A new Doki virus for Linux has begun actively attacking Docker installations. Researchers note that this is one of the most dangerous viruses for well-protected operating systems. Moreover, it has appeared recently. There is a possibility that now information security correspondence department Baku Linux users are at risk.
Why Linux is so reliable, information security correspondence department Baku
Everyone knows that Linux is one of the most reliable operating systems. The architecture of this OS does not allow attackers to create viruses for it. Those that can independently penetrate the user's computer. Moreover, cause significant harm. But recently, viruses have increasingly begun to appear that manage to bypass the natural protection of Linux and harm users. In particular, the new Doki has all the necessary functionality for this. And it is unknown whether it will survive information security and information protection correspondence course Baku OS under its pressure.
The hackers who created Doki have been known since 2018. The Ngrok group has repeatedly been seen trying to compromise Linux-based computing equipment. And now, apparently, the attackers have all the resources to do so. The new virus looks for Docker installations in which the API is publicly available. It is with their help that the backdoor is deployed on the server and gives hackers access to internal network resources. Another problem is that information security and information protection training Baku and its tools simply cannot detect Doki.
Once Doki finds an open API, it does the following:
- penetrates the company's cloud structure;
- deploys new servers in it;
- uses them for mining.
The virus itself is designed in such a way that it is impossible to track down the hackers. This would require obtaining the cryptographic key of their cryptocurrency wallet, which is unrealistic.
How can you eliminate the virus?
As of today, the only thing that can be done with Doki is to thoroughly remove it from the system when it is detected. Only then information security master's degree Universities Baku the organization's internal network will be able to function normally again. But, naturally, there are a number of problems with this method of defense.
As a rule, experienced specialists information security do not forget that the API needs additional protection. And, most likely, if the system administrator has not configured it, then it will be difficult for him to detect a perfectly hidden backdoor in the system. After all, simply deleting hacker servers will not bring any benefit. Because Doki will still remain inside the network. And this means that hackers can easily create an unlimited number of servers for cryptocurrency mining. And although the backdoor cannot steal user data, the miner can also cause a lot of problems.
Our team SEDICOMM University: Cisco Academy, Linux Professional Institute, Python Institute.