Slashdot Mirror
Backdoor Targeting Apache Servers Spreads To Nginx, Lighttpd
An anonymous reader writes "Last week's revelation of the existence of Linux/Cdorked.A, a highly advanced and stealthy Apache backdoor used to drive traffic from legitimate compromised sites to malicious websites carrying Blackhole exploit packs, was only the beginning — ESET's continuing investigation has now revealed that the backdoor also infects sites running the nginx and Lighttpd webservers. Researchers have, so far, detected more than 400 webservers infected with the backdoor, and 50 of them are among the world's most popular and visited websites." Here's the researchers' original report.
Why do the developers force us to tell the world what engine we use?
Why isn't there a list of infected sites? Avoiding them would seem to be a priority.
Only on
The actual quote is, "50 are ranked in Alexa’s top 100,000 most popular websites." Quite different than the summary but would still be interesting to know.
This is what you get for trusting mission critical servers to open sores software.
Why is this hard to detect if you're monitoring the checksums on your server binaries?
We also don’t have enough information to pinpoint how those servers are initially being hacked, but we are thinking through SSHD-based brute force attacks.
So does this mean I need to remove sshd? Doubtful. More likely the initial vector is social engineering or weak passwords (social stupidity). That makes this whole infection uninteresting ... it's just an app from the web server perspective. OK, so it can break into your browser with a zero-day. Fix the browser.
now we need to go OSS in diesel cars
You can download a fix here.
is this for cpanel or apache?
Only 2 weeks back, when this was reported everyone blamed cPanel. Now that exposures in NGNIX and LighHTTPD have been found, comments (guesses) as to the attack method are proposed, but very few realistic ideas. TFA seems to indicate that it's more pervasive than many of the people commenting want to believe. I'm just waiting for them to find IIS infected as well.
Those servers somewhat (i.e. a vulnerable web app, weak ssh passwords, local privilege escalation on a shell got in in some way, or a combo of all of those) got rooted, and instead of modifying web pages (easier, but also easier to detect and fix), replacing the entire web server (easier to detect or to roll back) or changed the configuration of i.e. mod_rewrite modules (that with a configuration manager could had been detected/roll back to the original one). got some new modules replaced/added, modules that in particular had that functionality.
Is nothing particulary new in this, more than the malware authors not being just script kiddies and actually did some serious programming for it. Somewhat I hope that they give back to the community releasing the source, not the malware backdoor itself, but with a modified, non malware version with an useful use (i.e. something that dynamically blacklists IPs/useragents/languages for actions, receiving the input from another kind of system, like a honeywords service) if not available yet.
If they'd used Linux instead, this wouldn't have happened.
WP Signal Tracker Over View Product Name: WP Signal Tracker Creator: Mark Thompson Focus: SEO & Traffic http://wpsignaltrackers-review.com/wp-signal-tracker/
There are numerous security flaws in all the major browsers. Vulnerabilities are getting fixed all the time; just look at the change log of Firefox or Chrome over the last few releases, for example. If you think you're magically virus-proof because you're running your pet OSS software, you might consider the list of popular OSS web servers in the title of this discussion.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
That girl's standing over there listening and you're telling him about our back doors?
I knew this was a mistake. Secure my ass. I'm going back to Windows.
I'm a satanic clam.
Having a working knowledge of a variety of platforms is a good idea. Given that the vulnerability seems to be common to all these servers when run on Linux, now would be a prime time to flick services over to FreeBSD (or something else) until the root cause has been determined.
That no one knows the actual method of infection yet though is a fair cause for concern; it means you can't effectively defend against it when running that platform.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
From what I understand, the hack doesn't affect the binaries on disk, it runs in memory only. Checksum based file checkers don't check running executable.
The only backdoor I'm interested in is the one on a nubile woman.
for successful significantly else To be an teeth into when
I have some site running lighttpd, others I run G-Wan
Is G-Wan affected ?
Thanks in advance for any tips that you can share with us.
Thanks again !!
Muchas Gracias, Señor Edward Snowden !
Thanks for the info !!
Looks like I ain't gonna enjoy lots of sleep from now until next weekend
You could download and compile (for your web server) the detection C code provided here. Then you'll have less uncertainty.
I had to cross-compile it for an old Synology box with a PowerPC 8241 processor; it seems to be clean.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
They have vast botnets, once an IP gets blocked, they just continue from the next IP. I haven't seen brute forcing coming from the entire botnet by default myself, but I'm sure there are crackers that have figured this out by now. You're merely obfuscating the weakness with your solution. Sure, it's effective against quite a few types of drive-by attacks, but the only solution is to stop accepting passwords and require PKI for ssh auth.
I was promised a flying car. Where is my flying car?
Mini Ekskavatör Mü Lazm BizimLe Çalmak stermisiniz Makina Parkmz 4 adet Bobcat 2 adet Mini Ekskavatör Makinelerimiz 1.6 tonluk Mini Ekskavatör 2.6 Tonluk Mini Ekskavatör Kabinsiz Kullanmlarda 1.5 metre yükseklikden girebilen1 metre genilikden girebilen mini ekskavatör mevcut siz müterilerimiz bizi tercih etme sebebiniz ne olabilir tabiki Çalmamzn ve iimizi Temiz Yapmamz Sizlere Güven Verir Can Hafriyat Tahsin Can
Just because you see a shared memory segment used by apache doesn't mean that you're infected. Apache sometimes legitimately uses shared memory segments. See, for example: http://blog.nominet.org.uk/tech/2008/03/26/apache-shared-memory/
Find out what they're experts in, become a complete idiot in that field and start pestering them with requests for help.
Keeps my dad away. Though I now have to pay for repairs when my car breaks down.
My dad is a gynecologist, and he just gets worried when his son starts pestering him for advice.
Just because you see a shared memory segment used by apache doesn't mean that you're infected. Apache sometimes legitimately uses shared memory segments. See, for example: http://blog.nominet.org.uk/tech/2008/03/26/apache-shared-memory/
Thank you. That is an interesting use case, one that I had never encountered. Obviously, if Apache has been configured to share memory across processes then seeing it do so is not clear sign of infection. However, if Apache has not been explicitly configured to do so, then seeing Apache sharing memory with another process is a real red flag.
Your linked blog is great, there are quite a few gems in there. Thanks!
It is dangerous to be right when the government is wrong.
It's a nice filter. If apache isn't using shared memory, you are ok. If it is, well, research further.
Rethinking email
All of this is designed to smear Free Software. Their goal is to make people think "where there is smoke, there is fire". In truth, there is lots of smoke and no fire (how the infection actually happened) in their "reports". Trace the money and find Mr Ballmer of Redmond.
By "backdooring the binaries", I can change the operating system or any software of any system. So a system gets rooted, and bad wares can be installed. Bear shits in the woods, story at 11.