Mystery Malware Affecting Linux/Apache Web Servers

lisah writes "Reports are beginning to surface that some Web servers running Linux and Apache are unwittingly infecting thousands of computers, exploiting vulnerabilities in QuickTime, Yahoo! Messenger, and Windows. One way to tell if your machine is infected is if you're unable to create a directory name beginning with a numeral. Since details are still sketchy, the best advice right now is to take proactive steps to secure your servers. 'We asked the Apache Software Foundation if it had any advice on how to detect the rootkit or cleanse a server when it's found. According to Mark Cox of the Apache security team, "Whilst details are thin as to how the attackers gained root access to the compromised servers, we currently have no evidence that this is due to an unfixed vulnerability in the Apache HTTP Server." We sent a similar query to Red Hat, the largest vendor of Linux, but all its security team could tell us was that "At this point in time we have not had access to any affected machines and therefore cannot give guidance on which tools would reliably detect the rootkit."'"

Comments

Re:Ubuntu as well?

[oedneil]

As Ubuntu is indeed Linux, I'd venture to guess that it is affected.

Should have used IIS

[Anonymous Coward]

This is why serious businesses choose a serious web server: Microsoft Internet Information Services running on Microsoft Windows Server.

Re:Should have used IIS

[Shaman]

Hahahahahaha hah aha aha aha hahahahaaha bwahahahaha ...wait, you're joking, right?

Re:Should have used IIS

[uberushaximus]

Of course not, this is internet, internet is serious business, we do not 'joke' here.

Re:Should have used IIS

[Niten]

In all seriousness though, IIS 6 has a pretty darn good security track record; seemingly better than Apache 2's, even if it is blasphemy for me to say it. I've previously decried the use of raw vulnerability statistics to make comparative claims about different products' security, but I think the fact that such a widely-deployed product as IIS 6 has been found to have only a single remote access vulnerability in the last four years really speaks for itself.

I mean, I'm just a Unix guy who's never had much use for a Windows web server, but that's my $0.02...

Re:Ubuntu as well?

[PrescriptionWarning]

"the current thinking is that the malware authors gained access to the servers using stolen root passwords"

so basically its most likely they used the traditional means of gaining access (not through holes, but merely through bad personal security practices regarding passwords and password management). And it only affects windows clients. So how is this problem not your typical someone cracked your machine? Oh wait, I smell Microsoft FUD... ewwwwww

Something's fishy!

[linumax]

Last night I discovered a directory named 53 4B 59 4E 45 54 in my home folder.

Re:Something's fishy!

[JeepFanatic]

If you run those values through a hex to ascii converter you get SKYNET

Re:Something's fishy!

[Trigun]

Are those Bra sizes? You're into some weird shit man.

Re:Something's fishy!

[sukotto]

Yeah, mine had 4 8 15 16 23 42

and all sorts of weird stuff's started happening in the server room

Re:Something's fishy!

[StargateSteve]

What is this ASCII/HEX converter you are speak of? I had to learn this stuff myself. I would have also expected skynet to make the jump to Unicode by now.

Re:Something's fishy!

[geminidomino]

I saw that on someone's shirt last week when I went to my spanish class at night school. I spent 25 minutes before class trying to figure out the pattern.

Now I google it and I see it's from a dumbass TV show. I'm pissed off.

Hummm, no ahah ?!

[DirtyFly]

I do believe tht if this story was with IIS it would be tagged ahah :)

Re:Hummm, no ahah ?!

[Detritus]

He's on a little-endian system.

press release??

[Anonymous Coward]

"According to a press release issued earlier this month ..."

Yawn.

Re:Funny

[Undead Ed]

According to the story (did you read it), it appears to be a situation where the root password has been compromised, not the applications or operating system.

Problems with IIS were as a result of vulns in the application and/or Windows operating system - totally different problem.

Would you blame a lock company if the user left his keys in the lock?

Ed

Re:Funny

[Vellmont]

I think it's funny that Apache is affected by the same drama that affected IIS all those years ago.

Except IIS had security hole after security hole.

There's been no such security hole found in apache yet. So I'd wait before making comparisons to IIS.

mkdir 1

[hey]

I can see thousand of people trying to make numeric directories :)
Yes, also if you can run your tummy while patting your head you aren't infected also.
I think.... this crazy idea is the virus!

Re:mkdir 1

[grub]

I can see thousand of people trying to make numeric directories :)

I just mkdir'd a numeric directory then remembered I run OpenBSD on my net-facing servers. :P

Re:mkdir 1

[wanderingknight]

lucas@bilkis:~$ man mytummy
No manual entry for mytummy

Re:mkdir 1

[padyer]

That regex is b0rken. It matches any file of at LEAST 5 chars that ends in .js. The story at cPanel says that it is exactly 5 random chars and then the .js. Should be changed to

tcpdump -nAs 2048 src port 80 | grep "/[a-zA-Z]\{5\}\.js'"

Note the / at the beginning of the grep regex.

LOLserver?

[KublaiKhan]

IIS are serious server. This are serious thread.

Re:LOLserver?

[Anonymous Coward]

Is can be rootkit tiem now plz?

Re:LOLserver?

[davidsyes]

That are be unpossible.

Re:LOLserver?

[snarfies]

I see what you did there.

Re:LOLserver?

[idontgno]

Your shipment of rootkit has arrived!

Re:Am I safe?

[Anonymous Coward]

Does this rootkit work on a hardened Gentoo install with no LKM support on SPARC64? :P

Maybe; they're still compiling it.

Re:Nimda Code Red Chunked Encoding......

[angus_rg]

Bozo the Clown serious?

Read it careful people...

[cbart387]

The servers are linux (because of an access issue. The computers being hurt by this are windows. At least that's how I read the article (see quote from article below).

According to a press release issued earlier this month by Finjan, a security research firm, compromised Web servers are infecting thousands of visitors daily with malware that turns their Windows machines into unwitting bots to do the bidding of an as yet unidentified criminal organization. Security firms ScanSafe and SecureWorks have since added their own takes on the situation, though with varying estimates on the number of sites affected. All reports thus far say the compromised servers are running Linux and Apache.

Re:Read it careful people...

[jawtheshark]

I do not know how you interpret this, but a rooted server, Linux, FreeBSD, OpenBSD or even Windows is also a "harmed" computer. Yes, clients will get infected, but the servers are in deep trouble too.

Re:Read it careful people...

[cbart387]

I admit, I jumped the gun. I'm done conjecturing until more information comes in. I usually get annoyed when people do so, so I really have no excuse.

Re:Am I safe?

[GreggBz]

Yes, but you have to compile it.

Re:Funny

[plague3106]

I read it, here's what it said: "One great unknown thus far is how the servers come to be infected. Absent any forensic evidence of break-ins, the current thinking is that the malware authors gained access to the servers using stolen root passwords."

In other words, they have no idea how the servers were compromised. Because they can't find out how, they're guessing it was a root password that was stolen. In other words, its still just as likely a flaw in some software.

Can't be malware

[Anonymous MadCoe]

It's for Apache/Linux so it must be well crafted code written with the best intention....

Isn't that always the case with FOSS. If it was for Microsoft then it would be _real_ malware....

Re:Can't be malware

[geminidomino]

It's for Apache/Linux so it must be well crafted code written with the best intention.... Then how do you explain PHP?

*sniff sniff* Is something burning?

Re:Can't be malware

[ray-auch]

That's the secondary infection.

The tough question is what is the malware that is infecting the servers themselves. There have been reports of this for weeks now, and apparently it may go back months (see eg. http://www.channelregister.co.uk/2008/01/16/mysterious_web_infection_continues/), and AFAICS:

a) no one knows the initial attack vector (on the _servers_)
b) the malware (on the _servers_) seems to be difficult to detect
c) and no one seems to know how to remove it successfully either - some have suggested it is a rootkit as the apache part of the infection seems to reappear when removed.
d) possibly as a result of (b), estimates are vague on number of infected servers, but I've seen estimates from "hundreds" to "tens of thousands"
e) seems to be Linux + Apache stack that is targeted

Well...

[Anonymous Coward]

I did a mkdir 09F911029D74E35BD84156C5635688C0 and all I got was a DMCA rm -f 09FA* request.

Re:Software sucks.

[Anonymous Coward]

How is that flamebait? I'm dead serious. If the quality of software doesn't improve dramatically, we're going to be in a world of hurt very soon. How do you suggest we achieve that improvement if not by making authors of faulty software liable for their negligence? We certainly can't keep upgrading software every time a bug is found, if bugs keep cropping up at the current rate.

What are the common factors?

[Arrogant-Bastard]

To figure out what the compromise vector is, it's probably going to be necessary to figure out what the compromised servers have in common -- and how that differs from uncompromised servers. (Keeping in mind that currently-uncompromised servers may have the same vulnerability, and that attackers or their software just may not have gotten to them yet.)

I'd suggest enumerating factors such as OS, OS version, remote access methods (ssh, ftp, etc.), Apache versions, Apache modules, add-ons like CPanel, network/ASN, and so on -- anything could be a culprit at this point.

And that includes things that have nothing to do with Linux or Apache: for example, it's possible that the attackers acquired root passwords by infecting Windows systems used by administrators -- then just waited for them to initiate ssh sessions to their servers. It'd probably be best to leave all possibilities open and consider them equally likely until evidence starts accumulating in favor of/against them. (In re-reading that last statement, I suppose it sounds a bit trite. I'm just trying to discourage premature conclusions that anything is at fault until somebody can produce evidence to support saying so.)

Re:What are the common factors?

[whoever57]

To figure out what the compromise vector is, it's probably going to be necessary to figure out what the compromised servers have in common -- and how that differs from uncompromised servers. (Keeping in mind that currently-uncompromised servers may have the same vulnerability, and that attackers or their software just may not have gotten to them yet.)

Perhaps this is the end result of all those dictionary attacks against SSH servers that we have seen for the past 2-3 years. Inevitably, some of those attacks will have been successful. Perhaps the successful logins have not ben exploited until now.

Re:What are the common factors?

[Arrogant-Bastard]

That (use of data harvested from ssh attacks) is entirely possible. Some of those attacks had to successful against some hosts.

So maybe one possible line of investigation would be to see if any hosts which defended against ssh dictionary attacks (say, by throttling back or denying connections from hosts that made too many ssh tries) were compromised. (I suppose it'll also be necessary to assess the strength of their root passwords; sufficiently weak ones might not require a concerted ssh attack to be compromised.)

Sure, this could be the wrong line of reasoning -- but given that we've all seen the ssh attacks you refer to, it's probably worth investigating.

Re:What are the common factors?

[imipak]

Apparently it's not Cpanel.

Other info as of last week:

Various discussions:
http://www.webhostingtalk.com/showthread.php?t=651748
(useful discussion starts on page 3 or so)
http://www.theregister.co.uk/2008/01/11/mysterious_web_infection/
(describes the inability of ScanSafe to work out what's happening)
Trend have a piece on their blog:
http://blog.trendmicro.com/e-commerce-sites-invaded/
SANS/ISC
http://isc.sans.org/diary.php?storyid=3834&rss

Re:What are the common factors?

[Alioth]

It's quite possibly due to buggy PHP scripts. I've seen it before; what happens is the attacker goes for some unpatched vulnerability in PHPnuke, PHPbb or similar software. This gets them non-root access. They use this to 'wget some-hack.c' to the /tmp directory, build this hack then execute this to exploit a local root exploit.

This is why I treat all local root exploits as seriously as remote root exploits. All it takes is one buggy PHP script and then the attacker can try local root vulns.

The register's older writeup on this ...

[chris.dag]

The Register has been on this for a while and although the story is older it is better written and has more interesting details: http://www.channelregister.co.uk/2008/01/16/mysterious_web_infection_continues/

my $.02 of course

Re:The register's older writeup on this ...

[Mediamon]

Some additional reports from earlier this week and previous...

http://blog.trendmicro.com/e-commerce-sites-invaded/

http://www.scmagazineus.com/Attack-injects-malicious-JavaScript-into-e-commerce-sites/article/104206

http://www.theregister.co.uk/2008/01/11/mysterious_web_infection/

http://www.cpanel.net/security/notes/random_js_toolkit.html

http://isc.sans.org/diary.html?date=2008-01-18

http://isc.sans.org/diary.html?date=2008-01-14

http://www.webhostingtalk.com/showthread.php?p=4902045

ssh + bad password

[Panaflex]

I see this type of attack all the time, the fact that someone automated it and gave it a zombie machine is not surprising.

* Don't allow root to ssh into your machine.
* Disable ssh1.
* Limit sudoers.
* Have good passwords.
* ???
* PROFIT!!

Seems like a formula everyone should know.

Re:ssh + bad password

[ScouseMouse]

* Don't allow root to ssh into your machine.

I was most surprised when I found that Redhat (Our cooperate Linux of Choice) appears to allow this as the default. Certainly, The Debian box i use as a home server never used to allow that, however, checking i see that since I upgraded from Woody, it does allow remote SSH as root. Thats worrying.
Well have to fix that.

Re:ssh + bad password

[Panaflex]

That's a good idea - but be careful!

Attackers can trampoline onto other machines in the network if they share the same key. If you're going to do then be careful about which machines can freely contact each other, and use separate keys for each server.

Re:ssh + bad password

[mandelbr0t]

Allow me to insert one step before ???

* Follow-up on your SSH logs. If you see a phishing attack, do something about it!

That something could be:

- Report the IP to the owner of the netblock who can be found at ARIN. All netblock owners must have an IP-admin address or an abuse address. Unfortunately, my experience is that most of these go to /dev/null. There are those who actually have responsible NOC staff, and they will act on your complaint if you send them a copy of the relevant logs.

- Block further network access from that particular netblock at your firewall. I've found this to be a very effective method. Believe it or not, you don't end up blocking the entire Internet; the places that launch such attacks are not very common.

- Rate-limit SSH access. This works well, but I've locked myself out of my own server!

Re:ssh + bad password

[PinkPanther]

If someone is going to render there machine usable only by root, then I strongly doubt they've taken the time or have the knowledge to implement security precautions listed above. If they know how, they likely should and likely won't render their machine useless.

In addition, if they really might render the machine useless, they likely shouldn't have it on the 'net.

Re:ssh + bad password

[ls671]

You should also have some process that completely blocks ssh login attempts from a given IP after so many failed login attempts instead of letting the hi-jacker poll your machine for as long as he wishes.

Re:ssh + bad password

[MrDoh1]

I've found that Denyhosts is a nice tool to take care of securing SSH and blocking hosts of incorrect SSH attempts.

Re:ssh + bad password

[mi]

* Don't allow root to ssh into your machine.

Dangerous if you don't have easy physical access to your machine.

No, it is not. On *BSD family of Operating Systems root can only login on the local console anyway.

If you screw something up badly, you ssh in as yourself first, and then perform `su' — something, that only members of the wheel-group (gid 0) are allowed to do.

My FreeBSD machines all run a crude log-watcher, which blocks-out machines, from where root- and similar logins are attempted, immediately.

Re:ssh + bad password

[Archiviste]

You should also have some process that completely blocks ssh login attempts from a given IP after so many failed login attempts instead of letting the hi-jacker poll your machine for as long as he wishes.

Not quite "after so many failed login attempts", but useful nonetheless: DenyHosts

Re:ssh + bad password

[Crimsonjade]

I personally use http://www.fail2ban.org/wiki/index.php/Main_Page

Re:ssh + bad password

[Anonymous Coward]

http://hexten.net/wiki/index.php/Pam_abl

Re:ssh + bad password

[Gordonjcp]

The quick and dirty way is to move SSH to a non-standard port. This is a particularly good idea if you've got a bunch of machines behind a NAT firewall anyway, because they can't *all* have port 22.

I know "security through obscurity" isn't really secure, but it has entirely eliminated attempts to crack the root password on all the servers I run.

Re:ssh + bad password

[Niten]

I'll see your good point, and raise you a pf.conf snippet:

### MACROS AND TABLES SECTION
table <wan_bruteforce> persist

### PACKET FILTERING SECTION
block in quick on $if_wan inet from <wan_bruteforce>
# ...
pass in on $if_wan inet proto tcp from any to ($if_wan) \
port ssh flags S/SFRA synproxy state \
(max-src-conn-rate 3/30, overload <wan_bruteforce> flush global)

That's how you can block non-massively-distributed password dictionary attacks on the BSDs, anyway. Sadly, the fact that OpenBSD's firewall can perform this task on its own means that we probably won't see this feature worked into OpenSSH itself any time soon -- so on Linux you'll need a third-party script such as DenyHosts, as others have already pointed out.

(And yeah, unlike this PF configuration, DenyHosts lets you synchronize your table with a sort of universal blacklist of blocked hosts, so some might choose to run it on BSD anyway. It sounds like a good idea on paper, but boy does it suck when your home IP address keeps inexplicably winding up on the blacklist due to what turns out to be a single site's massively misconfigured server.)

But I think the most important lesson to be learned here, assuming that this thing does turn out to be an ssh attack, is that allowing single-factor, password-based administrative logins to a highly connected host is never a good idea. If you have the luxury of complete control over the site and its users (or are simply a highly empowered BOFH), disable password-based logins entirely and force the use of ssh public keys:

# /etc/ssh/sshd_config
PubkeyAuthentication yes
ChallengeResponseAuthentication no
PasswordAuthentication no
KerberosAuthentication no
GSSApiAuthentication no
UsePAM no

As a concession, if you want to ensure access without having to carry around an encryption key on a USB dongle, on Linux you can use PAM and libpam-opie to set up secondary access using a dual-factor combination of an S/Key one-time password and your regular login password (S/Key is like Steve Gibson's much-trumpeted "Perfect Paper Passwords" system, which is ingenious in its own right, except that S/Key is designed so that you don't need to keep your secret key stored unencrypted on the very server you're worried about protecting):

# /etc/ssh/sshd_config
PubkeyAuthentication yes
ChallengeResponseAuthentication yes
PasswordAuthentication no
KerberosAuthentication no
GSSApiAuthentication no
UsePAM yes

# /etc/pam.d/ssh
auth requisite pam_opie.so
auth required pam_unix.so nullok_secure

With the above configuration you can still log in seamlessly using your ssh private key. But if you get stuck somewhere without access to your private key, you just pull your S/Key passwords list out of your pocket and enter the next password in the sequence, as prompted, followed by your login password. This PAM configuration has the nice property that if you enter the correct S/Key password but then an incorrect Unix password, you will be asked for the next one-time password in the sequence before you can continue: so unless your attacker is exceptionally good at plaintext attacks on large cryptographic hashes, a successful brute-force attack becomes impossible.

Wow, this post got a lot longer than I wanted it to... I'm, um, going out to get some fresh air or something.

Re:ssh + bad password

[Panaflex]

Sorry, I wasn't clear:

I've had admins on my network simply copy both pub & private ssh keys from server to server (they're in the same directory). They leave the private keys on the machine and forget or don't know what they've done. An attacker with root on that machine can then su into the account and access other machines.

Re:Funny

[Undead Ed]

"they're guessing it was a root password that was stolen"

A pretty good guess, otherwise we could expect to see millions of Apache web servers compromised (there are over 75 million Apache web servers in active service) and anticipate a much greater number of Windows clients infected.

The significance of this story is not that Windows clients are the target, the significance is that the infecting agent is originating from Apache/Linux servers.

Ed

Re:Funny

[studpuppy]

Would you blame a lock company if the user left his keys in the lock?"

Depends. How good is my lawyer?

Re:Am I safe?

[bigredradio]

Your safe. NOTHING will run on that system. ;-)

Re:Software sucks.

[vux984]

It's high time for better software, and the only way to get that is to apply market pressure. Software liability is the answer.

1) If the market really wanted extensive 'software liability' then we'd already have it. Customers would demand it, suppliers would figure out how much it would cost to provide it, and prices would sort themselves out. Turns out the prices go WAY up, and customers (most of them) don't want to pay them.

2) What happens to Linux in a world with mandatory software liability? Who is liable? The company providing install and support? The volunteer contributor who wrote that line of code? The project maintainer who accepted the patch? ... And you wonder why your post was modded flaimbait?

Re:Ubuntu as well?

[symbolset]

It's possible to install software on a Linux webserver that exploits vulnerabilities in Windows clients. This is news?

Here's a shocker: it's possible to exploit Windows boxes with services hosted on a Commodore64.

Windows has more malware packages than legitimate software packages. They've really solved that ease of installation problem.

Re:Funny

[Anonymous Coward]

Ed,

Please let me know what the last critical security flaw for IIS was. I'd love to know.

Also, let me know how many critical security flaws there have been for Apache in the last year or so.

Thanks!

Re:Software sucks.

[Schraegstrichpunkt]

Yeah. People should be held liable when they know full well that Microsoft has a track record for bad security, but choose Microsoft products anyway.

Re:Software sucks.

[WaHooCrazy7]

Would you please tell me which one of the hundreds if not thousands of developers should be sued when OSS has a bug in it? Also, there is no way we could process that many law suits...

Re:Software sucks.

[Garridan]

Simple! Just don't upgrade. Problem solved! Don't worry, the rootkit seems to be spreading malware to windows users. They're used to it anyway -- it won't actually harm your linux box, so what's to worry?

Re:Funny

[plague3106]

No, not really a good guess. It could be only Apache on a certain distro, with a certain version. Apache runs on Unix as well, so you can rule all those Apache installs out (the article seems to point out Linux, IIRC).

I agree with your reasoning on the significance of the story.

Re:Should have used *BSD

[Klaus_1250]

I'll take my chances with *BSD.

Re:Ubuntu as well?

[nicklott]

Microsoft? This story is on posted on linux.com and being hyped on a OSDN site, where do microsoft come in? They must have a pretty deep mole to get this one planted...

More details are available...

[Anonymous Coward]

... though a solution has not been yet:

http://blog.trendmicro.com/e-commerce-sites-invaded/

If you happen to have one of these compromised systems, I am sure that Trend would like to talk to you about it...

Re:Ubuntu as well?

[Anonymous Coward]

"but his point is that unless you are running Windows OR have an Apache webserver this doesn't effect you."

Well I am sure the 3% of the population that don't fit into either category are relieved as hell.

Re:Software sucks.

[0racle]

I agree. The people who made this problem possible should be sued and held accountable.

Now then, which admin is first for choosing bad passwords?

I'm not sure I buy it

[mlwmohawk]

There is something suspicious about this report. Some things can't happen the way people say they happen, and when that is the case we have to look at more likely scenarios.

I would bet the path of the TCP/IP packets route through compromised providers who have an injection strategy. Remember a few months ago how IPSs were injecting their own java script and ads into the pages of other sites?

http://ars.userfriendly.org/cartoons/?id=20070703

This is the most likely scenario I can think of.

Re:I'm not sure I buy it

[whitehatlurker]

they can't find any evidence of hacking

\begin{snarky}
I'm surprised some of these "admins" can find their servers, let alone moderately well hidden rootkits.
\end{snarky}

Many system administrators do not have a deep background in *nix security. If they can install a Linux box, they're apparently qualified. There are many admins who are extremely competent in security matters, but I have not seen anything coming from those people. (Perhaps they weren't infected?) So, I have not heard (read) of anything from anyone describing a good analysis of an infected machine. The best so far is the cPanel note. There they do mention that "[i]t is common to see a short but successful root login via ssh 5-10 minutes before the compromise occurs" which in my mind is already a compromise.

I call Bullshit!

[Anonymous Coward]

FTFA:FTFA - "The random js toolkit was detected using Finjan's patented real-time code inspection technology while diagnosing users' web traffic during December 2007..."

This is all just a ploy to bring attention to Finjan for financial gain!

Re:Ubuntu as well?

[BorgCopyeditor]

But why male models?

All your BASE are belong to us

[davidwr]

All your BASE are belong to us.

Re:Funny

[Undead Ed]

"It could be only Apache on a certain distro, with a certain version."

Yet another persuasive argument to avoid the technological mono-culture that is Microsoft Windows.

Ed

Re:Software sucks.

[mlwmohawk]

Software has to suck because the market can't afford software that doesn't suck. Kids out of high school and collage or fresh out of joe's web school. aren't qualified to write good software, yet this is what companies hire over more experienced people.

Even then, there is no ability to develop your skills because you spend 99% of your time learning new environments.

Software is HUGELY complex these days and it takes a log of study, knowledge, and skill to be any good at it. Companies don't want to hear that. They want to increase productivity by "KLOC." (Un)fortunately, there is a lot of "art" and "creativity" in software development and without well defined product specs, rigid test plans, and quality assurance which adds delays and cost to a project you won't get better code.

Standard business upside potential vs downside risk. Upside potential: first to market, profit!!! Downside risk: blame some hacker.

Re:Ubuntu as well?

[wall0159]

What's this nonsense? Ubuntu is Ubuntu. ...and that's kinda related to Mac, right? Just... more browner.

Re:Passwords are still the big exposure.

[MichaelSmith]

Check your other users too, particularly people in group wheel

Which is hardly an advantage on Linux because everybody can su to root. We have RMS to thank for that one. Apparently the GNU way is fairer to the users.

Re:Is Idiocracy coming true?

[zcat_NZ]

happy geek has run out of happy :-(

Re:Ubuntu as well?

[Christianfreak]

Exactly. Also this gem from the article:

Other than using and safeguarding secure root passwords, not much can be done at this time to be proactive in preventing servers from being compromised,

Turn off root's log in and get rid of cPanel and similar programs as well. I understand the need for an easy to use remote admin tool (as much as I'd love people to actually learn the shell), but can't we do better than a web-based program for this stuff?

Re:Ubuntu as well?

[stuntpope]

His main point was insightful. There are two parts to the story - one, Linux servers running Apache have been compromised. Two, these servers are infecting Windows clients through vulnerabilities in those clients. This exploit does not affect non-Windows computers.

If the current thinking is indeed that the Linux servers were inappropriately accessed through stolen passwords, how is that a security flaw of Linux or Apache? Like he asked, how is using a legitimate password equal to cracking the server?

On the other hand, turning Windows clients into bots *IS* an example of that software's (and QuickTime's and Yahoo! Messenger's) insecurity and vulnerability!

Re:Fail2ban

[whoever57]

Fail2ban is another nice way to deal with these brute force attacks.

You can use fail2ban, but SSH can be protected very nicely with Netfilter/IPTABLES -- just limit the rate of new connections to something like 3 per 3 minutes for each host and this will slow down any dictionary attack to the point that it is very unlikely to be successful.

Re:Funny

[cp.tar]

How many lawyers are good?

I think their class restricts them to Lawful Evil; should they change alignment, they et disbarred. So, none, at a guess.

Re:Ubuntu as well?

[Skrynesaver]

There is no more powerful, nor easy to use, (with training), remote control tool for servers than ssh.

GUIs provide metaphors for users, they have no place in administration.

</grumpyOldFart>

Re:Ubuntu as well?

[Isauq]

Right, right, they're running your typical LAMP stack. You know, like most of the internet. Statistically speaking, if you have a site, you more than likely have a site served by Apache on Linux. In truth, I've heard of very few servers that receive significant traffic that DON'T run Apache and even fewer that don't run Linux. As the internet is based around open international standards, there's no reason a Linux-based server couldn't serve packets containing harmful windows executable code. Your first point is a non-issue.

As to your second point, it's only natural that windows machines be targeted. More critical security vulnerabilities as part of the base operating system that is almost certainly being run as root ("administrator" if you've never used *nix) means greater capability for general chaos. Alternatively, more useful machines for ye olde botnette. One problem with targeting Linux machines is the Unix permissions model that would create a situation where even if someone were to find a hole by which they could access the system, they would still need to find a method by which to elevate their user privileges to root so that they could accomplish more than manipulation of the user's home directory. This leads to the second problem- security flaws in a *nix system are almost certainly related to the software installed on them rather than the Linux kernel itself, making it a roulette game whether your particular method of attack is even present to be exploited.

In a system that has been systematically secured by experts from all callings for years on end, it becomes, with each patch level, more and more likely for the human equation's unreliability to be the single greatest point of failure. Being fallible, people resort to insecure data practices for their own convenience, out of laziness, from a lackadaisical attitude, or out of habit; thus creating a situation where the likelihood of a partial or full breach rapidly approaches one. This is a well known point of failure, and is even counted on, at some level, with a sane backup policy and data redundancy.

What's more, while rootkits and their dangers are very real, one cannot say that it is a vulnerability of a system that someone in possession of what is assumed to be a secure superuser password can install software on that system. Were you to steal the keys to a car, you certainly wouldn't find it strange be able modify the engine of said vehicle- after all, with keys you can unlock the door and with a minimum of effort pop the hood and go to work.

So yes, my dear Coward, grandparent was correct- this is somewhat more elegant than we're used to seeing, but it is most certainly presented in a way thst prompts one to think that there is something "wrong" with Apache or Linux.

Re:Ubuntu as well?

[Kwirl]

One great unknown thus far is how the servers come to be infected.

So as long as it defends your precious *nix community, and lays potential blame at the door of MS, it is perfectly acceptable practice to make accusatory conclusions with no evidence or proof. This kind of MS bashing just makes the *nix community look like desperate hypocrites, and only furthers my resolve to continue supporting the MS platform for another 15 years of satisfied usage.

Why can't you just accept the fact that everyone knows that every platform is vulnerable to some extent, and probably 90% of users don't give a shit.

Re:Ubuntu as well?

[Ilgaz]

From TFA - "All reports thus far say the compromised servers are running Linux and Apache."

"And it only affects windows clients. So how is this problem not your typical someone cracked your machine? Oh wait, I smell Microsoft FUD"

Are you really that illiterate? Just an FYI - Microsoft doesn't make Apache OR Linux. If compromised severs are being used, it is certainly not the type that "only affects windows clients". Duh. Only here would such blatant anti-MS bullshit get modded "Insightful". I took a way more "insightful" shit this morning. So, Mac planet is not alone discrediting every single security alert as "FUD" :)

It seems there are other people who sees a story validated by 4 different, independent security companies as FUD. Apache is planets number 1 webserver and Linux is number 1 Webserver OS. What else would a blackhat supported by mafia would target? It is not like "I am proving Linux is unsecure", it is "I have purchased a previously unknown compromised account list and I am using it to infect millions of MS Windows users running popular but unpatched software, we will make millions from that zombie army".

I don't get why people gets defensive.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Ubuntu as well?

[hostyle]

This is old news. Its caused by a rootkit: http://www.cpanel.net/security/notes/random_js_toolkit.html

Identified about 5 months ago

[fmavituna]

I identified this rootkit in a system about 5 months ago and slightly documented some behaviours of it (I think only behaviour I've missed was numerical directory thingy). Related blog post 25.08.2007 - http://ferruh.mavituna.com/makale/exploit-paketleri/ ).

There is one more thing to add, it modify all valid HTTP responses, add .js after body tag in all interfaces. There was one article that mentioned most of the compromised servers based UK, it was same for me. And considering it's been about 5 months, I assume UK websites were prime target in the start.

Re:Ubuntu as well?

[budgenator]

What that means is that probably every server in the data center had the same root password and somebody leaked it or sold it. We had a server that was managed by command dental system, and every system they sold had one of 5 root passwords which quickly became common knowledge in the industry.

Re:Ubuntu as well?

[Sillygates]

on several systems, in a small amount of time?
In general, these systems probably don't even give users shell access, and even then, password cracking is probably out of the picture. And brute forcing a password over ssh? thats probably troublesome too, it would be hard to get over about 50 attempts/second.

On the other hand, there are a whole bunch of local vulnerabilities that can be exploited, after a system is compermised. In some cases, a weak php include vulnerability could potentially allow the apache user to execute suid root applications through such vulnerabilities as: https://rhn.redhat.com/cve/CVE-2007-5964.html on a default configuration of rhel5/fedora5-7.

Every system has it's vulnerabilities.

Re:Ubuntu as well?

[schmutze]

Linux desktop users most certainly can be infected with this rootkit. We've seen 4 machines with it so far- 1 server and 3 desktops. The Apache webserver may be being used to infect windows clients with malware, but it is not the point of entry for the rootkit installation.

Re:Ubuntu as well?

[SgtChaireBourne]

If the current thinking is indeed that the Linux servers were inappropriately accessed through stolen passwords, how is that a security flaw of Linux or Apache? Like he asked, how is using a legitimate password equal to cracking the server?

On the other hand, turning Windows clients into bots *IS* an example of that software's (and QuickTime's and Yahoo! Messenger's) insecurity and vulnerability! Using a legitimate password is not equal to cracking the server. But it must be made to look so because the PR firms the M$ movement uses must cast aspersions on Apache and Linux so as to draw attention away from the actual insecure and vulnerable system. Most PHBs never read past the headlines, so this is major spin for the M$ party.

Re:Ubuntu as well?

[WWWWolf]

There is no more powerful, nor easy to use, (with training), remote control tool for servers than ssh. GUIs provide metaphors for users, they have no place in administration.

While SSH allows for direct neural link that allows the computer to do exactly what you think, thus bypassing the metaphors and concepts entirely? Man, I thought SSH didn't do that by default, at least not on my Linux systems; it just provided a secure connection to whatever user interface the system provided. So, where can I download DO-WHAT-I-MEAN-OSIX 2.0? =)

Command lines are a metaphor. Yes, incidentally well suited for system administration, but a metaphor nevertheless. =)