Slashdot Mirror
Sophisticated Apache Backdoor In the Wild
An anonymous reader writes "ESET researchers, together with web security firm Sucuri, have been analyzing a new threat affecting Apache webservers. The threat is a highly advanced and stealthy backdoor being used to drive traffic to malicious websites carrying Blackhole exploit packs. Researchers have named the backdoor Linux/Cdorked.A, and it is the most sophisticated Apache backdoor seen so far. The Linux/Cdorked.A backdoor does not leave traces on the hard-disk other than a modified 'httpd' file, the daemon (or service) used by Apache. All information related to the backdoor is stored in shared memory on the server, making detection difficult and hampering analysis."
Only cpanel apaches vulnerable and modified httpd easily found by grep'ing a string?
*yawn*
Getting Cdorked in the backdoor sounds painful.
Here's another link about this issue.
Seems systems with cPanel installed are getting hit with this. Better get a hash of your current apache executable so you can easily check it down the road.
"other than a modified 'httpd' file,"
It's completely invisible, as long as you're blind.
However I was wrong. This could be easily fixed with a slightly modified HOSTS file.
How are they gaining access to the server to install their malicious software?
This looks like a module for apache that, while sinister and clever, must be installed like any other module. Presumable, unless I'm missing something, this requires root access. If this so called "back door" (debatable) is on a system where it shouldn't be there is a bigger question on how was access to install it obtained it the first place.
other than a modified 'httpd' file.
That seems like a pretty significant trace. Check the MD5 yourself. You can check it with 'debsums', you don't even have to set it up unlike tripwire.
Back in the day, people broke into servers for fun.
Now, people break into servers to serve advertising.
Soon, people will break into servers to drop bitcoin miners on them.
I guess now we know where the real money is: ad impressions. What Ad networks serve ads to the cracker community?
Surely detection is pretty easy if the httpd binary has been modified, most distributions already have features to check the binaries on a system against known checksum lists from the packages they were installed from, so a modified httpd would stick out like a sore thumb.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
This is the most ignorant statement I have ever seen on slashdot.
Given that you didn't mention what tools you could use to compare the checksums to the package tells me that you, and most others aren't checking packages on a regular basis.
We also don’t have enough information to pinpoint how those servers are initially being hacked, but we are thinking through SSHD-based brute force attacks.
They didn't really find a backdoor in Apache, rather they found a modified httpd with some interesting new features installed on otherwise compromised servers. It's not an Apache problem. If you keep your servers secure in first place, you won't have this problem.
rkhunter and chkrootkit as a quick example.
two tools which are more or less set and forget, and which also target workstation users.
(Done in background periodically, no interaction required, except running a small command after an update to avoid triggering false positive in one case)
Probably hundreds of sysadmin-oriented tools can do it too.
(checking files for modification is a very sane step to protect against corruption and possible compromise)
having the /usr mount read-only and only /var, /tmp & co read-write is a rather sane measure which is also wide spread (not only on big server farms, on the technical grounds that the /usr might be served over the network. but even some smart-phone do it, webOS for example)
On the other hand, a trojan targeting Linux is a proof that Linux server *are* a very valuable infection target, and lower markter share at the desktop isn't the only valid argument explaining the scarcity of Linux viruses.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I rather preferred the APK spam.
chattr +i anyone?
just unchattr when you need to update httpd/apache
more interesting is where the hole/holes are in cpanel
I rather preferred the APK spam.
At least this is shorted and less offensive to the eye.
Spam is spam, though.
Interesting, I didn't know about it. I think they made a mistake but it's a simple one to undo for server administrators as it's a configuration switch. Check at the end of this file. Furthermore it's up to the applications to honor the flag, the web server is just a middleman here, right?
Read TFA, it tells you that the checksum does not change, but you go ahead and think rpm -V will save you
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
"Apache Backdoor in the Wild"
Am I the only one who initially pictured a rear entrance to a teepee in the countryside?
Which is irrelevant to the obvious point that this particular item says nothing about whether apache sucks or not.
But sure, tit's not the most ignorant statement that's been posted on slashdot, it's at the top end of the list though.
Maybe I missed it, but I don't see any details on how httpd gets compromised in the first place? Is there a zero-day vulnerability in apache that allows itself to be overwritten?
"ESET researchers .. have been analyzing a new threat affecting Apache webservers. The threat is a highly advanced and stealthy backdoor .. Researchers have named the backdoor Linux/Cdorked.A, and it is the most sophisticated Apache backdoor seen so far"
How does this advanced threat get onto the Apache webservers in the first place?
AccountKiller
This whole story is inverse-spam, AKA Microsoft FUD.
I hate this new corporate-friendly Slashdot - it's all just so banal.
What is with the hyper-sensationalized reports of "advanced and stealthy" Apache vulnerabilities lately? First darknet, now Cdorked? It is clearly FUD, as even the least competent systems administrator could confirm.... Neither of these security issues have anything at all to do with Apache except that they target the Apache binaries for modification.
The only vulnerability here is that for some reason you allowed your server to get rooted. Neither of these attacks can be carried out without root access, and if your server is already rooted, a modified httpd binary could end up being the least of your worries. (I'd be willing to bet you got rooted for a really dumb reason like a bad password, and if so, you probably also have extremely stupid practices like keeping plaintext password lists or private keys on the server...in which case, you just gave your entire infrastructure to some script kiddie.)
Isn't Apache Open Source?
Isn't Open Source the only way to prevent this stuff from getting into the wild?
Are we totally screwed because our last best hope hopeless?
Moderators, PLEASE stop modding biters up. A visible biter highlights the invisible troll he's biting and the dumbass stupid enough to respond to a troll should be modded "troll" as well as the troll he's biting. I biter is as bad as a troll!
I think I'll do a little metamoderating. I hope I run across the ignorant comment I'm responding to.
It is a high level hack........gov't/porn has great programmers
maybe he's part of the wachootoo tribe... apparently they're biters