Slashdot Mirror
New Multi-Purpose Backdoor Targets Linux Servers
An anonymous reader writes A new multi-purpose Linux Trojan that opens a backdoor on the target machine and can make it participate in DDoS attacks has been discovered and analyzed by Dr. Web researchers, who believe that the Chinese hacker group ChinaZ might be behind it. "First, Linux.BackDoor.Xnote.1 sends information about the infected system to the server. It then goes into standby mode and awaits further instructions. If the command involves carrying out some task, the backdoor creates a separate process that establishes its own connection to the server through which it gets all the necessary configuration data and sends the results of the executed task," the researchers explained.
Well those certainly look like reputable links by famous 'researchers' to me! As an IT guy, I'll definitely have to go click on them so that my workstation gets infected too.
You have to run the file as a system admin for it even to work. This is a non issue joke.
The source was Dr. Web's own marketing page.
This smells like a press release (which smells coincidentally like spam).
They mount a bruteforce SSH attack.. for real.. Well, I say bring it on!
Come on!!!
What vulnerability? What port? What gets attacked?
Is there more than one vulnerability?
I wonder -- I really, really wonder. Are Slashdot "editors" getting kickbacks?
What a loaded pile of crappy advertising.
"The malware, dubbed Xnote, gets delivered on the target computer after the attackers mount a successful brute force attack and establish an SSL connection with the machine."
If someone brute-forces rootlevel creds on your machine, you're toast anyway, you always were.
OpenBSD has always supported networking.
"The malware will only be installed in a system if it has been launched with superuser (root) privileges"
aaaand i've already gone back to my tea.
any sysop worth her salt knows the rules:
0. It will build without root or not at all.
1. It will come from a repository or reputable source.
2. It will check its md5 and check it twice.
3. It will be compatible with standard secops tools like chroot, jails, cgroups, propolice, and selinux. this includes sandboxing.
4. Isolate, quarantine, and deploy the secops team. any compromised machine, any network, any server without question.
5. Slap about with a large bit of herring or trout the dev or luser in accordance with LART policies.
Good people go to bed earlier.
Why bother with a backdoor? Just use a front door like SMB.
What a fine description of the attack vector. OMG, we are all doomed!
In Soviet Washington the swamp drains you.
"Who also know nothing about Unix/Linux"....
Who are the editors here, and have they ever even *used* a linux distribution????
If telephones are outlawed, then only outlaws will have telephones.
This is FASCINATING! Where can I buy Dr. Web antivirus for Linux? I'm seriously SOLD on this product that Dice has seen fit to advertise to me today.
THANK YOU so much!!!
I'm targeting this article with my multi-purpose back door right now.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
The linked article mistranslates the original russian.
The vector is SSH, brute force attempts to guest the root password. The net-security article mistranslates to SSL.
In what world do competent women admins exist?
This one. The overwhelming majority of sysadmins I've seen all have boobs.
"A new multi-purpose Linux Trojan that opens a backdoor on the target machine and can make it participate in DDoS attacks has been discovered and analyzed by Dr. Web researchers.
.. The malware will only be installed in a system if it has been launched with superuser (root) privileges".
How does the 'Trojan' get onto the target machines?
"To spread the new Linux backdoor, dubbed Linux.BackDoor.Xnote.1, criminals mount a brute force attack to establish an SSL connection with a target machine
For fucks-sake slashdot, remember when this was a serious technology mag, instead of providing free adverts to some AV company.
Most linux systems don't have root passwords anymore. Use sudo, don't allow root logins and you are safe from those stupid 'so 1996' kind of attacks.
Non-Linux Penguins ?
No, the BSDs instead. Particularly OpenBSD for this one, although FreeBSD may be just as good
Why doesn't the summary mention to look for /bin/iptable6?
Wouldn't that be the single most important piece of information to convay? Oh. No. The single most important piece of information seems to be to plug some AV garbage.
Successful ones will indeed be much better...
However, not allowing root logins, not running services as root, and keeping things in Chroot jails, makes the task of the virus writer gets so much more difficult, even if you get escalated to root on some buffer overflow, injection attack or something. Not to mention, Linux distributions seem to have a lot of different ideas about how and where the configuration files live, what init process they want to run and the default security settings they use for the various services...
Taking all that into account will be some feat...
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
The idea of using sudo instead of allowing ssh as root always sounded stupid to me.
If an attacker gets access to your regular user account then it is game over the next time you try to sudo from there.
It's called systemd. Many users are installing it so now there's a whole slew of linux boxen under someone else's control...
There's a lot of those ssh brute force attacks going on at the moment, although they are trying usernames other than "root" and widely distributed so you get a couple of hundred machines taking turns of just a few attempts each so that it's harder to block.
It's a problem a few years old with the recent twist being spreading out the attacks to avoid triggering "fail2ban" and other automated blocking measures.
They never are. It is the clueless users, of which there are plenty. As Linux gets more popular, it gets more of them. We have a lot where I work at a university. Grad students will decide they want to have a Linux system for something they are researching. They won't consult IT, they just go grab whatever distro they've heard of and install it. Then they start turning on every feature they can, SSH, web, etc, anything any of their software asks for or anything they think might be neat. They leave it on all the time and don't mind after it. Then it gets owned, and they are surprised.
I care about malware notices not for my own system, I've never had any case of any kind of malware since I'm vigilant in my security. I care because I work in IT and have to deal with people who are not careful. Also because the more of these infected systems there are, the shittier a place the Internet is in general.
But you have to brute force a username as well as a password. These attacks aren't in any way targeted and "root" is present everywhere. I've never seen anyone try to ssh into my machines as the user geantvert or chihowa. Have you?
If you want a vision of the future, imagine a youtube comments section scrolling - forever.
chihowa writes:
But you have to brute force a username as well as a password. These attacks aren't in any way targeted and "root" is present everywhere. I've never seen anyone try to ssh into my machines as the user geantvert or chihowa. Have you?
Well, not before today...
What is the exposure by which the Trojan is actually planted, and how does it differ from any other trojan? If this is not a BackDoor, then its not a news item and deserves to be taken off the site.
Time for a new Political party in the US (or two!) One is off the rails Other cant pony up a leader.
Good luck guessing with major distro's defaulting to "PermitRootLogin no" nowadays.
So that is only an additional layer of security by obscurity. Still not convinced!
google translate, translates correctly to SSH
DrWeb, such good "researchers" they can't even translate their own shit
Atari rules... ermm... ruled.
just renamed all my "root" users to "admin" :-)
Try to bruteforce that!
Maybe I should rename to "Ht695rdwP"
Atari rules... ermm... ruled.
Guest? :P
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Good security includes such layers (but doesn't rely only on them). It's entirely effective against non-targeted automated attacks, which comprise well over 99% of the attacks your network will face. (Of course, a good password or key based auth is just as effective. A good password or key and no root login is more effective.) Allowing root login adds another attack opportunity with predictable parameters. It's all about minimizing the surface open to attack.
Since >99% of all ssh attacks on the internet are automated and target root, you can drop (or tarpit or whatever) all of those attempts without affecting legitimate users. This leaves your attention free to address the attacks that are actually dangerous (and leaves your logs less cluttered or easily filtered).
Look at it another way... what do you gain, security wise, from allowing a superuser to login directly from the network? Especially when most of the attacks you see are trying to log in directly as that superuser.
[As an aside, "security by obscurity" gets a bad rap and the term is often bandied about as a self-evident truth like "correlation is not causation". "Security by obscurity" refers to keeping the design of an implementation secret, not to using secrets in your implementation (is having a password security by obscurity?).
Depending only on obscurity is poor security, but using obscurity as a layer (where it's effective) in a larger security process can be extremely effective. Schneier has a good essay on this subject.]
If you want a vision of the future, imagine a youtube comments section scrolling - forever.