Slashdot Mirror
Researchers Help Shut Down Spam Botnet That Enslaved 4,000 Linux Machines (arstechnica.com)
An anonymous reader shares an article on Ars Technica: A botnet that enslaved about 4,000 Linux computers and caused them to blast the Internet with spam for more than a year has finally been shut down. Sophisticated Mumblehard spamming malware flew under the radar for five years. Known as Mumblehard, the botnet was the product of highly skilled developers. It used a custom "packer" to conceal the Perl-based source code that made it run, a backdoor that gave attackers persistent access, and a mail daemon that was able to send large volumes of spam. Command servers that coordinated the compromised machines' operations could also send messages to Spamhaus requesting the delisting of any Mumblehard-based IP addresses that sneaked into the real-time composite blocking list, or CBL, maintained by the anti-spam service. "There was a script automatically monitoring the CBL for the IP addresses of all the spam-bots," researchers from security firm Eset wrote in a blog post published Thursday. "If one was found to be blacklisted, this script requested the delisting of the IP address. Such requests are protected with a CAPTCHA to avoid automation, but OCR (or an external service if OCR didn't work) was used to break the protection."
In the year of our lord 2016 I can't believe this shit is still going on. Its been a few yrs since I checked in. Everything in the firehose was spam a few times, and the one article I did promote drew some flak. *sigh* wonderful.
C|N>K
How exactly did Mumblehard initially infect the Linux and BSD systems?
It used a custom "packer" to conceal the Perl-based source code that made it run...
I think writing it in Perl provides sufficient obfuscation all by itself.
Nah, even Gnu-Linux isn't impervious to apt-get install-malware. Especially when the dependency library is something like elm-send-spam. No amount of "My OS is better than your OS" will insulate people from stupid practices. Plus, there are a lot of application level exploits. In fact, most exploits these days - for any OS - are application layer. Whether it is flash or java on the client or wordpress or something else on the server - between application and poor admin practices (the nut behind the wheel or the pebkac problem) it won't matter what OS you run. You can be owned regardless.
The Eset researchers still aren't certain how Mumblehard is installed. Based on their analysis of the infected server, they suspect the malware may take hold by exploiting vulnerabilities in the Joomla and WordPress content management systems. Their other theory is that the infections are the result of installing pirated versions of the DirecMailer program.
Look for cron jobs executing code from /var/tmp.
They did such a beautiful and informative report(PDF) it's a damn shame not to read it.
Most mainstream distros have some sort of built-in defense against this kind of attack, such as SELinux or AppArmor. Of course, that only works if the Sysadmin has enough sense to let them do their job instead of disabling them to prevent problems that were solved over a decade ago.
Good, inexpensive web hosting
>"There was a script automatically monitoring the CBL for the IP addresses of all the spam-bots, If one was found to be blacklisted, this script requested the delisting of the IP address"
Oooh, that is really clever/evil. And that went on for years and Spamhaus never discovered they were getting automated requests? I would think that would be pretty easy to detect if they get ANOTHER report of spam coming from the same machine and ANOTHER delisting request...
Absolutely I agree with this -- and would like to add, firewalling outbound connects as well as the inbound
C|N>K
which distro was mostly effected, forensics should be able to figure that out and then some more snooping find the culprets, if they are developers that contribute to Linux then they need to be found out and blacklisted and removed and maybe send a goon squad to go break their knees and fingers
Politics is Treachery, Religion is Brainwashing
A botnet that enslaved about 4,000 Linux computers and caused them to blast the Internet with spam for more than a year has finally been shut down.
Martin Luther Mainframe: "Set my brethren free!"
1. Look at the number of infections. A bit lower than typical Windows malware.
2. An idiot sysadmin can make Linux just as vulnerable as Windows. Linux with a competent sysadmin is in a completely different class than Windows.
But haters will hate, no matter the actual facts.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I think that if you spend this much time developing software that uses other peoples' machines to send spam, further wasting even more peoples' time for fractions of a cent per message sent, you clearly deserve death, as the sum of your life's work is a negative.
We as society should send killers after these people. If they are witnessed operating the command servers, just execute them on the spot, I don't want to hear about it any further after that.
it's a very useful forum for Windows and Linux users.
Oh, puh-leez. Getting developers to learn to play nicely with SELinux is a chronic release repair task that has been far more expensive than losing an occassional spambot, especially if you block port 25 and port 587 outbound to go only to your designated local email server.
When SELinux breaks a release, I get screamed at. When spam gets out to somebody somewhere else, I can pretty safely ignore it and still get paid.
Now why am I not shocked these two pieces of spaghetti code were used as an attack vector? It's always important to lock down and isolate each /vhost/ but these who really exemplify why that is so important. Specially WordPress has been one huge security disaster after another.
9/11: Never forget it was a false-flag operation
Everything I know about selinux, I learned from selinux. Don't blame sysadmins for not wanting to play a never-ending game of whack-a-mole with it. "But it's works now, we promise" - Yeah, I've been hearing that for about 10 years.
I've been using SELinux for years, and I can't remember the last time I had an alert that wasn't caused by some badly-written program trying to do something it had no business doing. For that matter, it's been the best part of a year since I've had an alert. If you don't want to use it, that's up to you, but I'm happy to have it.
Good, inexpensive web hosting
Loonix is impervious to such things! Teh Open Sores was created by messiah Loonix Toreballs; and as a god, things with his name nevar have problems!
Ah! the troll is strong with this one. These aren't the Linux's you are looking for, move along.
There ain't no such thing as proprietary standards only proprietary formats. Standards are by definition open.
Faggot.