Slashdot Mirror

← Back to Stories (view on slashdot.org)

Backdoor Targeting Apache Servers Spreads To Nginx, Lighttpd

Posted by timothy on from the learning-to-attack-the-unpronounceable dept.

An anonymous reader writes "Last week's revelation of the existence of Linux/Cdorked.A, a highly advanced and stealthy Apache backdoor used to drive traffic from legitimate compromised sites to malicious websites carrying Blackhole exploit packs, was only the beginning — ESET's continuing investigation has now revealed that the backdoor also infects sites running the nginx and Lighttpd webservers. Researchers have, so far, detected more than 400 webservers infected with the backdoor, and 50 of them are among the world's most popular and visited websites." Here's the researchers' original report.

136 comments

  1. I have a stupid question. by Anonymous Coward · · Score: 1, Interesting

    Why do the developers force us to tell the world what engine we use?

    1. Re:I have a stupid question. by TheCarp · · Score: 4, Interesting

      Are you refering to the http headers that identify the server version? If so then yes, it is a stupid question since, every webserver which I have ever configured has had an option to turn that off. Not that I ever bothered, if it was so useful, it would be turned off by default.

      Fingerprinting doesn't take that long, especially for well known services. Might be of some use if you really to run something obscure. In any case, even if they don't know if you are vulnerable, how long does it take to find out? Little use there.

      --
      "I opened my eyes, and everything went dark again"
    2. Re:I have a stupid question. by phantomfive · · Score: 1

      It's going to be useful if someone is trying a targeted attack directly on your server. That way they know what version you are running, and can go to the correct source code trying to find a vulnerability, and not waste time on newer versions, or older versions, or patched versions, or whatever.

      --
      "First they came for the slanderers and i said nothing."
    3. Re:I have a stupid question. by Anonymous Coward · · Score: 0

      Are you refering to the http headers that identify the server version? If so then yes, it is a stupid question since, every webserver which I have ever configured has had an option to turn that off. Not that I ever bothered, if it was so useful, it would be turned off by default.

      Fingerprinting doesn't take that long, especially for well known services. Might be of some use if you really to run something obscure. In any case, even if they don't know if you are vulnerable, how long does it take to find out? Little use there.

      So how do you do that in Apache?

    4. Re:I have a stupid question. by Bert64 · · Score: 3

      It's all about advertising, to show just how many people use their webserver.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    5. Re:I have a stupid question. by Anonymous Coward · · Score: 0

      Yes, Mr. expert, can you please tell us how to do this? I would appreciate you telling me how to do this in nginx.

    6. Re:I have a stupid question. by gmack · · Score: 3, Informative

      Quite frankly, I don't think the webserver was the entry point for Cdorkd.A since as far as I read it was mainly machines with cpanel that were infected. Even if the problem wasn't cpanel Apache doesn't run with the right permissions to change it's own binary. If the entry point is elsewhere, once they are in the machine with root access discovering what web server software being used is trivial.

      Rather than worrying about something as trivial as the web server software, I would be much more concerned about why none of the control panels I've come across seem to have any sort of secure design. They run as root without any sort of privilege separation and edit the config files even when daemons are available that have a database back end.

    7. Re:I have a stupid question. by Anonymous Coward · · Score: 0

      Well, if you have a catalog of what every website runs, it's a lot easier to run targeted exploit attacks instead of just blanketing every webserver in existence hoping to hit an exploit.

    8. Re:I have a stupid question. by Anonymous Coward · · Score: 0

      In nginx setting "server_tokens off" will remove version info, but there is (by design) no way to remove the "nginx" string. To get rid of this, the simplest way is to change the string in the source code and then build nginx yourself (src/http/ngx_http_header_filter_module.c).

      Fingerprinting makes this probably overkill, and some browsers treat different webservers differently based upon what this value is, so I'm not sure that it should even be best practice to hide this value. I believe this is why nginx consider there being no config option to totally remove the "nginx" type as a feature rather than a bug.

    9. Re:I have a stupid question. by phantomfive · · Score: 0

      What kind of developer thinks that a web server needs a GUI? That, in my opinion explains everything about why the control panels lack secure design.

      --
      "First they came for the slanderers and i said nothing."
    10. Re:I have a stupid question. by Anonymous Coward · · Score: 2, Informative

      So how do you do that in Apache?

      You're looking for ServerTokens and/or ServerSignature.

      But as the comment says:

      # Changing the following options will not really affect the security of the
      # server, but might make attacks slightly more difficult in some cases.

    11. Re:I have a stupid question. by Anonymous Coward · · Score: 0

      If you think hiding a version number or application name will help you're being naive. They'll just do something akin to the black hole exploit kit, and try every exploit known to them.

    12. Re:I have a stupid question. by Opportunist · · Score: 1

      And this is why I usually announce a version with a well known exploit and keep the firewall trained to alert me of exploits targeting that version.

      No better way to tip you off to a targeted attack.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    13. Re:I have a stupid question. by Zontar+The+Mindless · · Score: 5, Funny

      What kind of developer thinks that a web server needs a GUI?

      Where else are they going to put the ON and OFF buttons?

      --
      Il n'y a pas de Planet B.
    14. Re:I have a stupid question. by mvdwege · · Score: 1

      Keyword here is 'if'.

      Most attackers will just run every exploit against a service in the hope that one will stick.

      --
      "I know I will be modded down for this": where's the option '-1, Asking for it'?
    15. Re:I have a stupid question. by Anonymous Coward · · Score: 0

      it's not forced on you, it's something that can be turned off or edited into something a little more generic...

      similarly....

      that's why you don't use AGPL (Affero) software for web sites and apps that forces you to disclose that, AND, link to your code, besides...

      and, shorted-sighted little shits that 'demand' link or attribution on public facing pages or page output source for their little project or code are also fucking stupid..

      you don't tell the world what you're running. period. sure, some things are too obvious from url structure, etc, such as joomla or word press... but you shouldn't be running those either..

    16. Re:I have a stupid question. by Zero__Kelvin · · Score: 4, Insightful

      CPanel is often used to allow Web Hosting customers to have control over their pay per month websites / accounts. If a company allows their customers to create email accounts, enable ssh, etc. on a shared host this is how it is typically done to reduce the huge overhead of fielding requests for such tasks from every Tom, Dick, and Harry, since you clearly cannot give them root access.

      Implemented an idea poorly does not make it a bad idea.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    17. Re:I have a stupid question. by Anonymous Coward · · Score: 0

      And generate a metric ass-ton of logs making the whole attempt easy to see. No, security through obscurity does not work; you are no more or less vulnerable... Masking httpd engine, plugins/modules, and version makes it more difficult for an attacker or pentester to stealthily compromise the service.

      Ignoring your logs means it will make no difference; logwatch+masked service goes a long ways in making it more interesting...

    18. Re:I have a stupid question. by Yebyen · · Score: 3, Interesting

      > since you clearly cannot give them root access.

      and yet that's what it seems to be doing here. I heard a lot of folks say that LXC was DOA, because it didn't offer any protection against the classic "escalate chrooted root user to full system access," and I am not an expert but I'd say that has changed, you _can_ give your customers root without giving them root on the host system. Check out http://docker.io/ </shameless>

      (I heard there were alternatives to docker too, but I haven't found any other than RTFM and Edit The Damn Configs And Cross Your Fingers. Docker has just entered version 0.3 release and development is moving quickly.)

      --
      Restating the obvious since nineteen aught five.
    19. Re:I have a stupid question. by Anonymous Coward · · Score: 0

      In the cloud?

    20. Re:I have a stupid question. by Zero__Kelvin · · Score: 1

      You aren't quite getting it. The tool is designed to only allow people who have logged in (auth'd) to perform tasks that require root access, limiting said access to only certain configuration files that they should be able to change, and to make only certain kinds of changes. It has a security flaw which can be exploited. It is no different than any other software that requires root access and has a security flaw that can be exploited from a non-privileged environment. It is akin to a GUI based sudo with nice dialogs as a front end to various tools. If a particular implementation of sudo is flawed it doesn't mean the concept of sudo is flawed.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    21. Re:I have a stupid question. by jafiwam · · Score: 2

      It's going to be useful if someone is trying a targeted attack directly on your server. That way they know what version you are running, and can go to the correct source code trying to find a vulnerability, and not waste time on newer versions, or older versions, or patched versions, or whatever.

      Not really. Even targeted attacks are begun by an automated probe that just tries everything and sees what sticks.

      It's a foolish thing to care about. The headers shouldn't be there, and if they are, it shouldn't matter. It takes literally seconds or minutes to ferret out what the tool is, and often the site says so right in a page somewhere.

      Caring about it is for fools or people who want to lead those fools away from their money.

    22. Re:I have a stupid question. by phantomfive · · Score: 1

      It's an interesting idea, I'm not sure it's very practical on a production server.

      --
      "First they came for the slanderers and i said nothing."
    23. Re:I have a stupid question. by TheCarp · · Score: 1

      > Apache doesn't run with the right permissions to change it's own binary

      However it runs with enough permission to execute an exploit that would elevate access. The further you get into the system, the more holes can be exploited. The article did mention that they seem to be using a sophisticated root kit, after initial entry.

      > as I read it was mainly machines with cpanel that were infected.

      However many infected had neither cpanel or the other common app. Likely, there are multiple vectors. This seems very targeted. Likely they pick their target and then choose vectors based on the intended target.

      It was indicated that this Cdorked.A doesn't contain code to spread itself. So it must be injected by some other tool.

      --
      "I opened my eyes, and everything went dark again"
    24. Re:I have a stupid question. by Yebyen · · Score: 1

      No, I got it, I was just chiming in chorus with the other folks that were saying, "this tool does not need to be run as root. why does it have such a large attack surface? it's very expensive and widely deployed so why is it that it's always been such crap"

      I don't run cpanel myself (I understand it's quite expensive to license) but I have been a customer of cpanel hosts before, I totally get it, it's meant to limit your access while providing you with administrative capabilities that are above the bare minimum access given to public consumers of the services on your server instance. So is LXC, and so is chroot, and for a long time they had expensive holes too that could result in not just privilege escalation, but total system compromise, if they (or their children processes) were exploited, like many other tools that are meant to limit your access and provide access limitations.

      Cpanel is meant to give the appearance of root (sometimes even a root shell) without allowing total system compromise. See what I did there?

      I was actually fishing for someone to possibly mention another tool like docker.

      --
      Restating the obvious since nineteen aught five.
    25. Re:I have a stupid question. by TheCarp · · Score: 1

      This is true but you are assuming that removing this information from where it is now presents a significant barrier to such a database. I find this unlikely with the ease of both os level and application level fingerprinting and the availability of throwaway botnetted machines.

      This protects best against the very specific MO of someone with a few exploits looking for a wide range of servers to exploit. This seems more targeted. If they didn't have the information needed on a desired target, they could likely collect it easily enough.

      Remember, the malware in question doesn't spread itself, it must be injected by another tool, and likely can use multiple tools with different injection vectors.

      --
      "I opened my eyes, and everything went dark again"
    26. Re:I have a stupid question. by Opportunist · · Score: 1

      It can very easily backfire, of course. Takes some serious titanium balls to pull it off. :)

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  2. Why? by centipedes.in.my.vag · · Score: 5, Interesting

    Why isn't there a list of infected sites? Avoiding them would seem to be a priority.

    --
    Only on /. can I lose karma with 2x "5, Funny" posts.
    1. Re:Why? by Skapare · · Score: 3, Funny

      Are you afraid of little infected web site? Something wrong with your browser?

      --
      now we need to go OSS in diesel cars
    2. Re:Why? by centipedes.in.my.vag · · Score: 5, Insightful

      Yes. My entire family will be calling for free tech support as their machines eat crap. This affects me directly and greatly, as I'm sure it similarly affects many other frequent posters here. Also personally, yes, no browser is invincible and I'd like to avoid infection as well.

      --
      Only on /. can I lose karma with 2x "5, Funny" posts.
    3. Re:Why? by Anonymous Coward · · Score: 0

      Yes. My entire family will be calling for free tech support as their machines eat crap. This affects me directly and greatly, as I'm sure it similarly affects many other frequent posters here. Also personally, yes, no browser is invincible and I'd like to avoid infection as well.

      It looks like Facebook, Twitter, Google, Yahoo, Hotmail, Reddit and Slashdot are among the affected sites... good luck with that!

      But really, that's like telling your family: "don't open any emails that say "free" in the subject, they're infected with a virus!!!" I'm sure the sites that are known to be affected have already been notified by the researchers and they've taken steps to clean it up - so why get everyone in a tizzy over this when the known sites are likely going to be solved before it's a problem for you?

    4. Re:Why? by phantomfive · · Score: 2

      It could lure you into a sense of false security, letting you think you are safe by avoiding them, when really you don't know that. Other sites are probably infected too.

      Also, the sites they've found are probably not infected anymore, since presumably they've been notified and resolved the problem.

      --
      "First they came for the slanderers and i said nothing."
    5. Re:Why? by jrumney · · Score: 1

      Avoiding them would seem to be a priority.

      1. slashdot.org
      2. ....

      Too late!

    6. Re:Why? by znrt · · Score: 2

      It could lure you into a sense of false security, letting you think you are safe by avoiding them, when really you don't know that. Other sites are probably infected too.

      methinks the whole interntets build upon a false sense of false security. the OP is right, there is no reason not to disclose the list.

      Also, the sites they've found are probably not infected anymore, since presumably they've been notified and resolved the problem.

      this is a bold assumption, and a clear indication of a false sense of security :-)
      (besides in contradiction with your previous statement)

    7. Re:Why? by phantomfive · · Score: 1

      How is it a contradiction?

      --
      "First they came for the slanderers and i said nothing."
    8. Re:Why? by dotancohen · · Score: 3, Interesting

      Why isn't there a list of infected sites? Avoiding them would seem to be a priority.

      Here is how to make sure you are not one of the infected sites: Compile and run this:
      http://www.welivesecurity.com/wp-content/uploads/2013/04/dump_cdorked_config.c

      If you don't want to vet that, you can get a first-aproximation with "ipcs", just look for the Apache PID, which you can get from "ps aux | grep apache2".

      --
      It is dangerous to be right when the government is wrong.
    9. Re:Why? by mwvdlee · · Score: 3, Interesting

      How exactly does your browser recognize the difference between a normal page and the exact same page delivered from the exact same server at perhaps a microsecond delay?

      This backdoor may simply be passing on POSTs with passwords (a webserver receives these unencrypted, you know) to another server without altering anything on the page. The only one who'd notice would be a webserver admin that happens to monitor outgoing traffic.

      --
      Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
    10. Re:Why? by Anonymous Coward · · Score: 0

      You can't get them to return the favour? Sounds like a bit unbalanced situation.

    11. Re:Why? by Opportunist · · Score: 3, Funny

      Find out what they're experts in, become a complete idiot in that field and start pestering them with requests for help.

      Keeps my dad away. Though I now have to pay for repairs when my car breaks down.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    12. Re:Why? by Anonymous Coward · · Score: 0

      Find out what they're experts in, become a complete idiot in that field and start pestering them with requests for help.

      Not only are you an opportunist, you are a genius as well.

    13. Re:Why? by Anonymous Coward · · Score: 0

      Are you 23? Why are you doing tech support for your family. Get some hormone replacement therapy and man the fuck up.

    14. Re:Why? by znrt · · Score: 1

      sorry. there's no contradiction, really, i meant that warning against trusting *any* site (an advice i endorse) would be incompatible with advocating for trusting *some* sites because they would fix the issue (the same sites that got pwned in the first place), but i see now that you weren't implying that at all. my bad.

    15. Re:Why? by phantomfive · · Score: 1

      oic

      --
      "First they came for the slanderers and i said nothing."
  3. Name the 50 sites by PNutts · · Score: 5, Insightful

    The actual quote is, "50 are ranked in Alexa’s top 100,000 most popular websites." Quite different than the summary but would still be interesting to know.

    1. Re:Name the 50 sites by Anonymous Coward · · Score: 0

      Where is this list? I would want that information as a high priority. That Alexa put some list together and these sites happen to be on the list of affected sites - is immaterial. Incomplete reporting across the board - not one of the links from the posting have any more info than the kernel in the posting has. Journalism, if one can still call it that, is in a dismal state. Give people the information they need, don't leave them hanging, wondering, searching... /rant ends/

    2. Re:Name the 50 sites by phantomfive · · Score: 1

      That Alexa put some list together and these sites happen to be on the list of affected sites - is immaterial.

      It's material because it means that you had a nontrivial chance of actually running into them.

      Also, releasing that information is less useful than you think, because presumably those sites have been notified and resolved the problem. The real security worry is the sites that are infected but we don't know. They are definitely out there.

      --
      "First they came for the slanderers and i said nothing."
    3. Re:Name the 50 sites by Anonymous Coward · · Score: 0

      Ok, point taken. If its non-trivial to run across these sites, this makes disclosure of the list even more important. Which 50 of Alexa's top 1000 sites on the planet are they? CNN.com? Reuters.com? Ubuntu.com? Microsoft.com? Facebook? Flikr? The public need to know.

    4. Re:Name the 50 sites by Anonymous Coward · · Score: 0

      Most likely it's microsoft.com

    5. Re:Name the 50 sites by daveime · · Score: 1

      It's material because it means that you had a nontrivial chance of actually running into them.

      Well that really depends if the affected sites are #1 to #50 or #99950 to #99999 now doesn't it ?

  4. Re:Should have used Microsoft Windows Server 2012 by Anonymous Coward · · Score: 0, Troll

    yeah cos the alternative is SOOOO much better

    fuckwit

  5. checksums by ncohafmuta · · Score: 2

    Why is this hard to detect if you're monitoring the checksums on your server binaries?

  6. And they still don't know the initial vector by Skapare · · Score: 3, Insightful

    We also don’t have enough information to pinpoint how those servers are initially being hacked, but we are thinking through SSHD-based brute force attacks.

    So does this mean I need to remove sshd? Doubtful. More likely the initial vector is social engineering or weak passwords (social stupidity). That makes this whole infection uninteresting ... it's just an app from the web server perspective. OK, so it can break into your browser with a zero-day. Fix the browser.

    --
    now we need to go OSS in diesel cars
    1. Re:And they still don't know the initial vector by phantomfive · · Score: 3, Informative

      So does this mean I need to remove sshd?

      No, it means you need a more complicated password.

      And it seems to be just a guess, they probably came to 'sshd' by following a line of reasoning starting with the only thing they could think of that all the hacked servers have in common.

      --
      "First they came for the slanderers and i said nothing."
    2. Re:And they still don't know the initial vector by lgftsa · · Score: 4, Informative

      Worried about exposed sshd? Install pam-abl and watch the brute force attackers waste their time. With my config, three failures from any IP address in an hour (or 6 per day) and that IP is locked out for a week through PAM. They can still try, of course, but even if they somehow guess the correct password, it must be in their first three guesses each week.

      There's no indication to the attacker that pam-abl is there, and there's very little chance of a DOS attack against legitimate logins.

      Oh, and you've denied root logins from the internet, haven't you?

      Warning: Source tarball, but if I debian-ized it, then anyone can.

    3. Re:And they still don't know the initial vector by jedidiah · · Score: 1

      ...and the server wasn't using any of the various forms of brute force attack countermeasures.

      These come prepackaged now but you could easily craft one yourself out of basic Unix tools. Did that very thing before discovering fail-to-ban.

      A little paranoia goes a long way.

      --
      A Pirate and a Puritan look the same on a balance sheet.
    4. Re:And they still don't know the initial vector by thetoastman · · Score: 3, Informative

      There are quite a number of ways to harden access

      1. pam-abl (as noted above)
      2. denyhosts
      3. VPN (openvpn works for me)
      4. Hosting ISP firewall

      Also as noted above, do not permit direct remote root access. Doing anything less is just advertising yourself as a platform for malware.

      The first three are quite easy to set up. There is really no excuse for not setting up a least a minimum level of security on your system. That plus careful use of mod_security, and you've done quite a bit towards thwarting the casual drive-by cracker.

      . . . . just my two cents

    5. Re:And they still don't know the initial vector by mtb_ogre · · Score: 3, Informative

      [quote]No, it means you need a more complicated password.[/quote] Or better still, generate a key and turn off passwords entirely.

    6. Re:And they still don't know the initial vector by OhANameWhatName · · Score: 1

      So does this mean I need to remove sshd?

      I got an e-mail in my spam folder last week so I pulled all the hard disks.
      Unlike you other lameoids, my server aints gettin hacked.

    7. Re:And they still don't know the initial vector by Anonymous Coward · · Score: 0

      Warning: Source tarball, but if I debian-ized it, then anyone can.

      apt-get install libpam-abl

    8. Re:And they still don't know the initial vector by nedwidek · · Score: 3, Informative

      And if not fail2ban, a good first step is updating the firewall rules to have a rate limiter on sshd. Mine allows only 2 attempts to connect a minute.

      -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --set
      -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 2 -j DROP
      -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

      --
      Post anonymously - For when your opinion embarrasses even you!
    9. Re:And they still don't know the initial vector by Anonymous Coward · · Score: 0

      sorry, any decent timing attack will definitely detect and likely exploit pam-abl to make your passwords less secure. most open source security code is terrible at this, and coming in a tarball is not a good indicator of project maturity.

    10. Re:And they still don't know the initial vector by Anonymous Coward · · Score: 0

      Dude, way to make the rest of us look bad.

    11. Re:And they still don't know the initial vector by Anonymous Coward · · Score: 0

      Do you have proof of this or are you just talking out your ass?

    12. Re:And they still don't know the initial vector by Anonymous Coward · · Score: 2, Informative

      Also don't use user/password ssh logins. RSA authentication only.

    13. Re:And they still don't know the initial vector by Slashdot+Parent · · Score: 2

      Worried about exposed sshd? Install pam-abl and watch the brute force attackers waste their time.

      Thanks for the link to pam-abl. That was the first I'd heard of it. Neat module.

      Personally, I've always gone with

      RSAAuthentication yes
      PubkeyAuthentication yes
      PasswordAuthentication no

      and I sleep well at night. Although I have to admit, I sure see an assload of this type of crap in the logs:

      May 9 11:12:38 imap sshd[15366]: reverse mapping checking getaddrinfo for ras-185-151.wntpr.net [196.12.185.151] failed - POSSIBLE BREAK-IN ATTEMPT!
      May 9 11:12:38 imap sshd[15366]: Invalid user matt4 from 196.12.185.151
      May 9 11:12:44 imap sshd[15368]: reverse mapping checking getaddrinfo for ras-185-151.wntpr.net [196.12.185.151] failed - POSSIBLE BREAK-IN ATTEMPT!
      May 9 11:12:44 imap sshd[15368]: Invalid user mat4 from 196.12.185.151
      May 9 11:12:46 imap sshd[15370]: reverse mapping checking getaddrinfo for ras-185-151.wntpr.net [196.12.185.151] failed - POSSIBLE BREAK-IN ATTEMPT!
      May 9 11:12:46 imap sshd[15370]: Invalid user mat from 196.12.185.151

      --
      They don't grade fathers, but if your daughter's a stripper, you fucked up. --Chris Rock
    14. Re:And they still don't know the initial vector by marcosdumay · · Score: 1

      So does this mean I need to remove sshd?

      No, but if you can you should disable pasword authentication.

      --
      Rethinking email
    15. Re:And they still don't know the initial vector by Lakitu · · Score: 1

      Has this never resulted in denial of service?

    16. Re: And they still don't know the initial vector by Anonymous Coward · · Score: 0

      Additionally, in your sshd config, restrict allowed users to your working account and disable root login

    17. Re:And they still don't know the initial vector by Lost+Race · · Score: 1

      Yeah, you could do that, or you could change to a non-standard port. In my ten years of running sshd on a non-standard port on several public servers I've been hit by exactly 0 (zero) probes on that port.

      Obscurity for the security win!

    18. Re:And they still don't know the initial vector by WuphonsReach · · Score: 1

      So does this mean I need to remove sshd?

      Any public side SSH service where you are only using SSH for administration of the machine should be:

      1) Disallowing password-based authentication. Use only SSH key pairs instead for authentication. Now the attacker also needs to steal your private SSH key (and possibly find out the password as well). You've just made it a lot more difficult for them.

      2) Moved to an alternate port. This doesn't make you immune to attacks, but it does mean that you'll see less garbage in your log files. Most brute-force attack botnets only look at port 22 before moving on. By moving to an alternate port, you're no longer low-hanging fruit and most automated attacks will pass you by. By having less garbage in the log file, any organized attacker stands out more clearly.

      3) Disallow login to root via SSH. Even for an internal-only machine that never talks to the outside world it's a better move to require users to authenticate as themselves and then "su" or "sudo" in order to perform root level tasks.

      --
      Wolde you bothe eate your cake, and have your cake?
    19. Re:And they still don't know the initial vector by WuphonsReach · · Score: 1

      Although I have to admit, I sure see an assload of this type of crap in the logs:

      The simple solution there is to move SSH off of the default port (of 22) and to some other port in the 1-1024 range. You'll end up with a lot less crap in the log files as a result.

      Which makes it easier to see the real threats because they aren't camouflaged by hundreds of other errors in the logs.

      --
      Wolde you bothe eate your cake, and have your cake?
    20. Re:And they still don't know the initial vector by Anonymous Coward · · Score: 0

      Or you could use more useful tools like CSF and LFD...

    21. Re:And they still don't know the initial vector by Trogre · · Score: 1

      Here's what I do:

      1. Have sshd listen on a non-standard port (ie NOT 22)
      2. apt-get install fail2ban - lock the
      3. Use pam_listfile to whitelist what accounts can log in with SSH
      4. Explicitly disable SSH root access in sshd_config

      --
      "Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
  7. Fix by Frankie70 · · Score: 5, Funny

    You can download a fix here.

    1. Re:Fix by Anonymous Coward · · Score: 1, Funny

      Yes, indeed. Why suffer from this minor malware when you could have all the best ones infecting you? Lightweights!

    2. Re:Fix by hcs_$reboot · · Score: 1

      At first it made me laugh... but then wondered... maybe you were serious after all??

      --
      Slashdot, fix the reply notifications... You won't get away with it...
  8. Cpanel? by Anonymous Coward · · Score: 1

    is this for cpanel or apache?

    1. Re:Cpanel? by fazey · · Score: 1

      ... What?
      The intruder is backdooring the binaries. It has nothing to do with cPanel. Not to mention cPanel runs easyapache, but if it became an intended target, im sure it could be infected just the same...

    2. Re:Cpanel? by c0lo · · Score: 2

      is this for cpanel or apache?

      TFA

      "We still don’t know for sure how this malicious software was deployed on the web servers," the researchers admit. "We believe the infection vector is not unique. It cannot be attributed solely to installations of cPanel because only a fraction of the infected servers are using this management software. One thing is clear, this malware does not propagate by itself and it does not exploit a vulnerability in a specific software."

      --
      Questions raise, answers kill. Raise questions to stay alive.
  9. Curious by Anonymous Coward · · Score: 1

    Only 2 weeks back, when this was reported everyone blamed cPanel. Now that exposures in NGNIX and LighHTTPD have been found, comments (guesses) as to the attack method are proposed, but very few realistic ideas. TFA seems to indicate that it's more pervasive than many of the people commenting want to believe. I'm just waiting for them to find IIS infected as well.

    1. Re:Curious by Anonymous Coward · · Score: 0

      LighHTTPD is infected too?? Damn, I thought it was just Apache, nginx, and LigHTTPD

  10. Not an apache/nginx/lightttpd vulnerability by gmuslera · · Score: 2, Informative

    Those servers somewhat (i.e. a vulnerable web app, weak ssh passwords, local privilege escalation on a shell got in in some way, or a combo of all of those) got rooted, and instead of modifying web pages (easier, but also easier to detect and fix), replacing the entire web server (easier to detect or to roll back) or changed the configuration of i.e. mod_rewrite modules (that with a configuration manager could had been detected/roll back to the original one). got some new modules replaced/added, modules that in particular had that functionality.

    Is nothing particulary new in this, more than the malware authors not being just script kiddies and actually did some serious programming for it. Somewhat I hope that they give back to the community releasing the source, not the malware backdoor itself, but with a modified, non malware version with an useful use (i.e. something that dynamically blacklists IPs/useragents/languages for actions, receiving the input from another kind of system, like a honeywords service) if not available yet.

    1. Re:Not an apache/nginx/lightttpd vulnerability by Anonymous Coward · · Score: 0

      Yeah, it's Burston-Marsteller, contracted by M$, smearing FOSS. Thanks for your reasonable post.

  11. Those idiots at Microsoft by Anonymous Coward · · Score: 1

    If they'd used Linux instead, this wouldn't have happened.

    1. Re:Those idiots at Microsoft by hcs_$reboot · · Score: 0

      Oh you mean if MS wouldn't have existed, many people wouldn't have converted themselves to virus makers and the world would be better?

      --
      Slashdot, fix the reply notifications... You won't get away with it...
  12. There is something wrong with EVERY browser by Anonymous+Brave+Guy · · Score: 1

    There are numerous security flaws in all the major browsers. Vulnerabilities are getting fixed all the time; just look at the change log of Firefox or Chrome over the last few releases, for example. If you think you're magically virus-proof because you're running your pet OSS software, you might consider the list of popular OSS web servers in the title of this discussion.

    --
    If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
    1. Re:There is something wrong with EVERY browser by DarkTempes · · Score: 3, Insightful

      I run lynx/links/etc in a chroot jail, you insensitive clod!

      In my experience most of the major browser exploits attack vulnerable plugins (flash, java, acrobat/pdf viewer, etc) or abuse scripting.
      If you restrict or disable said plugins and javascript then I'd say you're pretty darn safe.
      Granted, most "web 2.0" websites work like shit without javascript enabled but some stuff still works. For the more sane of us there are things like NoScript.

      It's kind of hard for plain text and images to do bad things though I suppose it's been done before.

    2. Re:There is something wrong with EVERY browser by jedidiah · · Score: 2

      There's a small number of infected sites. That clearly indicates that this is likely a case of digital burglary rather than the much lower bar of something like a viral infection. Otherwise we would be talking about thousands of sites or half the Internet.

      Your screed would be more relevant if not for the fact that there are various fairly common workarounds employed on the various browsers to mitigate just this kind of nonsense.

      A little paranoia goes a long way. That's far more useful than the sort of blissful ingorance that tends to be associated with non-OSS software.

      --
      A Pirate and a Puritan look the same on a balance sheet.
    3. Re:There is something wrong with EVERY browser by lindi · · Score: 4, Interesting

      From Debian 7 release notes:

      "Therefore, browsers built upon the webkit, qtwebkit and khtml engines are included in Wheezy, but not covered by security support. These browsers should not be used against untrusted websites. For general web browser use we recommend browsers building on the Mozilla xulrunner engine (Iceweasel and Iceape) or Chromium."

      -- http://www.debian.org/releases/stable/amd64/release-notes/ch-information.en.html#browser-security

    4. Re:There is something wrong with EVERY browser by Bert64 · · Score: 3, Interesting

      They attack plugins because flash/java/acrobat are still installed on over 90% of potential targets, whereas the browser market is now diversified...

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    5. Re:There is something wrong with EVERY browser by dkf · · Score: 3, Informative

      It's kind of hard for plain text and images to do bad things though I suppose it's been done before.

      There have been vulnerabilities in PNG and JPG image format handlers in the past, so yes, there has definitely been the potential to have images do bad things. (Arguably none would be as bad as using some of the ones relating to goatse, but that's a different kind of problem.) If you hear of problems in fundamental media type handlers, for goodness sake make sure you're up to date with your security patches!

      I don't know if there were any exploits of those problems in the wild though.

      --
      "Little does he know, but there is no 'I' in 'Idiot'!"
    6. Re:There is something wrong with EVERY browser by Anonymous Coward · · Score: 0

      You youngsters and your newfangled technologies, the proper way of browsing is Stallman's:

      I have several free web browsers on my laptop, but I generally do not look at web sites from my own machine, aside from a few sites operated for or by the GNU Project, FSF or me. I fetch web pages from other sites by sending mail to a program (see git://git.gnu.org/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly.

    7. Re:There is something wrong with EVERY browser by neonKow · · Score: 1

      I have several free web browsers on my laptop, but I generally do not look at web sites from my own machine, aside from a few sites operated for or by the GNU Project, FSF or me. I fetch web pages from other sites by sending mail to a program (see git://git.gnu.org/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly.

      I think this is the key.

      Get your friends' computers infected instead!

  13. screw it by clam666 · · Score: 4, Funny

    I knew this was a mistake. Secure my ass. I'm going back to Windows.

    --
    I'm a satanic clam.
    1. Re:screw it by Anonymous Coward · · Score: 0

      Hey why stop there, Novell 3.11 !

    2. Re:screw it by Volguus+Zildrohar · · Score: 1

      I don't think you're familiar with the stereotypes. You'd only need to secure your ass if you were going to OS X.

      --
      When confronted with one problem, some think "I'll use recursion". Now they are confronted with one problem.
    3. Re:screw it by Anonymous Coward · · Score: 0

      This made me lol. 8/10

  14. Re:I can't believe it, Jim. by VortexCortex · · Score: 0

    That girl's standing over there listening and you're telling him about our back doors?

    Clearly, that girl is interested in back doors because he has a package at his front door.

  15. Re:I can't believe it, Jim. by Anonymous Coward · · Score: 0, Offtopic

    That girl's standing over there listening and you're telling him about our back doors?

    Mister Potato Head! Mister Potato Head! Back doors are not secrets!

  16. The hack resides in memory. by mtb_ogre · · Score: 2

    From what I understand, the hack doesn't affect the binaries on disk, it runs in memory only. Checksum based file checkers don't check running executable.

    1. Re:The hack resides in memory. by ls671 · · Score: 2

      I think they said there is a modified httpd although. It should be enough to raise suspicion.

      https://www.net-security.org/secworld.php?id=14836

      --
      Everything I write is lies, read between the lines.
  17. Re:and this is why.... by Anonymous Coward · · Score: 5, Funny

    FreeBSD runs the same software stack, so it would make little difference.

    That's why our organization uses a custom server software written in 68K assembly running on MacOS 7.6.1 on a cluster of Quadra 610s.

  18. Re:and this is why.... by H0p313ss · · Score: 1

    That's why our organization uses a custom server software written in 68K assembly running on MacOS 7.6.1 on a cluster of Quadra 610s.

    Well played sir, well played indeed.

    --
    XML is a known as a key material required to create SMD: Software of Mass Destruction
  19. Is G-Wan affected ? by Taco+Cowboy · · Score: 1

    I have some site running lighttpd, others I run G-Wan

    Is G-Wan affected ?

    Thanks in advance for any tips that you can share with us.

    Thanks again !!

    --
    Muchas Gracias, Señor Edward Snowden !
    1. Re:Is G-Wan affected ? by phantomfive · · Score: 1

      Looks like it could be affected because the exploit wasn't in the web-server; their machines got hacked through other means and then used that access to modify the webserver. So make sure you have a good ssh password and your box is updated at a minimum.

      --
      "First they came for the slanderers and i said nothing."
    2. Re:Is G-Wan affected ? by Anonymous Coward · · Score: 0

      Thanks for the info !!

      Looks like I ain't gonna enjoy lots of sleep from now until next weekend

    3. Re:Is G-Wan affected ? by Anonymous Coward · · Score: 1

      Not delivering traffic is standard behaviour for G-Wan; it doesn't need a backdoor or virus for that.

  20. Re:and this is why.... by Anonymous Coward · · Score: 1

    610s? I can get 40 605s in a rack that fits 10 or so 610s.

    Which 10G AAUI modules are you using for your AppleTalk SAN?

  21. Checker code: download, compile, run by AliasMarlowe · · Score: 1

    Thanks for the info !!

    Looks like I ain't gonna enjoy lots of sleep from now until next weekend

    You could download and compile (for your web server) the detection C code provided here. Then you'll have less uncertainty.

    I had to cross-compile it for an old Synology box with a PowerPC 8241 processor; it seems to be clean.

    --
    Those who can make you believe absurdities can make you commit atrocities. - Voltaire
    1. Re:Checker code: download, compile, run by marcosdumay · · Score: 1

      Hey, great tool, thanks.

      But I wouldn't trust a positive result that much. If it says your computer is clean, it probably is, if it says it isn't, you'd better take another look at it before formating.

      --
      Rethinking email
  22. pam-abl doesn't solve this by dutchwhizzman · · Score: 2

    They have vast botnets, once an IP gets blocked, they just continue from the next IP. I haven't seen brute forcing coming from the entire botnet by default myself, but I'm sure there are crackers that have figured this out by now. You're merely obfuscating the weakness with your solution. Sure, it's effective against quite a few types of drive-by attacks, but the only solution is to stop accepting passwords and require PKI for ssh auth.

    --
    I was promised a flying car. Where is my flying car?
    1. Re:pam-abl doesn't solve this by Anonymous Coward · · Score: 0

      I'm glad you live in a perfect world where nobody needs password only access. Also I hope you like the 100% cpu spinning from the SSHD still getting a crapload of connections because they still keep connecting endlessly even though you don't accept passwords. Most of these things are pretty stupid, but hey you just keep using public keys and think the world is perfect because you are using those. Nevermind the fact that key management in typical SSH usage is TERRIBLE. But hey, you are the security expert here, right?

  23. Re:The only backdoor I'm interested in by Anonymous Coward · · Score: 0

    I'm sorry, your sister is not relevant to this discussion.

  24. Re:and this is why.... by Anonymous Coward · · Score: 0

    FreeBSD runs the same software stack, so it would make little difference.

    That's why our organization uses a custom server software written in 68K assembly running on MacOS 7.6.1 on a cluster of Quadra 610s.

    My organization uses custom server software written in 6502 assemly language running on a cluster of VIC-20s. We upgraded from Sinclair ZX-81s just this year.

  25. Apache sometimes legitimately uses shared memory by Anonymous Coward · · Score: 0

    Just because you see a shared memory segment used by apache doesn't mean that you're infected. Apache sometimes legitimately uses shared memory segments. See, for example: http://blog.nominet.org.uk/tech/2008/03/26/apache-shared-memory/

  26. No good... by Anonymous Coward · · Score: 0

    Find out what they're experts in, become a complete idiot in that field and start pestering them with requests for help.

    Keeps my dad away. Though I now have to pay for repairs when my car breaks down.

    My dad is a gynecologist, and he just gets worried when his son starts pestering him for advice.

  27. Re:and this is why.... by smash · · Score: 1

    Except it isn't the same software stack down to the operating system. The one thing all of these exploits have in common is they are running on Linux. What's to say there isn't a flaw in the kernel somewhere that is exposed via these web servers?

    --
    I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
  28. Re:and this is why.... by smash · · Score: 1

    If not the kernel, maybe the C library. Which also isn't common to say, FreeBSD or Solaris.

    --
    I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
  29. Re:Apache sometimes legitimately uses shared memor by dotancohen · · Score: 1

    Just because you see a shared memory segment used by apache doesn't mean that you're infected. Apache sometimes legitimately uses shared memory segments. See, for example: http://blog.nominet.org.uk/tech/2008/03/26/apache-shared-memory/

    Thank you. That is an interesting use case, one that I had never encountered. Obviously, if Apache has been configured to share memory across processes then seeing it do so is not clear sign of infection. However, if Apache has not been explicitly configured to do so, then seeing Apache sharing memory with another process is a real red flag.

    Your linked blog is great, there are quite a few gems in there. Thanks!

    --
    It is dangerous to be right when the government is wrong.
  30. Re:Apache sometimes legitimately uses shared memor by marcosdumay · · Score: 1

    It's a nice filter. If apache isn't using shared memory, you are ok. If it is, well, research further.

    --
    Rethinking email
  31. M$oft Propaganda Operation by Anonymous Coward · · Score: 0

    All of this is designed to smear Free Software. Their goal is to make people think "where there is smoke, there is fire". In truth, there is lots of smoke and no fire (how the infection actually happened) in their "reports". Trace the money and find Mr Ballmer of Redmond.

  32. Re:and this is why.... by Anonymous Coward · · Score: 0

    Oh yeah. That's the intended message by those who paid this smear campaign.

    If we actually tracked down the root cause it probably is something like "didn't bother to update stupid admin GUI for five years".

  33. Re:and this is why.... by Anonymous Coward · · Score: 0

    68k systems are inherently more secure than x86 systems. On x86, the stack starts at the top of memory and grows downward, making stack smashing through buffer overflows trivial: walking off the end of the buffer gives you immediate access to things like the return pointer and saved register values. On 68k, the stack starts at the top of code and grows upwards, so a buffer overflow only has access to local variables -- the return pointer and the like are all inaccessible.

  34. Re:and this is why.... by smash · · Score: 1

    You want to bet the security of your site on that?

    --
    I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
  35. Re:and this is why.... by Anonymous Coward · · Score: 0

    Oh yeah? Well, mine uses a cluster of UNIVACs with custom server software written on punchcards!

  36. proves this is all a farce by iggymanz · · Score: 1

    By "backdooring the binaries", I can change the operating system or any software of any system. So a system gets rooted, and bad wares can be installed. Bear shits in the woods, story at 11.

    1. Re:proves this is all a farce by fazey · · Score: 1

      What I was getting at is, rootkit != vulnerability in cpanel nor apache.