Slashdot Mirror

← Back to Stories (view on slashdot.org)

Backdoor Targeting Apache Servers Spreads To Nginx, Lighttpd

Posted by timothy on from the learning-to-attack-the-unpronounceable dept.

An anonymous reader writes "Last week's revelation of the existence of Linux/Cdorked.A, a highly advanced and stealthy Apache backdoor used to drive traffic from legitimate compromised sites to malicious websites carrying Blackhole exploit packs, was only the beginning — ESET's continuing investigation has now revealed that the backdoor also infects sites running the nginx and Lighttpd webservers. Researchers have, so far, detected more than 400 webservers infected with the backdoor, and 50 of them are among the world's most popular and visited websites." Here's the researchers' original report.

3 of 136 comments (clear)

  1. Re:I have a stupid question. by TheCarp · · Score: 4, Interesting

    Are you refering to the http headers that identify the server version? If so then yes, it is a stupid question since, every webserver which I have ever configured has had an option to turn that off. Not that I ever bothered, if it was so useful, it would be turned off by default.

    Fingerprinting doesn't take that long, especially for well known services. Might be of some use if you really to run something obscure. In any case, even if they don't know if you are vulnerable, how long does it take to find out? Little use there.

    --
    "I opened my eyes, and everything went dark again"
  2. Why? by centipedes.in.my.vag · · Score: 5, Interesting

    Why isn't there a list of infected sites? Avoiding them would seem to be a priority.

    --
    Only on /. can I lose karma with 2x "5, Funny" posts.
  3. Re:There is something wrong with EVERY browser by lindi · · Score: 4, Interesting

    From Debian 7 release notes:

    "Therefore, browsers built upon the webkit, qtwebkit and khtml engines are included in Wheezy, but not covered by security support. These browsers should not be used against untrusted websites. For general web browser use we recommend browsers building on the Mozilla xulrunner engine (Iceweasel and Iceape) or Chromium."

    -- http://www.debian.org/releases/stable/amd64/release-notes/ch-information.en.html#browser-security