Slashdot Mirror
Unnoticed For Years, Malware Turned Linux Servers Into Spamming Machines
An anonymous reader writes: For over 5 years, and perhaps even longer, servers around the world running Linux and FreeBSD operating systems have been targeted by an individual or group that compromised them via a backdoor Trojan, then made them send out spam, ESET researchers have found. What's more, it seems that the spammers are connected with a software company called Yellsoft, which sells DirectMailer, a "system for automated e-mail distribution" that allows users to send out anonymous email in bulk.
Here's the white paper in which the researchers explain the exploit.
Would you like some cheese with your whine?
So Windoze, Linux, BSD have all been compromised ... how about Hurd / Plan-9? Have they been compromized?
Muchas Gracias, Señor Edward Snowden !
This isn't as interesting as it sounds (or have i misunderstood?) Basically, if you are a spammer, and download binaries of 'cracked' spamming software... surprise surprise, there is a back door in it that lets other spammers use your servers to spam. It is kinda interesting from a technical point of view (putting perl scripts into elf binaries) but the headline is very misleading, this is not a serious linux/bsd security issue.
"Perl code packed inside ELF binary .. The Perl spammer .. The spamming daemon is also written in Perl and packed inside an ELF binary"
OK. how exactly is this Mumblehard malware loaded and executed on the server,without user action and without the user running as root?
Via greed driving user interaction in the hope of a "free lunch". From the article:
So it's a parasite feeding on cheapskate spammers. I'm not sure whether to get annoyed with them or give them a medal.
These PEBKAC exploits happen more often than you might think on Linux
And removing the "text extending babbel":
1.) Don't get a pirated copy of "DirectMailer" - because it's infected and will trojanise your server.
2.) keep your server and especially it's services updated - check your Joomla and Wordpress installation - and additionally to that the themes you installed.
- the white paper says that the researchers think that these were the most likely vectors
- the article puts faith on the thoughts of the researchers
Translation:
The infected server were so extremely outdated that the researchers didn't know where to start to search. Some believe to have seen active kernel versions dating back to 2000 and even further and surrendered the computers to archeologists to study ancient server setups.
3.) an antivirus on freebsd or linux system is pratically useless in detecting recent malware - they need at least 5 yrs. of cultivation
On windows the infection base is much greater. However the idea of "quarantining" software of problematic origin for a certain period of time and early virustotalling it, should be considered.
lesson: no cracked software on linux/freebsd system
Broken content management systems like Joomla and Wordpress seem to play a big part in all sorts of problems these days. Why are these packages not robust, despite them being open source? Isn't the general claim around here that in open source, vulnerabilities are quickly found and fixed?
WTF?
Decent people don't want to be associated with people like MikeeUSA, the fact that the anti-systemd people seem happy to associate with him isn't going to help their cause.
What about this one: "decent people don't want to be associated with people like Hitler, the fact that the vegetarian people seem happy to associate with him isn't going to help their cause."
See what I did there? (no, that doesn't qualify as Godwin, not yet)
I'm one of these anti-systemd people, and I don't want to be associated in anyway with a troll like MikeeUSA. He's behavior has nothing to do with accepting or not systemd and trying to make some kind of true-scotman-non-sequitur-bullshit out of it is utter non-sense.
It's not like the script can run without the interpreter. Even if you were stupid enough to mount /tmp other than noexec (the default).
I thought direct mailer was a bulk spamming engine? It seems to be a dog eat dog situation.
i.e. if you install a pirated version of a spamming engine [FOR YOUR OWN USE] it will also spam for other spammers too.
You certainly didn't wait long enough to read the article before posting.
Since when was Russell Coker an official spokesman for Debian?
Watch this Heartland Institute video
I've got three servers that I maintain; four if you count my workstation. They all run Ubuntu Linux 14.04.
What is top in my mind is DETECTION. How to tell if Mublehard has infected us. If it has I must can go in person and re-install all the systems from scratch. But I'm not going to spend several nights on the bus until I get a YES or NO. Perhaps Yellsoft sells a Mumblehard detector, ha ha?
Yes, you're right, anti-systemd people are not all insane, but some of the most vocal of them are.
(And it's not just good old "I want to marry 12 year old girls" MikeeUSA, there are also the "systemd will eat your ouput" loons, the "systemd is an NSA plot" obsessives, the "systemd is an end run around the GPL" tin-foil hatters...)
Watch this Heartland Institute video
Decent people don't want to be associated with people like MikeeUSA, the fact that the anti-systemd people seem happy to associate with him isn't going to help their cause.
What about this one: "decent people don't want to be associated with people like Hitler, the fact that the vegetarian people seem happy to associate with him isn't going to help their cause."
See what I did there? (no, that doesn't qualify as Godwin, not yet)
I'm one of these anti-systemd people, and I don't want to be associated in anyway with a troll like MikeeUSA. He's behavior has nothing to do with accepting or not systemd and trying to make some kind of true-scotman-non-sequitur-bullshit out of it is utter non-sense.
Wikipedia about Godwin:
Godwin's Law is an Internet adage asserting that "As an online discussion grows longer, the probability of a comparison involving Nazis or Hitler approaches 1" — that is, if an online discussion (regardless of topic or scope) goes on long enough, sooner or later someone will compare someone or something to Hitler or Nazism.
This is a perfect example - even if it is not a troll, even if it's meant to tell us that this is not a Godwin, even if meant as a serious answer.
This "article" is beyond retarded.
read the article to see how it got there
"The hands that help are better far than lips that pray." - Robert Ingersoll (1833-1899)
this malware is pretty unix-y about the way it does things. its small, does few things and does them efficiently.
The author should be complemented on his adherence to the unix philosophy. Even his social engineering campaign is that way.
Functionality wise, an equal malware executable on windows would be megabytes in size and be installed as a service :D
Cheese is a GNOME application and runs natively , no need for a Windows compatibility layer.
oh dear.... what an unoriginal troll.. leave the internet and come back when your age exceeds your shoe size and maybe you'll become more informed
"The hands that help are better far than lips that pray." - Robert Ingersoll (1833-1899)
Read the article? What madness is this?
I haven't read it either and I'll still agree with MobileTatsu-NJG here: the huge benefit with OSS that people keep talking about is that thousand of people looking at the source code are able to find bugs, trojans and backdoors. And this particular problem is over five years old, too.
Get free satoshi (Bitcoin) and Dogecoins
Yeah, I can't wait to hear how this is spun I to a tale of how great OSS is.
Wait no more!
The article states that the analysts have identified 8,867 infected IP addresses. In April 2014, Netcraft confirmed that there were roughly 958,919,789 sites on the web at that time. Independently of them, W3Techs state that nearly 68% of servers are running some form of Unix, and the vast majority of those can be safely assumed to be running Linux.
So let's say, then, that better than half a billion sites are potentially vulnerable to this exploit, but in practical terms, over the course of years, a mere 8,867 of them actually were infected by this exploit. That means that, uh... carry the 9... somewhere around, oh... 0.0017734% of all vulnerable Linux sites have been compromised by a hitherto unknown and unmitigated active exploit.
Clearly this debacle is indisputable proof that Linux security is a shambolic, shameful charade that needs to be stopped before the world collapses into chaos.
Crumb's Corollary: Never bring a knife to a bun fight.
"\u201cconservative\u201d"
"doesn\u2019t"
"I\u2019m"
Looks like systemd already wrecked your shit. Your punctuation doesn't even fucking work!
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
"Clearly this debacle is indisputable proof that Linux security is a shambolic, shameful charade that needs to be stopped before the world collapses into chaos."
Pretty much, because once you understand Linux, you realize that it's a fucking tangled web of crap with no cohesion, and thus no real chance of ever being half secure.
MenuetOS does a better job at security, and it's fucking proprietary garbage.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Don't you love it when an exploit explanation is given in PDF form... it's a trap!!!
"If any question why we died, Tell them because our fathers lied."
Or they are using it.
"If any question why we died, Tell them because our fathers lied."
If you had read both the article and the white paper, you would have known that the operators behind the infection purposefully keep the number low to stay under the radar. It has succeeded for at least 5 years (and possibly up to a decade). And who's to say that others won't copy the technique, now that the assembly code for the unpacker is also given in the white paper?
The reality is that the "many eyes" claim of open source is a myth, and gives a false sense of security.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
There is no source code available to look at in this case. The article is very short and you could have read most of it in the time it took you to post the above irrelevant post, but as it is you are not even aware it's so irrelevant that it looks very silly in context.
Without stating the precise nature of the "exploit", it's hard to know whether or not your trolling is even relevant.
A Pirate and a Puritan look the same on a balance sheet.
Then maybe you too should read the white paper.
However, that doesn't change the reality that the "many eyes" claim is a myth, like so many other software myths, such as "proprietary software is better because you get what you pay for."
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Read TFA. The flaw isn't in the OSS.
You are right. The flaw is in the OSS-users who think that OSS magically makes them secure from Trojans.
Of course news about a fake are Fake News.
Yes, you're right, anti-systemd people are not all insane, but some of the most vocal of them are.
Congratulations on your insightful mod, there, for your fallacious characterization. As if we needed more proof that this place has gone to shit.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
However, that doesn't change the reality that the "many eyes" claim is a myth,
What? No, no it is not. The fact is that many bugs and vulnerabilities are found because of "many eyes", while we have to wait for either a vendor or a malicious attacker to find and announce vulnerabilities in closed-source software. Nobody credible ever claimed that "many eyes" makes FOSS invulnerable to bugs, back doors, etc. The claim is that it makes it less vulnerable, through better practice. Now, if you can provide a citation that shows this is false, I'll show you a paper full of lies — because a comparison is impossible, because the code we most care about isn't available for analysis and comparison. Without the code for the massive and common operating systems and packages which users commonly run, you can't actually make a meaningful comparison.
So, since we can't prove the claim either way, but we certainly have plenty of evidence that it does work that way since many eyes do in fact often find flaws through code analysis of FOSS but those many eyes do not find flaws in code analysis of closed-source software due to lack of availability. Therefore, the onus of proof is on you — if you want to show that something behaves counterintuitively, you're going to have to prove it.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
/. announced OpenBSD 5.7 the other day and the usual crowd came out to say, "so what", and "nobody uses it", etc. Well, this is why it has fans. Yes, yes, there were Linux and FreeBSD machines run well enough to be proof against this exploit...it's that OpenBSD machines tend to be safe out of the box and you have to make a real effort to de-secure them.
This is a trojan not an exploit. Any vendor could do this. How do I know that even the legitimately purchased programs aren't using my computer or network resources for their own benefit?
For all I know, M$ could be using the Office suite programs to mask some kind of analysis or number crunching at my expense and using Windows Update as a command-and-control.
Pain is merely failure leaving the body
Sure it's a myth. There are bugs in open source products that have been sitting there out in the open for YEARS without anyone recognizing them until they're exploited. Shellshock and Hearbleed (OpenSSL library - you can't get much more critical than that) prove once again that the "many eyes" that are not bothering to look because they all have something else to do (like scratching their own itch) proves that you also have to wait for a malicious attacker to find the vulnerabilities before they're fixed.
It's simply not a "better practice" - just different - and the myth leaves people open to exercising less caution out of an erroneous feeling that someone out there is going over the code to fix it just because it's open source. We all know that debugging and fixing code is a lot less attractive to people than writing new code, and that's simply not going to change, because it's human nature. Most programmers simply do not like to do code maintenance, which is why proprietary software with revenue streams have both an incentive and the means to PAY people to do the maintenance.
Which I guess is why the Windows kernel is now more secure than either the Linux or BSD kernels. So, citation provided :-)
Am I happy about it? No, but that's the reality of it, and denying it is being willfully negligent.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Trojans ARE exploits, duh!
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Which I guess is why the Windows kernel is now more secure than either the Linux or BSD kernels. So, citation provided :-)
I've already debunked the citation of this report when other people who failed to understand it cited it. That is a report on reported vulnerabilities. It says so right at the top of the chart. Now, go back and re-read my prior comment to understand why that is useless, and why you have failed.
If you want me to debunk any other crappy citations for you, I can do that. But if it gets to be a habit, I'm going to bill you.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Don't be a dick. Pay for the software you use.
This works if the software is still in print. True, on a server, you're going to want to use software that's still maintained. But there are plenty of video games that have gone out of print.
Trojans are exploits of a human vulnerability. How would you go about patching a system against operator stupidity?
PHP, and that means your security is dead right there
In theory, it should be possible to adopt good coding practices that leave out all the bad parts of PHP, in much the same way that Douglas Crockford recommends for JavaScript in his book JavaScript: The Good Parts. If you think the PHP interpreter inherently has poor security despite good coding practices, have you tried notifying the operators of Wikipedia?
Fellow pedantic here. The Godwin definition is of a comparison "involving" Nazis, not "with" or "to" Nazis (the words "compare ... to" are part of a rather poor and unnecessary Wikipedia paraphrase).
No, your children are not the special ones. Nor are your pets.
We can only go by reported vulnerabilities - we have no data for unreported vulnerabilities, and claiming that there are fewer unreported vulnerabilities in the linux and bsd kernels than in the windows kernel is totally unprovable - it's "magic thinking". And as shellshock and heartbleed have shown us, linux and bsd are not "magically invulnerable".
Times change. BSD used to have the least, followed closely by Linux, but not any more. Whether this trend will continue in the future is unknown, but for right now, "them's the facts."
Neither software development (open or closed) is perfect. They both have obvious problems. Back when the Windows kernel was more vulnerable, people claimed it was because Windows was used more. Today linux is more vulnerable, even though we haven't seen any increase in uptake, so why is linux more vulnerable now?
Simple - Microsoft, after having one near-death experience too many, got their act together. The excitement we had 20 years ago over the promise of linux - "maybe this will be the year of linux on the desktop" - will never happen, and we know it. As Apple has shown with BSD, and Microsoft continues to show with Windows, the vast majority of people are quite willing to pay for software and don't care about whether it's open or not. The problem with linux is fragmentation, and it's now too late to address that.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
We can only go by reported vulnerabilities - we have no data for unreported vulnerabilities, and claiming that there are fewer unreported vulnerabilities in the linux and bsd kernels than in the windows kernel is totally unprovable - it's "magic thinking".
No, it's a proven fact. Now you don't even know what you wrote. Hilarious. You've got yourself all in a tizzy.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
So show me the stats on unreported vulnerabilities.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Lost my mod points or you would get em. Another problem is that there is a huge number of scanners running out there looking for known back doors. Here is my log trace for the group that seems to be knocking on my routers, interesting how they use stealth attack vectors but do leave the trace if you know where to look ;-> Looks like they are mostly from Russia with love LOL Notice my whois is not as root. The router logs on the dos attacks tell the tale and are persistent but timed every few weeks. This is the latest but it tracks to russia the same as the other ones that seem to be knocking on my router thinking there is a server behind it.
~$ whois -B 185.94.111.1
inetnum: 185.94.108.0 - 185.94.111.255
netname: RU-QRATOR-20150331
descr: HLL LLC
country: RU
org: ORG-LA267-RIPE
admin-c: LA27-RIPE
tech-c: AA8879-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: MNT-QRATOR
mnt-routes: MNT-QRATOR
changed: hostmaster@ripe.net 20150331
source: RIPE
organisation: ORG-LA267-RIPE
org-name: HLL LLC
org-type: LIR
address: 5 Magistralnaya, 8A
address: 123007
address: Moscow
address: RUSSIAN FEDERATION
phone: +78003333522
e-mail: mail@qrator.net
abuse-c: AR16870-RIPE
mnt-ref: RIPE-NCC-HM-MNT
mnt-ref: MNT-QRATOR
mnt-by: RIPE-NCC-HM-MNT
changed: bitbucket@ripe.net 20150330
source: RIPE
person: Alexander Asimov
address: 5-ya Magistralnaya, 8a
address: 119034 Moscow
address: Russian Federation
notify: aa@highloadlab.com
e-mail: aa@highloadlab.com
mnt-by: MNT-QRATOR
phone: +7-499-241-81-92
nic-hdl: AA8879-RIPE
changed: aa@highloadlab.com 20100623
source: RIPE
person: Lyamin Alex
address: 5-ya Magistralnaya, 8a
address: 119034 Moscow
address: Russian Federation
phone: +7-499-241-8192
e-mail: flx@msu.ru
nic-hdl: LA27-RIPE
notify: flx@msu.ru
changed: ada@comstar.ru 19961219
changed: flx@msu.ru 20000529
mnt-by: MNT-QRATOR
source: RIPE
% Information related to '185.94.111.0/24AS197068'
This message was not sent from an iPhone because Peter Sellers really was a deviated prevert without a dime for the call
The article is very short and you could have read most of it in the time it took you to post the above irrelevant post, but as it is you are not even aware it's so irrelevant that it looks very silly in context.
It's a lot less silly if you know anything about Microsoft or Apple and read the stories about exploits in their systems, here. I've actually people describe Android malware, for example, as 'freedom'.
In short, you and a couple of people with mod-points missed the point of my post. I have no hard feelings, I know double-standards are hard to admit to.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
So what exactly was the point? All that is there is something about lying (spin) about OSS.
Again... Double-standards.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
Doesn't seem in any way related to your post so maybe you should actually try writing some stuff instead of assuming that people will figure out the unrelated unwritten stuff for themselves. I suspect that's why the mods didn't have the faintest clue what you were writing about and just saw an accusation of a lie that hasn't happened.
I don't know what's worse: This remark from Captain RTFA or the fact that I already explained it. Good night.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
What's falacious? You haven't seen the trolls I've described? You deny that their ideas are insane?
Watch this Heartland Institute video
The problem with linux is fragmentation, and it's now too late to address that.
Uhhh, There's only one Linux kernel and that's what you were comparing, kernels.
But I do agree with you that the Linux community could do a lot better in vetting source code for vulnerabilities.
But by lack of an itch and/or pay it's going to be hard to find competent analysts.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
Thanks. I would just like to point out that there are many different linux kernels. Many distros do their own customizations and patches. And there are many build targets - x86, ARM, POWER, etc. And there are kernels that are hard real-time. Which is pretty neat, and a GOOD THING (tm), even if it introduces even more complexity.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Of course, the number of high vulnerabilities of Linux is lower than all of the Microsoft OSes except those popular fan favorites, Vista and RT. Ahem... but I digress.
If you consider both high and medium vulnerabilities, OSX and Linux take the top spots, by more than a 2 to 1 margin compared to Windows. Hopefully this will incentivize OSX and Linux to look at different processes for development, testing, and deployment.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
They put a trojan horse into pirated copies of code for a bulk mailer -- then used those servers to send spam. Who's gonna notice? Who's gonna be surprised that their machine gets 'accidentally' flagged as a spam box? Who do you complain to when you figure out that your 'cracked' spam software turned out to contain a trojan?
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
but rather a reduction in price on PHP hosting due to high demand
I thought "high demand" (movement of the demand curve to the right) caused an increase in price level, not a decrease. Are you claiming that the demand curve moved so much that hosting providers were able to build in enough economies of scale that they could move the supply curve so far to the right that it more than compensates for the increased demand? Or is there some particular shitty aspect inherent to PHP that happens to push its supply curve to the right?
No you compared this MikeeUSA person to Hitler.
MikeeUSA = Hitler
anti-systems people = vegetarians
It certainly was an instance of Godwin's law in the truest sense but just saying "that's Godwin's Law" doesn't invalidate your point.
All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe
s/systems/systemd/
All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe