Slashdot Mirror
Speedy Attack Targets Web Servers With Outdated Linux Kernels
alphadogg writes "Web servers running a long-outdated version of the Linux kernel were attacked with dramatic speed over two days last week, according to Cisco Systems. All the affected servers were running the 2.6 version, first released in December 2003. 'When attackers discover a vulnerability in the system, they can exploit it at their whim without fear of it being remedied,' Cisco said. After the Web server has been compromised, the attackers slip in a line of JavaScript to other JavaScript files within the website. That code bounces the website's visitors to a second compromised host. 'The two-stage process allows attackers to serve up a variety of malicious content to the visitor,' according to Cisco."
So the webserver was compromised and JavaScript was inserted and their first thought is it's the kernel?
Your hair look like poop, Bob! - Wanker.
No mention of how the 2.6 kernel was compromised . Besides 2.6 is quite ancient by any standards . Why'd anyone want to run it?
All the affected servers were running the 2.6 version, first released in December 2003.
Not even wrong. I guarandamntee you that none of the affected computers were actually running 2.6.0, and it wouldn't have been /that/ long ago that such an obviously stupid and ill-researched claim wouldn't have been posted.
Soulskill, you /do/ understand that there were forty different versions of Linux in the 2.6 series, do you not? You do understand that the final 2.6 release was in August 2011 and it was numbered 2.6.39.4, which I know because I did 5 minutes of basic Googling?
Hail Eris, full of mischief...
E pluribus sanguinem
PHP is mentioned in the article. 1000x times more likely the attacker's initial entry point was a vulnerable PHP app. Some recent local privilege escalation exploits for linux were published a couple weeks ago, thats the only part relevant to the kernel. Yes, the author is an idiot.
"All of the affected web servers that we have examined use the Linux 2.6 kernel."
Right, because RHEL (and Centos) run 2.6.... so sampling ANY number of servers is likely going to show that they run 2.6.
Is Slashdot just a click redirector these days? Do 'editors' remotely 'edit' anything?
I want to delete my account but Slashdot doesn't allow it.
"We think you're door is unlocked but we won't say which house it is or where it's located."
Talk about vague.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
Slashdot fails again.
Danger! 2.6 kernel! MASSIVE INFECTIONS! While we're at it, lets talk about Windows XP...
If you have root on a webserver, why do you need javascript to do the redirect?
The webserver is perfectly capable of doing that on its own.
It gets worse (or IMHO, less competent):
Author Comment FTFA (bottom of page - emphasis mine):
"We haven’t identified the initial attack vector. We have no reason to suspect that the attack isn’t via http. I’d be very interested to hear from any affected sys admins if they identify how the attackers gain access."
In other words, they don't even know if it's the effing kernel at this point -all they know is that 2,000 some-odd websites have been bit, and they all use the absolute most common kernel version for webservers on the planet (2.6.x).
Hell, for all we know it could be some commonly-shared crappy PHP script getting popped. :/
Quo usque tandem abutere, Nimbus, patientia nostra?
Wow a shitty year and shitty software.
Becomes The Internet of unpatched easily pwned things.
There is a list of affected sites linked in the comments. The first one on the list is running FreeBSD. I did not bother checking the rest.
Follow your Euro bills at EBT
Maybe that's because it was a LAN networking stack that ran IPX/SPX and didn't connect to the global Internet using TCP/IP.
And personally I updated it quite a bit, thank you.
Are you trolling?
From the comments on the announce page, since (almost) nobody will go over there.
So, it looks like the "old 2.6.x kernel releases" was really just a signal for "old nonupdated code".
BTW: for those who bitch about "well the 2.6 line was patched and maintained all the way to 2011" they do have a line where they imply the 2.6 kernels are early kernels, not the latter 2.6.20 whatever ones, but it's not a well written article and is easy to miss.
Okay, so between 2003 and 2011 there have probably been 3 dozen versions of that kernel. The overwhelming majority of Linux based web servers run the vetted, thoroughly tested and patched, tried and true 2.6 series Linux Kernel. This makes me concerned Cisco doesn't understand what it means to run a production system. Also, what do they even mean by "web server" are we to assume Apache? Because there are alternatives in use... lots. Considering most Linux based web servers are running a variation of the 2.6 kernel, then of course that's where they will the find the attacks (Duh anyone?). I would be much more interested in what web server we are talking about and any commonality between them over the kernel of the operating system. I am shaking my head trying to figure what this article is really trying to communicate especially since they practically shoot down most of their article with the "Update" at the top.
Oh, I get it now.
Brought to you by Carl's Junior.
I didn't realize Windows servers were running Linux 2.6 under the hood...fascinating! http://www.whitefirdesign.com/...
The comments at the end of the CISCO article flush out the fact that they noticed a line of malicious javascript at the end of a large number of .js files but they have no idea how it got there.
In fact the list of JS files given include many that are not even running on Linux servers.
The author is irresponsible at best, and incompetent at worst...