Forgot your password?
typodupeerror
Security The Internet Unix Linux

Malware Attack Infected 25,000 Linux/UNIX Servers 220

Posted by Soulskill
from the sudo-configure-your-stuff-properly dept.
wiredmikey writes "Security researchers from ESET have uncovered a widespread attack campaign that has infected more than 25,000 Linux and UNIX servers around the world. The servers are being hijacked by a backdoor Trojan as part of a campaign the researchers are calling 'Operation Windigo.' Once infected, victimized systems are leveraged to steal credentials, redirected web traffic to malicious sites and send as many as 35 million spam messages a day. 'Windigo has been gathering strength, largely unnoticed by the security community, for more than two and a half years and currently has 10,000 servers under its control,' said Pierre-Marc Bureau, security intelligence program manager at ESET, in a statement.

There are many misconceptions around Linux security, and attacks are not something only Windows users need to worry about. The main threats facing Linux systems aren't zero-day vulnerabilities or malware, but things such as Trojanized applications, PHP backdoors, and malicious login attempts over SSH. ESET recommends webmasters and system administrators check their systems to see if they are compromised, and has published a detailed report presenting the findings and instructions on how to remove the malicious code if it is present."
This discussion has been archived. No new comments can be posted.

Malware Attack Infected 25,000 Linux/UNIX Servers

Comments Filter:
  • by alen (225700) on Tuesday March 18, 2014 @08:08PM (#46520763)

    April fools is here early

    • From the Article (Score:5, Informative)

      by Anonymous Coward on Tuesday March 18, 2014 @08:24PM (#46520869)

      From the Article

      No vulnerabilities were exploited on the Linux servers; only stolen credentials were leveraged.
      We conclude that password-authentication on servers should be a thing of the past

      http://www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.pdf

      Nuff said.

      • by gmuslera (3436)

        Maybe those credentials were posted on github [forbes.com] by devels and then scraped from there. Or from google, there is a bunch of id_rsa that pop up with trivial searchs.

        Anyway, 25.000 linux/unix servers looks like a very low number, considering the 500.000.000 servers running apache or nginx [netcraft.com], even with multiple domain hosted in a lot of them.

        • by rtb61 (674572)

          Plus of course those servers compromised servers maintained a suspiciously low profile not doing anything naughty other than trying to compromise other servers. This really stinks of a government agency at work, setting up 'long term' espionage routes. I wonder which one?

        • Maybe those credentials were posted on github [forbes.com] by devels and then scraped from there. Or from google, there is a bunch of id_rsa that pop up with trivial searchs.

          Anyway, 25.000 linux/unix servers looks like a very low number, considering the 500.000.000 servers running apache or nginx [netcraft.com], even with multiple domain hosted in a lot of them.

          Is that "better" [zone-h.org]? That were over a million Linux servers defaced in 2010, most of them actually rooted.

      • by gweihir (88907)

        Well, with only 25k infected, these may well just be really bad passwords.
        I conclude that password authentication on servers is alive and well, as long as done right.

        • I conclude that password authentication on servers is alive and well, as long as done right.

          Depends on the service and whether it does rate-limiting of attack attempts.

          For SSH-based services? There's really no excuse not to use a password-protected SSH public key pair, and turn off password-authentication for SSH. Plus disallowing the ability for "root" to login over SSH. It raises the bar by an order of magnitude. Unless the attackers can get a copy of your private key file, and the password to de
    • by meerling (1487879) on Tuesday March 18, 2014 @08:38PM (#46520927)
      They do, no joke, and they have for many years.
      Back in the late 90s, Macs had over a 1000 viruses, linux, less than 10. (It's been a few years, I forget the exact numbers.)

      Did those infections occur a lot? No, but it did happen sometimes.
      After all, there's a huge benefit to NOT being the most common user OS. Those scum writing the malware usually want to hit as many victims as possible, and if there's an OS that has 70% or more of the desktops out there, it's pretty obvious what they will aim for.

      If you want to continue to believe marketing and fanboys, that's up to you, but don't be surprised when you get infected by some kind of malware for not taking the proper precautions because you believe in computing myths and the protective power of obscurity is magically unbeatable.

      By the way, I've done the tech support, and have seen the reality, this isn't just some random opinion. If you don't believe me, that's your problem.
      • by MikeMo (521697) on Tuesday March 18, 2014 @09:41PM (#46521253)
        You do know that the OS back then is a completely different base than OSX? That OSX is FreeBSD based and OS9 (the one back in the late 90's) was based on the original Mac OS from 1984? That there's no relationship AT ALL between the OS's? And so there is no relationship between what viruses may have occurred on Macs in the 90's and Macs of today?
        • by petsounds (593538) on Wednesday March 19, 2014 @02:28AM (#46522319)

          That there's no relationship AT ALL between the OS's?

          While OS X is based heavily on NeXTSTEP (and most developer API class names on the Mac are prefixed "NS"), I wouldn't go so far as to say there is no relationship between the "classic" Mac OS and OS X. OS X's standard filesystem is HFS+, which was released in 1998 with Mac OS 8.1, and which shares the same format as its predecessor, HFS. And decisions and limitations from those days still unfortunately put their marks on OS X. For instance, the Labels feature from Mac OS which was bolted back onto OS X (after much public outcry) are still stored in the same place on the filesystem, and in the same format (bit fields), as they were in 1988! And the new tagging feature introduced in Mavericks, for the sake of backwards compatibility with Labels, uses this same area and format [arstechnica.com] to record Tag information! And of that, only three bits are available for storing color information on HFS+. This is why Labels-cum-Tags are limited to the same seven damn colors Mac OS had when Ronald Reagan was still president of the USA.

        • Re: (Score:2, Informative)

          by Anonymous Coward

          God Damn people!

          XNU operating system is not FreeBSD based! It use parts of the FreeBSD but is not based to that!

          Parts from FreeBSD are filesystems and network stack. Everything else in XNU operating system is Mach microkernel and I/O Kit.

          The FreeBSD filesystem and network stack is just 1/5 of the XNU operating system and not even the most important part the microkernel (or as lazy would call, kernel).

          In other hand, can we call Android is Linux based? Sure. Can we call Android is Linux based OS? No. Why not?

      • They do, no joke, and they have for many years.
        Back in the late 90s, Macs had over a 1000 viruses, linux, less than 10. (It's been a few years, I forget the exact numbers.)

        Oh yea, it was awful for them. It was you purchased a Mac, learned to program and wrote virus's; or sure seemed the path of a Mac user.

        If I had to have a favorite virus it would of been the Mac Energizer Bunny, while the Bunny banged a drum, and rolled across the bottom of your screen, your hard drive was being formatted.

        One friend mentioned that one at a time the letters on his display would just fall down and into a pile at the bottom of the display.

        It wasn't the OS to run.

      • by Bert64 (520050) <bert&slashdot,firenzee,com> on Wednesday March 19, 2014 @05:14AM (#46522687) Homepage

        That's assuming the malware is targeting end user workstations... The malware discussed in this article explicitly targets servers, and linux is far from an obscure platform when it comes to servers.

        There are many other reasons than lack of desktop users why there is less malware for linux... Linux users are far less likely to be running with admin privileges, linux users have to take extra steps to execute a random binary, linux users are less likely to want to execute random binaries due to the prevalent use of repositories, linux users are generally more savvy than windows users, linux users are more likely to have updated their applications (again due to repositories)...

        Also the idea of "security through obscurity" is usually promoted by proponents of closed source, who somehow think that restricted distribution of the sourcecode will prevent people from finding exploitable holes.

  • there just isn't any. at all.
  • Who'da thunk (Score:5, Insightful)

    by sgt scrub (869860) <saintium@yahoo.cMENCKENom minus author> on Tuesday March 18, 2014 @08:17PM (#46520811)

    A weak root password and public facing root SSH access is bad?

    Managing a Linux box with a publicly facing web based interface bad?

    Installing untested web based applications released as freeware with no idea what the code does is bad?

    • A weak root password and public facing root SSH access is bad?

      Managing a Linux box with a publicly facing web based interface bad?

      Installing untested web based applications released as freeware with no idea what the code does is bad?

      The analysis in the PDF suggests that the majority of passwords used in this were not weak.

    • Re:Who'da thunk (Score:4, Interesting)

      by dbIII (701233) on Tuesday March 18, 2014 @11:30PM (#46521697)
      I found out close to ten years ago that a weak password on any account on an internet facing machine that had been modified by an idiot for his own convenience is a bad idea on a machine with ssh access (lots of "chmod 777", including in /etc, is a sign of an idiot loose on a linux system). A workaround is to make sure that ssh access is limited to only those users that actually use it.
      It's something to watch out for with IPv6 and all of us getting internet facing machines again - a firewall on the router is not enough to protect us from traffic on ports we want to pass through (unless we want to stop all incoming ssh or redirect it to the router - good in some circumstances but what if someone wants to log directly into their box while travelling?)
  • The state of Linux (Score:5, Informative)

    by cold fjord (826450) on Tuesday March 18, 2014 @08:19PM (#46520837)

    Linux is now big enough with all the Android deployments on top of the server infrastructure that there is going to be increasing amounts of effort aimed at exploits. Unfortunately there is a lot of pressure to hurry applications to market and make upgrades to the OS. That means more pressure and opportunities to create exploitable errors. Unless both the Linux community and the application developers up their game we're going to be in the era of owned Linux handhelds and boxes.

    • by Anonymous Coward on Tuesday March 18, 2014 @09:03PM (#46521063)

      I work as a consultant for several fortune 500 companies, and I think I can shed a little light on the climate of the open source community at the moment. I believe that part of the reason that open source based startups are failing left and right is not an issue of marketing as it's commonly believed but more of an issue of the underlying technology.

      I know that that's a strong statement to make, but I have evidence to back it up! At one of the major corps(5000+ employees) that I consult for, we wanted to integrate Linux into our server pool. The allure of not having to pay any restrictive licensing fees was too great to ignore. I reccomended the installation of several boxes running the new 2.4.9 kernel, and my hopes were high that it would perform up to snuff with the Windows 2k boxes which were(and still are!) doing an AMAZING job at their respective tasks of serving HTTP requests, DNS, and fileserving.

      I consider myself to be very technically inclined having programmed in VB for the last 8 years doing kernel level programming. I don't believe in C programming because contrary to popular belief, VB can go just as low level as C and the newest VB compiler generates code that's every bit as fast. I took it upon myself to configure the system from scratch and even used an optimised version of gcc 3.1 to increase the execution speed of the binaries. I integrated the 3 machines I had configured into the server pool, and I'd have to say the results were less than impressive... We all know that linux isn't even close to being ready for the desktop, but I had heard that it was supposed to perform decently as a "server" based operating system. The 3 machines all went into swap immediately, and it was obvious that they weren't going to be able to handle the load in this "enterprise" environment. After running for less than 24 hours, 2 of them had experienced kernel panics caused by Bind and Apache crashing! Granted, Apache is a volunteer based project written by weekend hackers in their spare time while Microsft's IIS has an actual professional full fledged development team devoted to it. Not to mention the fact that the Linux kernel itself lacks any support for any type of journaled filesystem, memory protection, SMP support, etc, but I thought that since Linux is based on such "old" technology that it would run with some level of stability. After several days of this type of behaviour, we decided to reinstall windows 2k on the boxes to make sure it wasn't a hardware problem that was causing things to go wrong. The machines instantly shaped up and were seamlessly reintegrated into the server pool with just one Win2K machine doing more work than all 3 of the Linux boxes.

      Needless to say, I won't be reccomending Linux/FSF to anymore of my clients. I'm dissappointed that they won't be able to leverege the free cost of Linux to their advantage, but in this case I suppose the old adage stands true that, "you get what you pay for." I would have also liked to have access to the source code of the applications that we're running on our mission critical systems; however, from the looks of it, the Microsoft "shared source" program seems to offer all of the same freedoms as the GPL.

      As things stand now, I can understand using Linux in academia to compile simple "Hello World" style programs and learn C programming, but I'm afraid that for anything more than a hobby OS, Windows 98/NT/2K are your only choices.

      thank you.

      • by Trogre (513942) on Tuesday March 18, 2014 @09:15PM (#46521121) Homepage

        Thank you for that delightful trip back to the year 2000. Tell me, did you warn them?

      • having programmed in VB for the last 8 years doing kernel level programming

        Obvious red flag showing no clue about the topic - it's just buzzword bingo throwing impressive sounding verbage around with a lack of understanding.

        If it was a fanboy they really need to lift their game if they want to avoid other fanboys laughing at them.
        If it was some "media studies" person acting as a paid social media shill then whoever paid them got ripped off.

        • Obvious red flag showing no clue about the topic - it's just buzzword bingo throwing impressive sounding verbage around with a lack of understanding.

          "VB" is impressive sounding verbiage?

          • by dbIII (701233)
            No it's the red flag - the remainder of the buzzword bingo is the bit I was referring to.
      • by richlv (778496)

        it might take some recent history knowledge and whatnot, but this is a really great troll post. some sentences are pure fun on their own :)

      • by pcjunky (517872)

        My experience has been the exact opposite. We started way back in the day with all Windoz servers. These were a constant source of headache. They would crash and need reboots weekly. Sometimes things would fail for no apparent reason without any means of fixing them short of reinstalling Windows. We started installing a few Linux servers for radius, DNS, HTTP. These didn't fail and one by one we replaced the Windoz boxes with Linux boxes.

        Life is much better now and I spent very little time with server maint

    • by cbhacking (979169)

      The truly typical Linux installations - that is, the ones found in TVs, set-top boxes, cable modems, routers, "smart" appliances, and so on - are configured extremely insecurely. There are typically remote management backdoors and such, but even if there aren't, the systems usually use horribly outdated software, have exposed (vulnerable) servers, and run everything as root. Serious exploit mitigations like SELinux are almost unheard-of.

      Linux servers, assuming a competent admin, are generally very secure. O

      • by dbIII (701233)
        It's very disappointing since really secure little routers on ulinux led the way for these things.
      • by Lumpy (12016)

        Mostly because they are made by companies that do not hire engineers for thier OS but use one of the janitors or an IT guy that knows linux.

        NEC Tv's you can easily get into Root from the serial port if you are fast enough when the TV boots. from there it's trivial to have some fun.

    • by Anonymous Coward on Tuesday March 18, 2014 @09:42PM (#46521259)

      Except if you had read the report, you would realize that this is not about a security exploit, this is about stolen administrative credentials. No one is using new vulnerabilities in the Linux operating system. This is malware that works on *nix specifically, but what it ends up doing is not *nix specific - it simply steals passwords and uses them to manually propagate the infection.

      In the end, the blame lies with server administrators running networks porous enough to be infected at deployment time, and who are not using two-factor auth to guard the keys to the castle. This isn't about the "Linux community" so much as it is about organizations and their admin practices.

      • by fnj (64210)

        This is nitpicking, but if your admin credentials get stolen, somebody is exploting a security weakness. Not a design weakness, maybe, but an operating weakness. It's still a security weakness.

      • by Lumpy (12016)

        There you go bring in truth and reality into the whole FUD story.

        This is Wednesday, we are all supposed to wave our arms in the air and scream how insecure linux is and Windows is the future.
        Tomorrow is dog on QNX day, bring your own lunch.

  • http://www.eset.com/us/downloa... [eset.com] So buy our software to stay safe!
  • There is not a single OS that is not vulnerable to a trojan. If this was a virus, drive-by download, or infection of a repository, then that would be disconcerting, but there will always be people who fall for trojans and the OS they use has little to do with it.
  • by MouseTheLuckyDog (2752443) on Tuesday March 18, 2014 @08:55PM (#46521019)

    The best locks in world, which Linux does come with, do not help if the door is left unlocked.
    Microsoft OTOH has no doors.

    The biggest threat to linux in the last five years has not been the architecture of linux, but the willingness of programmers, in particular weak programmers from the WIndows world coming over and applying the same philiosophies to linux development.

  • by whoever57 (658626) on Tuesday March 18, 2014 @09:43PM (#46521271) Journal
    The report only mentions in passing how the servers are compromised, which is that the operators of the botnet use credentials that have already been stolen to "infect" new machines. I personally think it likely that brute force attacks against ssh passwords are also used.

    The summary states:

    The servers are being hijacked by a backdoor Trojan

    but I think this is an inaccurate summary since the Trojan is being installed on machines where the attackers already have root credentials.

    Perhaps some unknown vulnerability is also being used to gain root access, but the report does not claim this.

  • by pla (258480) on Tuesday March 18, 2014 @09:47PM (#46521291) Journal
    I have (grudgingly) admin'ed such a server, and will readily admit it as a form of public shaming (though not of myself, as you'll soon learn).

    As TFS points out, the attackers didn't use a zero-day exploit. They didn't use an unpatched old exploit. They didn't even use the fact that huge "trusted" swaths of the filesystem, including standard executable paths (such as /usr/local/bin) had both the directory and everything contained within world-writable (no, I didn't have the option of fixing that - it would have broken "features" of the reason this box existed, as I'll soon explain).

    This system ran a fairly popular POS software suite, and absolutely depended on all its serious security flaws. The vendor had even installed what amount to pre-compromised binaries for "convenience" in diagnosing end-user problems (connect to the right port, bam, you can monitor any user's session). But even that egregious level of incompetence didn't cause the breach.

    No, the breach came from the fact that the vendor had their own company name as the root password (and had it hard-coded in literally dozens of (world-readable) scripts, so I couldn't just change it). And did I mention, the vendor required this box have a publicly facing IP or they'd refuse to honor their SLA?

    Needless to say, my first action on learning all this, I blocked it at the firewall and told the vendor that we'd let them in when, and only when, we needed assistance. That, amazingly, enough kept the box safe for about a year (and floored me that we hadn't gone down long before I got stuck with that albatross)...

    Until an upgrade. Took a total of half an hour. Didn't matter, because we had someone in as root in a tenth that time.


    But, distant past. Couldn't happen again, and no other vendor would ever have such an extreme level of cluelessness, right?

    So, currently, I work with (but thank Zeus, don't have to administer) a CRM system by an entirely different vendor, running on an outdated Linux distro. Pretty much everything I just said applies to this box. But hey the firewall keeps it safe, except the once-a-year the vendor demands access to audit our license compliance...


    So yeah, Linux systems get hacked - For reasons that wouldn't protect the otherwise-most-secure system on the planet. You want to make it stop? Tell your vendors to go fuck themselves when they rationalize having a weak root password, and piss-poor system-wide security, and ban patching known vulnerabilities because it "might" break something the vendor used. Really that simple.
    • by dbIII (701233)

      No, the breach came from the fact that the vendor had their own company name as the root password

      I saw that one a few years back but that had Win2k under their POS system and it was dialup connectivity (literally phoning home), which at least reduced the attack surface a bit. Management was incredibly disfunctional, knew about the problem, and were sick of IT consultants telling them it was a bad idea. It was a wakeup call for me that for anything you can say about management problems in government there'

    • by whois (27479)

      So, currently, I work with (but thank Zeus, don't have to administer) a CRM system by an entirely different vendor, running on an outdated Linux distro. Pretty much everything I just said applies to this box. But hey the firewall keeps it safe, except the once-a-year the vendor demands access to audit our license compliance...

      You should set it up so their only ingress is through a reverse ssh tunnel outward. Preferably secured with a key you send to them so their reused passwords aren't the only thing keeping people out. You should also restrict it by IP range to whatever machine they're coming from.

      If the vendor refused any of my security stipulations for their audit I'd invite them to come to me and do the audit onsite. Of course they might threaten to shutdown your CRM but then you can always sue for breach, or better yet

      • by pla (258480)
        You should set it up so their only ingress is through a reverse ssh tunnel outward. Preferably secured with a key you send to them so their reused passwords aren't the only thing keeping people out. You should also restrict it by IP range to whatever machine they're coming from.

        I like to think I would do better today than I did back then - My primary role involves coding, not network hardening. I just tend to get ownership of Linux boxes because, surprisingly, not many folks in the business world (even
    • by richlv (778496)

      um, vendor names ?

    • Vendor name, please? You are not doing anyone any favors by not mentioning who they are.

  • by Areyoukiddingme (1289470) on Tuesday March 18, 2014 @10:00PM (#46521343)

    So is it 10,000 or 25,000? I can't be arsed to read the article, because as another poster succinctly observed "oh no, thousands of infected unpatched Wordpress installations", but it sounds like the ESET people trying to make a quick buck off of some FUD can't even get their FUD straight. As if tripwire hasn't been available for a couple of decades...

The sooner you fall behind, the more time you have to catch up.

Working...