Sophisticated Apache Backdoor In the Wild

An anonymous reader writes "ESET researchers, together with web security firm Sucuri, have been analyzing a new threat affecting Apache webservers. The threat is a highly advanced and stealthy backdoor being used to drive traffic to malicious websites carrying Blackhole exploit packs. Researchers have named the backdoor Linux/Cdorked.A, and it is the most sophisticated Apache backdoor seen so far. The Linux/Cdorked.A backdoor does not leave traces on the hard-disk other than a modified 'httpd' file, the daemon (or service) used by Apache. All information related to the backdoor is stored in shared memory on the server, making detection difficult and hampering analysis."

Comments

doesn't look so scary

[iggymanz]

Only cpanel apaches vulnerable and modified httpd easily found by grep'ing a string?

*yawn*

Re:doesn't look so scary

[Eunuchswear]

Yeah, and I'm sure you could fix it with an apropriate hosts file.

Re:doesn't look so scary

[Anonymous Coward]

No, all apaches are vulnerable - if the binary is replaced in this way. cPanel doesn't use packaged binaries for apache, and therefore you can't spot if you've been hacked *by simple use of the package manager*.

Re:doesn't look so scary

[The Mighty Buzzard]

All everything is vulnerable if the binary is replaced. There's exactly jack and shit sophisticated about replacing binaries.

Re:doesn't look so scary

[KiloByte]

It's a cpanel vulnerability, Apache is merely modified by the payload to help it spread. Seriously, giving a web server process root -- what the hell are those guys thinking?

Re:doesn't look so scary

[Lumpy]

Bingo.

That is why this thing is overhyped. Yes it's a problem but only on grossly msiconfigured servers. They might as well left the Root password as "password"

Re:doesn't look so scary

[Anonymous Coward]

They might as well left the Root password as "password"

You can change it ???

Re:doesn't look so scary

[Anonymous Coward]

They might as well left the Root password as "password"

You can change it ???

Don't worry, I already did it for you!

Re:doesn't look so scary

[ebno-10db]

They might as well left the Root password as "password"

You can change it ???

Yes, but it's a bad idea. Think of changed passwords as security through obscurity.

Does it hurt?

[geek]

Getting Cdorked in the backdoor sounds painful.

Another Link

[Anonymous Coward]

Here's another link about this issue.

Seems systems with cPanel installed are getting hit with this. Better get a hash of your current apache executable so you can easily check it down the road.

Wow

[Dr. Evil]

"other than a modified 'httpd' file,"

It's completely invisible, as long as you're blind.

Re:Wow

[Synerg1y]

when was the last time you checked your httpd file?

Re:Wow

[Poeli]

rpm -V httpd ?

Not that difficult to put in a cron job.

Re:Wow

[ArchieBunker]

Who even does that in the first place? OpenBSD gives you a daily email containing all changes to config files that have occurred.

Re:Wow

[lky]

when was the last time you checked your httpd file?

If you're using tripwire or another similar tool and its properly configured, then you should be notified of file changes.

As long as you're paying attention, this doesn't seem like much of an issue.

Re:Wow

[larry bagina]

httpd isn't a config file; it's the apache executable. Tripwire or other such utilities would catch it.

Re:Wow

[ShaunC]

rpm -V httpd ?

That won't work for this particular attack surface, because cPanel installs Apache itself and doesn't use a package manager. As far as rpm is concerned, Apache isn't installed to verify.

Re:Wow

[h4rr4r]

The solution to this is be a big boy and don't use cPanel.

Re:Wow

[c0lo]

rpm -V httpd ?

Not that difficult to put in a cron job.

Cited FA:

In our previous posts, we recommended the utilization of tools like “rpm -Va” or “rpm -qf” or “dpkg -S” to see if the Apache modules were modified. However, those techniques won’t work against this backdoor. Since cPanel installs Apache inside /usr/local/apache and does not utilize the package managers, there is no single and simple command to detect if the Apache binary was modified.

Yeah, you'd be vulnerable if your apache installation is done using cpanel (as many hosting providers are).

It's bad, but is this really a back-door?

[dmomo]

This looks like a module for apache that, while sinister and clever, must be installed like any other module. Presumable, unless I'm missing something, this requires root access. If this so called "back door" (debatable) is on a system where it shouldn't be there is a bigger question on how was access to install it obtained it the first place.

Just of the top of my head...

[DrYak]

rkhunter and chkrootkit as a quick example.
two tools which are more or less set and forget, and which also target workstation users.
(Done in background periodically, no interaction required, except running a small command after an update to avoid triggering false positive in one case)

Probably hundreds of sysadmin-oriented tools can do it too.

(checking files for modification is a very sane step to protect against corruption and possible compromise)

having the /usr mount read-only and only /var, /tmp & co read-write is a rather sane measure which is also wide spread (not only on big server farms, on the technical grounds that the /usr might be served over the network. but even some smart-phone do it, webOS for example)

On the other hand, a trojan targeting Linux is a proof that Linux server *are* a very valuable infection target, and lower markter share at the desktop isn't the only valid argument explaining the scarcity of Linux viruses.

Method of infection?

[dgharmon]

"ESET researchers .. have been analyzing a new threat affecting Apache webservers. The threat is a highly advanced and stealthy backdoor .. Researchers have named the backdoor Linux/Cdorked.A, and it is the most sophisticated Apache backdoor seen so far"

How does this advanced threat get onto the Apache webservers in the first place?