Slashdot Mirror
Mystery Malware Affecting Linux/Apache Web Servers
lisah writes "Reports are beginning to surface that some Web servers running Linux and Apache are unwittingly infecting thousands of computers, exploiting vulnerabilities in QuickTime, Yahoo! Messenger, and Windows. One way to tell if your machine is infected is if you're unable to create a directory name beginning with a numeral. Since details are still sketchy, the best advice right now is to take proactive steps to secure your servers. 'We asked the Apache Software Foundation if it had any advice on how to detect the rootkit or cleanse a server when it's found. According to Mark Cox of the Apache security team, "Whilst details are thin as to how the attackers gained root access to the compromised servers, we currently have no evidence that this is due to an unfixed vulnerability in the Apache HTTP Server." We sent a similar query to Red Hat, the largest vendor of Linux, but all its security team could tell us was that "At this point in time we have not had access to any affected machines and therefore cannot give guidance on which tools would reliably detect the rootkit."'"
As Ubuntu is indeed Linux, I'd venture to guess that it is affected.
This is why serious businesses choose a serious web server: Microsoft Internet Information Services running on Microsoft Windows Server.
Last night I discovered a directory named 53 4B 59 4E 45 54 in my home folder.
Does this rootkit work on a hardened Gentoo install with no LKM support on SPARC64? :P
-:sigma.SB
WARN
THERE IS ANOTHER SYSTEM
IIS are serious server. This are serious thread.
In Xanadu did Kubla Khan
A stately pleasure dome decree
Bozo the Clown serious?
Underage anime? Does that refer to pictures drawn after 1990?
It's for Apache/Linux so it must be well crafted code written with the best intention....
Isn't that always the case with FOSS. If it was for Microsoft then it would be _real_ malware....
I did a mkdir 09F911029D74E35BD84156C5635688C0 and all I got was a DMCA rm -f 09FA* request.
IIS6 has never had a remote code execution hole. Ever.
Depends. How good is my lawyer?
The last time I wrote code, it was Morse
Yeah. People should be held liable when they know full well that Microsoft has a track record for bad security, but choose Microsoft products anyway.
http://outcampaign.org/
Simple! Just don't upgrade. Problem solved! Don't worry, the rootkit seems to be spreading malware to windows users. They're used to it anyway -- it won't actually harm your linux box, so what's to worry?
"but his point is that unless you are running Windows OR have an Apache webserver this doesn't effect you."
Well I am sure the 3% of the population that don't fit into either category are relieved as hell.
But why male models?
Shop as usual. And avoid panic buying.
Try "squam1sh666oss1frage"
That's amazing! I have exactly the same combination on my highly secure luggage. Well, I did, anyway.
Thanks a lot, asshole.
What's this nonsense? Ubuntu is Ubuntu. ...and that's kinda related to Mac, right? Just... more browner.
Which is hardly an advantage on Linux because everybody can su to root. We have RMS to thank for that one. Apparently the GNU way is fairer to the users.
http://michaelsmith.id.au
happy geek has run out of happy :-(
455fe10422ca29c4933f95052b792ab2
Yeah, there's no way a company like Microsoft would have the resources to spread false information on internet sites.
I think their class restricts them to Lawful Evil; should they change alignment, they et disbarred. So, none, at a guess.
Ignore this signature. By order.
He's on a little-endian system.
Mea navis aericumbens anguillis abundat
So as long as it defends your precious *nix community, and lays potential blame at the door of MS, it is perfectly acceptable practice to make accusatory conclusions with no evidence or proof. This kind of MS bashing just makes the *nix community look like desperate hypocrites, and only furthers my resolve to continue supporting the MS platform for another 15 years of satisfied usage.
Why can't you just accept the fact that everyone knows that every platform is vulnerable to some extent, and probably 90% of users don't give a shit.