Malware Attack Infected 25,000 Linux/UNIX Servers

wiredmikey writes "Security researchers from ESET have uncovered a widespread attack campaign that has infected more than 25,000 Linux and UNIX servers around the world. The servers are being hijacked by a backdoor Trojan as part of a campaign the researchers are calling 'Operation Windigo.' Once infected, victimized systems are leveraged to steal credentials, redirected web traffic to malicious sites and send as many as 35 million spam messages a day. 'Windigo has been gathering strength, largely unnoticed by the security community, for more than two and a half years and currently has 10,000 servers under its control,' said Pierre-Marc Bureau, security intelligence program manager at ESET, in a statement.

There are many misconceptions around Linux security, and attacks are not something only Windows users need to worry about. The main threats facing Linux systems aren't zero-day vulnerabilities or malware, but things such as Trojanized applications, PHP backdoors, and malicious login attempts over SSH. ESET recommends webmasters and system administrators check their systems to see if they are compromised, and has published a detailed report presenting the findings and instructions on how to remove the malicious code if it is present."

Comments

Summary -- root can do anything!

[whoever57]

The report only mentions in passing how the servers are compromised, which is that the operators of the botnet use credentials that have already been stolen to "infect" new machines. I personally think it likely that brute force attacks against ssh passwords are also used.

The summary states:

The servers are being hijacked by a backdoor Trojan

but I think this is an inaccurate summary since the Trojan is being installed on machines where the attackers already have root credentials.

Perhaps some unknown vulnerability is also being used to gain root access, but the report does not claim this.