Slashdot Mirror
Unnoticed For Years, Malware Turned Linux Servers Into Spamming Machines
An anonymous reader writes: For over 5 years, and perhaps even longer, servers around the world running Linux and FreeBSD operating systems have been targeted by an individual or group that compromised them via a backdoor Trojan, then made them send out spam, ESET researchers have found. What's more, it seems that the spammers are connected with a software company called Yellsoft, which sells DirectMailer, a "system for automated e-mail distribution" that allows users to send out anonymous email in bulk.
Here's the white paper in which the researchers explain the exploit.
Would you like some cheese with your whine?
So Windoze, Linux, BSD have all been compromised ... how about Hurd / Plan-9? Have they been compromized?
Muchas Gracias, Señor Edward Snowden !
This isn't as interesting as it sounds (or have i misunderstood?) Basically, if you are a spammer, and download binaries of 'cracked' spamming software... surprise surprise, there is a back door in it that lets other spammers use your servers to spam. It is kinda interesting from a technical point of view (putting perl scripts into elf binaries) but the headline is very misleading, this is not a serious linux/bsd security issue.
"Perl code packed inside ELF binary .. The Perl spammer .. The spamming daemon is also written in Perl and packed inside an ELF binary"
OK. how exactly is this Mumblehard malware loaded and executed on the server,without user action and without the user running as root?
Via greed driving user interaction in the hope of a "free lunch". From the article:
So it's a parasite feeding on cheapskate spammers. I'm not sure whether to get annoyed with them or give them a medal.
These PEBKAC exploits happen more often than you might think on Linux
And removing the "text extending babbel":
1.) Don't get a pirated copy of "DirectMailer" - because it's infected and will trojanise your server.
2.) keep your server and especially it's services updated - check your Joomla and Wordpress installation - and additionally to that the themes you installed.
- the white paper says that the researchers think that these were the most likely vectors
- the article puts faith on the thoughts of the researchers
Translation:
The infected server were so extremely outdated that the researchers didn't know where to start to search. Some believe to have seen active kernel versions dating back to 2000 and even further and surrendered the computers to archeologists to study ancient server setups.
3.) an antivirus on freebsd or linux system is pratically useless in detecting recent malware - they need at least 5 yrs. of cultivation
On windows the infection base is much greater. However the idea of "quarantining" software of problematic origin for a certain period of time and early virustotalling it, should be considered.
lesson: no cracked software on linux/freebsd system
They are usually quickly fixed but not quickly updated by end users. That's the problem with all OSes. The advantage of OSS is that you have the option of fixing it yourself if the software creator doesn't.
WTF?
Decent people don't want to be associated with people like MikeeUSA, the fact that the anti-systemd people seem happy to associate with him isn't going to help their cause.
What about this one: "decent people don't want to be associated with people like Hitler, the fact that the vegetarian people seem happy to associate with him isn't going to help their cause."
See what I did there? (no, that doesn't qualify as Godwin, not yet)
I'm one of these anti-systemd people, and I don't want to be associated in anyway with a troll like MikeeUSA. He's behavior has nothing to do with accepting or not systemd and trying to make some kind of true-scotman-non-sequitur-bullshit out of it is utter non-sense.
You certainly didn't wait long enough to read the article before posting.
Yes, you're right, anti-systemd people are not all insane, but some of the most vocal of them are.
(And it's not just good old "I want to marry 12 year old girls" MikeeUSA, there are also the "systemd will eat your ouput" loons, the "systemd is an NSA plot" obsessives, the "systemd is an end run around the GPL" tin-foil hatters...)
Watch this Heartland Institute video
This "article" is beyond retarded.
this malware is pretty unix-y about the way it does things. its small, does few things and does them efficiently.
The author should be complemented on his adherence to the unix philosophy. Even his social engineering campaign is that way.
Functionality wise, an equal malware executable on windows would be megabytes in size and be installed as a service :D
"Second, if you don't know how to detect this, you shouldn't be running servers."
How's about a real answer or at least a link to a resource to help someone learn what they need to know rather than acting high and mighty?
That's always been one of the bigger problems facing linux adoption. :P
Cheese is a GNOME application and runs natively , no need for a Windows compatibility layer.
Read the article? What madness is this?
I haven't read it either and I'll still agree with MobileTatsu-NJG here: the huge benefit with OSS that people keep talking about is that thousand of people looking at the source code are able to find bugs, trojans and backdoors. And this particular problem is over five years old, too.
Get free satoshi (Bitcoin) and Dogecoins
Yeah, I can't wait to hear how this is spun I to a tale of how great OSS is.
Wait no more!
The article states that the analysts have identified 8,867 infected IP addresses. In April 2014, Netcraft confirmed that there were roughly 958,919,789 sites on the web at that time. Independently of them, W3Techs state that nearly 68% of servers are running some form of Unix, and the vast majority of those can be safely assumed to be running Linux.
So let's say, then, that better than half a billion sites are potentially vulnerable to this exploit, but in practical terms, over the course of years, a mere 8,867 of them actually were infected by this exploit. That means that, uh... carry the 9... somewhere around, oh... 0.0017734% of all vulnerable Linux sites have been compromised by a hitherto unknown and unmitigated active exploit.
Clearly this debacle is indisputable proof that Linux security is a shambolic, shameful charade that needs to be stopped before the world collapses into chaos.
Crumb's Corollary: Never bring a knife to a bun fight.
"\u201cconservative\u201d"
"doesn\u2019t"
"I\u2019m"
Looks like systemd already wrecked your shit. Your punctuation doesn't even fucking work!
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
There is no source code available to look at in this case. The article is very short and you could have read most of it in the time it took you to post the above irrelevant post, but as it is you are not even aware it's so irrelevant that it looks very silly in context.
Read TFA. The flaw isn't in the OSS.
You are right. The flaw is in the OSS-users who think that OSS magically makes them secure from Trojans.
Of course news about a fake are Fake News.
However, that doesn't change the reality that the "many eyes" claim is a myth,
What? No, no it is not. The fact is that many bugs and vulnerabilities are found because of "many eyes", while we have to wait for either a vendor or a malicious attacker to find and announce vulnerabilities in closed-source software. Nobody credible ever claimed that "many eyes" makes FOSS invulnerable to bugs, back doors, etc. The claim is that it makes it less vulnerable, through better practice. Now, if you can provide a citation that shows this is false, I'll show you a paper full of lies — because a comparison is impossible, because the code we most care about isn't available for analysis and comparison. Without the code for the massive and common operating systems and packages which users commonly run, you can't actually make a meaningful comparison.
So, since we can't prove the claim either way, but we certainly have plenty of evidence that it does work that way since many eyes do in fact often find flaws through code analysis of FOSS but those many eyes do not find flaws in code analysis of closed-source software due to lack of availability. Therefore, the onus of proof is on you — if you want to show that something behaves counterintuitively, you're going to have to prove it.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Sure it's a myth. There are bugs in open source products that have been sitting there out in the open for YEARS without anyone recognizing them until they're exploited. Shellshock and Hearbleed (OpenSSL library - you can't get much more critical than that) prove once again that the "many eyes" that are not bothering to look because they all have something else to do (like scratching their own itch) proves that you also have to wait for a malicious attacker to find the vulnerabilities before they're fixed.
It's simply not a "better practice" - just different - and the myth leaves people open to exercising less caution out of an erroneous feeling that someone out there is going over the code to fix it just because it's open source. We all know that debugging and fixing code is a lot less attractive to people than writing new code, and that's simply not going to change, because it's human nature. Most programmers simply do not like to do code maintenance, which is why proprietary software with revenue streams have both an incentive and the means to PAY people to do the maintenance.
Which I guess is why the Windows kernel is now more secure than either the Linux or BSD kernels. So, citation provided :-)
Am I happy about it? No, but that's the reality of it, and denying it is being willfully negligent.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
PHP, and that means your security is dead right there
In theory, it should be possible to adopt good coding practices that leave out all the bad parts of PHP, in much the same way that Douglas Crockford recommends for JavaScript in his book JavaScript: The Good Parts. If you think the PHP interpreter inherently has poor security despite good coding practices, have you tried notifying the operators of Wikipedia?