Linux systems infiltrated and controlled in a DDoS botnet

[GreyGeek]

http://www.net-security.org/secworld.php?id=17322

"We have traced one of the most significant DDoS attack campaigns of 2014 to infection by IptabLes and IptabLex malware on Linux systems,"
...
"This is a significant cybersecurity development because the Linux operating system has not typically been used in DDoS botnets. Malicious actors have taken advantage of known vulnerabilities in unpatched Linux software to launch DDoS attacks. Linux admins need to know about this threat to take action to protect their servers,"...
...
Command and control centers (C2, CC) for IptabLes and IptabLex are currently located in Asia. Infected systems were initially known to be in Asia; however, more recently many infections were observed on servers hosted in the U.S. and in other regions.

In the past, most DDoS bot infections originated from Russia, but now Asia appears to be a significant source of DDoS development.

As usual, the fault lies with the negligent admin who sets up a Linux server and then forgets it, thinking that because it is Linux it will be secure no matter what.

Same problem, five years ago.

As Steve and others have often pointed out, security is a process, not a product.

[SteveRiley]

And it's a never-ending process. Great job security!

[NickStone]

With all these security issues getting highlighted recently with regards to Linux and with all the "doom and gloom" that Mr Riley keeps mentioning relating to Linux I've decided that after 10 years with Linux I have had enough and am returning to a more stable OS.

Anyone know where I can buy a (legal) copy of Windows Vista?

[SteveRiley]

The doom and goom is everywhere, dude. It really doesn't matter what software you're running.

I would put some kind of smiley icon here, but that would mean I'm trying to be funny. I'm not.

[GreyGeek]

Next to the careless admin is the careless user. Simple passwords, or no passwords, or the same password everywhere, no firewall on either the computer or the router, not allowing updates of bug fixes or security hole patches, abusing java, forwarding email from Windows boxes to other Windows boxes without scrubbing it ...