View source for Devnull

{{Short description|Linux computer worm}}
{{for|the Unix null device|/dev/null}}
{{No footnotes|date=March 2010}}
'''Devnull''' is a [[computer worm]] for the [[Linux]] [[operating system]] that was named after {{mono|[[/dev/null]]}}, [[Unix]]'s null device. This worm was found on 30 September 2002.

This worm, once the host has been compromised, downloads and executes a [[shell script]] from a web server. This script downloads a [[gzip]]ped executable file named {{mono|k.gz}} from the same address, and then decompresses and runs the file.

This downloaded file appears to be an [[IRC]] client. It connects to different channels and waits for commands to process on the infected host. 

Then the worm checks for presence of the [[GNU Compiler Collection|GCC]] compiler on the local system and, if found, creates a directory called {{mono|.socket2}}. Next, it downloads a compressed file called {{mono|devnull.tgz}}. After decompressing, two files are created: an [[Executable and Linkable Format|ELF]] binary file called {{mono|devnull}} and a source script file called {{mono|sslx.c}}. The latter gets compiled into the ELF binary {{mono|sslx}}.

The executable will scan for vulnerable hosts and use the compiled program to exploit a known [[OpenSSL]] vulnerability.{{which|date= November 2020}}

==See also==
*[[Linux malware]]

== External links ==
*[http://www.f-secure.com/v-descs/devnull.shtml F-Secure's Website: Linux/Devnull]

[[Category:Computer worms]]
[[Category:Linux malware]]

{{malware-stub}}