Slashdot Mirror
ProFTPD.org Compromised, Backdoor Distributed
Orome1 writes "A warning has been issued by the developers of ProFTPD, the popular FTP server software, about a compromise of the main distribution server of the software project that resulted in attackers exchanging the offered source files for ProFTPD 1.3.3c with a version containing a backdoor. It is thought that the attackers took advantage of an unpatched security flaw in the FTP daemon in order to gain access to the server."
People still use FTP?
So I put a backdoor in your backdoor so you can be compromised while you're being compromised.
Isn't there some type of review process for all changes? Or can you just go in and change things willy-nilly?
Maybe they need some more code oversight, just my opinion.
He who knows best knows how little he knows. - Thomas Jefferson
Oh, the irony
Author, Shell Scripting : Expert Re
To confirm their integrity, they are advised to verify the MD5 sums and PGP signatures of the downloaded files and compare them to that of the legitimate source tarballs.
Because the people who compromised your server and uploaded a trojaned version of your software would *never* think to upload their own MD5 sums and PGP signatures to match...
And how, exactly, would the attackers sign the distribution files with the same private key the project uses?
If they use ProFTPD for hosting the code too, why wouldn't the Hackers just use that same exploit on that? Why do they need to insert another way in?
Is this news?
Over the years not once I was going through bunch of ftpd picking one to install on my Linux box, all of them, ProFTPd included, had a ... front door wide open: anonyms had pretty much unlimited read access to everything.
And obviously all of the ftpds were refusing auth users by default. On the few occasions I need the FTP for my LAN server (mostly for Windows clients) it was such a royal pain to setup properly ... while welcoming all anonyms from everywhere to copy all the stuff all they want.
All hope abandon ye who enter here.
R E C U R S I O N
_______
2B1ASK1
The attackers changed the distribution files. These would be past the review process. Commits to the SCM would have been highly visible. Avoid criticizing what you clearly do not understand.
Funny, I was just trying to install ProFTP on Debian stable yesterday. Couldn't get it to work at all.
thankfully that fancy new version will be available from official repository for Debian stable in about 100 years or so..
Anyone with an internet facing anything should be doing (better) intrusion detection. It doesn't need to be expensive and doesn't need to be fancy. I ran an ftp box for over 10 years and we had some simple, automated processes to detect attacks. The box took a lot of flack but never got cracked and we could prove it. You know your security is working when you can *prove* it's working. "Set-and-forget" isn't a secure option.
/tmp/md5.txt ) /mnt/cdrom/md5sum ...')
.. from alex, .. from albert, etc). Usually, people don't make one connection and crack your server. It takes some probing and guesswork first and I've seen dictionary attacks last for an entire week before the attacker gives up. This is where you should be catching the attack - at the probe stage. (eg: fgrep 'session opened for user' /var/log/auth.log)
1) (md5|sha1)sum everything on the box. (eg: find / -exec md5sum '{}' \; >
Save it on your internal lan. Nightly, allow a box from your lan to ssh into the server to re-create the list and compare them. It will be a short list because you've certainly removed all unnecessary software from the box. This will tell you what files have changed,rooted,trojaned. For extra security burn the binaries on a cdrom and stick it on the server. create the list using r/o binaries in case they themselves get hacked. (eg: ssh server '/mnt/cdrom/find / -exec
2) scan messages logs hourly from cron
Look for attacks (eg: Invalid login from alicia,
3) watch your firewall logs
connection attempts for services you do not host on the box are cause for notice. Repeated connections for port 22, on a server you do not host ssh on, should be prime candidates for the bitbucket on the firewall. (eg: iptables -A INPUT -p tcp --dport 22 -m limit --limit 4/min --limit-burst 4 -j LOG --log-prefix "SSH_INGRESS: ")
boycott slashdot February 10th - 17th check out: altSlashdot.org
So how long was this in upstream, and which distros have packaged up the broken one?
Debian's got 1.3.1 in stable, and 1.3.3 in squeeze, so the latter might be built from the compromised one.
Others?
2*3*3*3*3*11*251
resulted in attackers exchanging the offered source files for ProFTPD 1.3.3c with a version containing a backdoor. It is thought that the attackers took advantage of an unpatched security flaw in the FTP daemon in order to gain access to the server.
So instead of downloading an FTP server with a security hole, you could download one with... a security hole.
On Sunday, the 28th of November 2010 around 20:00 UTC the main distribution server of the ProFTPD project was compromised. The attackers most likely used an unpatched security issue in the FTP daemon to gain access to the server and used their privileges to replace the source files for ProFTPD 1.3.3c with a version which contained a backdoor.
I'm glad they found the backdoor before someone backdoored my up-to-date ProFTPd 1.3.3c server to install it.
Yeah, it's OK to use plain-text password transports on a network that you think is secure, even though there are freely available secure transports that are drop-in replacements, and even though any network that has more than one computer on it is potentially insecure and should always be treated as insecure for data transport purposes.
It's also OK to leave your keys in your car every night if you trust your neighbors, and it's OK to let your daughter dance nude in clubs as long as everyone in the club is a police officer.
Why is it relevant whether you use your own software to distribute itself? Why am I any less vulnerable when I use someone else's potentially buggy software instead of my own (when they're both open source projects, so there's no security through obscurity argument)?
Or do you just mean it's a bad idea to use unstable development software on production servers? Obviously, I'd want to use a stable, QA approved release for the server, and not -r head trunk.
Was it a buffer overflow?
Annoyingly. Yes they do still use FTP. Its mostly clueless users who continue to use antiquated software and yell loudly when you turn FTP off. I'm a sysadmin at a hosting company and we've been trying to turn off FTP officially for 6 years now. Almost every new server that we bring up we leave FTP off for as long as we can, but eventually users start threatening to cancel instead of migrate to newer or different software on their end. For instance, some people use website creation software that doesn't support SSH, like old versions of Dreamweaver.
I was really mad when WinSCP added FTP support because that just adds fuel to the fire. Plus there are people out there who want to do things like have sub accounts, which SSH has no way of doing AFAIK.
Looks like the code was from ACIDBITCHEZ.. which is a pretty well known group.
Interesting that it had a hard coded IP from Saudi Arabia in it. http://www.exploit-db.com/exploits/15662/
What bothers me about this is the assumption that proftpd has a remote root bug. I would guess that
a local account was compromised and then a local root exploit was used to gain control before saying
proftpd was buggy.
Why? Because ACIDBITCHEZ would never show their hand like this if they had something juicy bug wise
that could own the newest release of proftpd as well as go back in time on older releases. This was something
they did for kicks with the access they had.
There is nothing I want to download quickly more than a hacked file that isn't the one I was expecting!
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
She's not going to get raped in the club, but her safety after they cuff her and take her away isn't guaranteed by any means. It could be a bad apple on the force. It could be here new "girlfriend." No matter how you slice it, being in the custody of the police is not even remotely safe (excuse the pun.)
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
I suppose for public sites serving very large files, it may make some sense, but for even internal use, we never use FTP, as HTTP transport can easily be secured via SSL, and it's easier to secure the single httpd server and port rather than having two services running.
Is the bandwidth savings really worth the extra security risk?
Make sure everyone's vote counts: Verified Voting
They used a security flaw that already existed in the FTP daemon to surreptitiously introduce a backdoor into the FTP daemon's source, evidently hoping it would be propagated? Why not just use the security flaw to attack whatever site they wanted to hit directly?