Slashdot Mirror
First Botnet of Linux Web Servers Discovered
The Register writes up a Russian security researcher who has uncovered a Linux webserver botnet that is coordinating with a more conventional home-based botnet of Windows machines to distribute malware. "Each of the infected machines examined so far is a dedicated or virtual dedicated server running a legitimate website, Denis Sinegubko, an independent researcher based in Magnitogorsk, Russia, told The Register. But in addition to running an Apache webserver to dish up benign content, they've also been hacked to run a second webserver known as nginx, which serves malware [on port 8080]. 'What we see here is a long awaited botnet of zombie web servers! A group of interconnected infected web servers with [a] common control center involved in malware distribution,' Sinegubko wrote. 'To make things more complex, this botnet of web servers is connected with the botnet of infected home computer(s).'"
Just waiting for the flamefest here of Linux vs Windows botnets.
Live today, because you never know what tomorrow brings
We can blame our hate pet OS for all of the internet evil out there, but we need to remember one important thing: people are almost always the week link in security. If someone knows what they are doing, it is very hard to penetrate a linux server... or a windows server. There will always be those that can break through the best security, but there is a lot of low hanging fruit and not just on the windows tree.
What's so special about this one that we haven't seen in the last 5 years? Linux or BSD systems have been durned into rogue IRC servers (for C&C purposes) for zombies all the time.
Whether sweeps for vulnerable AWStats installations, badly configured PHP installations or archaic PHPBB installs, webservers are hammered with automated exploits all day. Maybe "DataCha0s 2.0" rings a bell for some.
The article speculated that, since the iframe code was injected to legitimate webpages using stolen FTP credentials, it may be that a few "root" credentials are obtained the same way. FTP credentials can be stolen by malware running on the client computer, for example a computer an admin uses to control the server, from well-known FTP client software.
I once had a signature.
'Botnet' has never meant 'auto-infected' and if they assumed that, they were careless. The summary makes no attempt to fool them into thinking anything other than the facts.
Besides which, at this point, we don't -know- how it spreads. We just know that it exists... Which to me, is news.
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
At the moment that may be true, but that has certainly not been the case many times before.
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
It's unclear exactly how the servers have become infected. Sinegubko speculates they belong to careless administrators who allowed their root passwords to be sniffed.
If Sinegubko is right and the attack vector was sniffed passwords, then it is likely that those passwords got sniffed by an existing Windows Botnet.
We don't see the world as it is, we see it as we are.
-- Anais Nin
Rather than getting consumed in an OS holy-war, perhaps we should focus on how exactly these systems were compromised and how to detect whether your server has been compromised. Linux servers being compromised is not a new thing. If you run old-enough libraries and software on them or configure things improperly, they'll eventually be compromised.
Does anyone know if a particular vulnerability was used to gain access to systems?
Does anyone know how to detect whether your system is compromised in this manner (is doing "ps -aux nginx" simple enough to detect it)?
Spare everyone the OS holy-war and fanboism and let's figure out what the problem is, how to detect it, and what to do to fix it.
Faith is a willingness to accept something w/o complete proof and to act on it. Reason allows you to correct that faith.
There is a continuous flood of SSH brute force attacks on any *nix machine connected to the internet. All one has to do is monitor their log files for verification.
They are not even sophisticated attacks, they are attempting to login using lame passwords, i.e. after watching the attacks for awhile I set up a box to see what they were doing and created a user name test with the password test based on the fact I could see them using test as one of the users for the attack and suspecting it was a dumb password attack.
It wasn't long before the system was "compromised" and likely recorded on the other end as a successful attack. Several hours later the account was again accessed and various applications downloaded and executed as the test user. One of these applications connected to the EFNET IRC network and joined a channel.
Using another system I connected to the IRC network in way I thought would be inconspicuous and monitored what was happening. Sure enough there were two individuals chatting it up in the channel and sending commands to hundreds of compromised systems.
While reviewing the various compromised systems I noted that they were all *nix machines of one type or another. This was a few years back so I believe you are correct in stating that this is nothing new. What would have been new is if a botnet like this was discovered to be from a real hack and not some lame password login scan.
I don't have a problem with it being called a linux botnet, but until they can come up with an explanation for the means by which the systems were compromised, other than the likely lame password attacks, its not really news.
Can't believe I just admitted I got compromised.
Much better than the fanbois who have tried everything under the sun to defend their pet project against the evil meanies who don't have a problem admitting that every system has weaknesses.
More than once I heard "I just use Linux, so I'm gonna have a secure system anyway". Yes, Linux is more secure by design than windows, but this attitude makes ppl dumb and lazy.
On second thought, let's not go to Camelot. It is a silly place.
That Debian runs older stable software, does not stop them from installed patched versions of software when it comes to security. You still get security updates in stable.. Not pointing fingers or anything.. but if I do a search for roundcube in debian stable I don't find anything.. testing, unstable, and experimental yes.. but stable no.. So perhaps the whole idea of running the creaky old software makes sense.
waiting for ad.doubleclick.net