Devnull

Devnull is a <a href="/facts/Computer_worm/9qKR1Hx5">computer worm</a> for the <a href="/facts/Linux/9FvCKSTq">Linux</a> <a href="/facts/Operating_system/8XTuvMh2">operating system</a> that was named after <a href="/facts/%2fdev%2fnull/MdLRSA8E">/dev/null</a>, <a href="/facts/Unix/0pNL2seI">Unix</a>'s null device. This worm was found on 30 September 2002.
This worm, once the host has been compromised, downloads and executes a <a href="/facts/Shell_script/NE7YvsBD">shell script</a> from a web server. This script downloads a <a href="/facts/Gzip/H23uqvyx">gzipped</a> executable file named k.gz from the same address, and then decompresses and runs the file.
This downloaded file appears to be an <a href="/facts/IRC/oDr3VN9q">IRC</a> client. It connects to different channels and waits for commands to process on the infected host. 
Then the worm checks for presence of the <a href="/facts/GNU_Compiler_Collection/t07jh01k">GCC</a> compiler on the local system and, if found, creates a directory called .socket2. Next, it downloads a compressed file called devnull.tgz. After decompressing, two files are created: an <a href="/facts/Executable_and_Linkable_Format/ro2CYqso">ELF</a> binary file called devnull and a source script file called sslx.c. The latter gets compiled into the ELF binary sslx.
The executable will scan for vulnerable hosts and use the compiled program to exploit a known <a href="/facts/OpenSSL/aXvs5fo2">OpenSSL</a> vulnerability.[which?]

Devnull open-in-new

Devnull