Slashdot Mirror
Compromised SSH Keys Lead To Linux Rootkit Attack
Tech Groupie writes "The US Computer Emergency Readiness Team (CERT) has issued a warning for what it calls 'active attacks' against Linux-based computing infrastructures using compromised SSH keys. The attack appears to initially use stolen SSH keys to gain access to a system, and then uses local kernel exploits to gain root access. Once root access has been obtained, a rootkit known as 'phalanx2' is installed."
Change your keys regularly, and revoke the key as soon as you have the slightest doubt it's been compromised.
Karma cannot be described by words alone.
The attack appears to initially use stolen SSH keys to gain access to a system
Ok...so if you get the key to a machine you can get in and abuse an old vulnerability, assuming the machine in unpatched. The rootkit that they discuss is from 2005, so where's the news here? Be careful about your SSH keys and passwords?
Seriously, if there's more to this I'd like to know. The article hardly has more information than the summary.
change your ports other than 22, this won't stop a full port scan but good against lamers scanning for port 22.
And you ip restriction. if you don't have static ip at least block connections outside of your connected isp.
you may also use port knocking protection.
these are not panacea but better than nothing.
Stolen login credentials leads to unauthorized access of computer resources!
"Obscenity is the crutch of the inarticulate motherfucker." - cloak42
If you generated that key with Debian within the last two years, anybody can figure it out in minutes, remotely.
What it means is that there are apparently some administrators not running Debian that have naively thought that the issue didn't affect them. However, if they haven't blacklisted those keys, they will undoubtedly have some users that generated their keys on Debian, which are vulnerable.
The worm will exploit this to obtain local non-root user access, and through local privilege escalation exploits will obtain root. Then, they will steal the keys stored on the host that might be used to connect out to other hosts. The last part of this is the deadly part, because those keys are not blacklisted, and will thus connect to and infect the hosts that don't have vulnerable-old-debian keys.
What this means for me, as the administrator of a web hosting company that has patched their servers, is that we will undoubtedly see illicit login attempts. With some really bad luck, one of those login attempts might work, despite our patching. Then, we are at the whim of how well we're secure against local privilege escalation.
This new attack relies on an attacker compromising login credentials. Then, the compromised login is used to install a rootkit on the target system.
This may rival the DNS vulnerability.
Palm trees and 8
How does the worm know what username to try to break into prior to escalating to 'root'?
Help! I'm a slashdot refugee.
Even the openssh guys don't seem interested in including blacklist support for probably-compromised keys: see https://bugzilla.mindrot.org/show_bug.cgi?id=1469
This means that, since the compromise arose, Debian and Ubuntu distros are safe once patched with the blacklist code. However, for keys generated on Debian/Ubuntu but uploaded to non-Debian/Ubuntu servers, those non-Debian/Ubuntu servers will still be vulnerable unless manually checked. This means: OpenBSD servers, Fedora servers etc.
Have any distros apart from Debian/Ubuntu provided blacklist-like tools for this issue? Any of the *BSDs?
"If you think the problem is bad now, just wait until we've solved it." --- Arthur Kasspe
With the exploit, breaking the key is a matter of minutes. The worm could try to crack them all hoping to find one generated on a debian box and not updated.
so in an ironic twist people using debian are in the safest position.
IranAir Flight 655 never forget!
I have sucessfully computed a easy and 100% affective plan to stop this attack I have cleared the cookies, defragmented the memory drive, emptyed the recycle bin and set the Internet security zone to 'high'. Last off all I downloaded the latest Linux Kernal and extracted it to C drive.
Now it will not affect me i advice everyone else just follow these simple steps and you will be safe to.
I've been using a package called DenyHosts for about 2 months now. It's in the Debian repos. It just reads the auth.log file and blocks ssh login attempts based on the parameters that you set. It's cut back on my login attempts by about 40% since I started playing with it. It helps a great deal even if you are doing password-less logins, because it will block based on the user, whether it is valid or not, root login attempt, et al. denyhosts.sourceforge.net It's worth looking into as an extra layer of security.
If you don't know what you're doing, you can't make mistakes.
DenyHosts is a handy little script that watches your ssh port, looking for brute force/dictionary attack attempts. Then it blacklists those IP addresses. You can also set it up to share your blacklist with others, and/or to update your own blacklist with what other users have found.