all devices connected to the network, update their software to the latest version and update their security software when it is made available on their devices.
