Doorways Sneak To Non-Default Ports of Hacked Servers 63
UnmaskParasites writes "To drive traffic to their online stores, software pirates hack reputable legitimate websites injecting hidden spammy links and creating doorway pages. Google's search results are seriously poisoned by such doorways. Negligence of webmasters of compromised sites makes this scheme viable — doorways remain unnoticed for years. Not so long ago, hackers began to re-configure Apache on compromised servers to make them serve doorway pages off of non-default ports, still taking advantage of using established domain names."
Re: (Score:2)
Oh, and in between those two are The Doors...
Re: (Score:2, Informative)
Maybe it has something to do with the submitter's name being "UnmaskParasites" and the URL of the article being http://blog.unmaskparasites.com/2010/12/03/doorways-on-non-default-ports-new-trend-in-black-hat-seo/.
If the author of the article did indeed just submit it here in some petty attempt to get traffic, he or she probably wouldn't have known what was unclear with the article.
Had some neutral party submitted this, this submitter may have had to also look up these non-standard terms, and may have had th
Re: (Score:3)
Or maybe the submitted hacked into an Apache server, put up this navel-gazing article and submitted via a non-default port to Timothy's queue.
o_O
Or maybe Slashdot is turning into a keyword spam infested link dump, like Digg and Reddit and the rest of the goddamned web. I miss the days when we featured cool nerdy projects, and Ask Slashdot required an IQ of at least 120 to even understand the question. This place has gone to the dogs.
Re: (Score:1)
This place has indeed gone to the dogs, but revealing modern hacker techniques one should watch out for is part of the reason I keep coming here. I just don't know how I'm going to tell my folks and other non-techie associates that there's something called port numbers that they should also find some way to add to what they try to pay attention to.
Re: (Score:3)
Uh, no, ideally you shouldn't allow the web server to rewrite its own config.
If it can do that, it's either already running as root, or, duh, its config files can be rewritten so it, from then on, runs as root. Which means the attacker is now running as root either way.
Frankly, half the time it'd be easier to detect extra ports than extra files. A lot of people have either gui interfaces to their http config, at which point an extra server on a weird port showing up would be noticeable, or have a script t
Re: (Score:2)
Are you responding to the same comment I see? Where does "running in a dmz" == "running as root"? Your points about it being bad for web servers to rewrite their own config are fine and dandy...but I'm hard pressed to see how they have anything to do with a dmz....
Re: (Score:2)
Yes, I am responding to you.
You seem to think the way to stop this problem is to stop one single way that a hijacker of a web server is using to attack other people.
They still have other ways to attack people. (Like rewriting the actual files of the site.) And, more importantly, they're still in control of a server!
Like I said somewhere else, this article is 'Assassins who break into people's houses are now shooting people out the window, instead of just the door', which is a moderately useful thing to k
Re: (Score:1)
...and Ask Slashdot required an IQ of at least 120 to even understand the question.
Can you point to even ONE study that links IQ and nerdiness / geekiness? Unapplied Intelligence is fungible, and any community that adopts memes like "hot grits!" or "first post!", while clearly nerdy, does not seem to be demarcated by any substantial intellect requirement.
(Oh, and the English language is organic instead of prescribed. "Ain't" is a word, "ATM Machine" isn't really a tautology, and "hacker" means someone who engages in "hacking", or the illegal access of computer systems through use of te
Re: (Score:2, Insightful)
Also, you'd think that timothy could lay off the huffing paint fumes and eating crayons for a moment, and maybe avoid using the word "hackers" in the pejorative sense on a site where many view themselves as hackers in the real sense. But no, he manages to embarrass himself once again.
Go and get yourself cleaned up, timothy, and try again.
Re: (Score:2, Flamebait)
Welcome to Slashdot; now go home (Score:2)
aw diddums did i hurt your feelings (Score:2)
Re: (Score:2)
I was at one point thirdline for the uks x.400 mail system
It's quite possible I used to be your boss.
Re: (Score:2)
I love people who still try to claim that the word hacking is not intrinsically linked to security. To claim the common usage of the word is an error, and all those dictionaries and reporters and millions of people are WRONG WRONG WRONG!
Did you know that the word starve used to mean dying specifically from cold? That's what the word means truly, and everyone else is just using it wrong. The next time you see people who look like they could use a meal and say they are starving, just offer them a sweater. I m
Re: (Score:2)
Wow APK, you sure take stuff personally.
Are we finally using the term "pirates" correctly? (Score:3)
Re:Are we finally using the term "pirates" correct (Score:5, Funny)
Ob-1999: I think you misspelt "cracker [slashdot.org]."
Re: (Score:1)
Racist!
Re: (Score:1)
Re: (Score:2)
Are we finally using the term "pirates" correctly?
Correctly? You think there's a "the" correct usage? I hate to tell you this, but words in English can, and frequently do have more than one meaning; and there usually isn't just one you can point to and say "this is the correct meaning." In this particular case, the 1913 public domain version of Webster's that is widely distributed on the Internet includes the infringement definition for "pirate", so that use is at least a century old, making it more legit than, say, the term "sky pirate".
If you want to
Re: (Score:2)
the 1913 public domain version of Webster's that is widely distributed on the Internet includes the infringement definition for "pirate"
Wow, you are right! You can even look back further than that [uchicago.edu] and see that even the 1828 version contained "To take by theft or without right or permission, as books or writings".
I have never understood why the term generates such a massive response here. All language is fluid. Even if the definition wasn't in these old dictionaries, it is in the modern ones because that is the term that people use for the act. Just live with it, I say.
Re: (Score:2)
The word "liberators" assumes that what is being liberated wants to escape. Whether you are copying games, music, films or books, none of these things actually desires to be liberated. Instead, the pirate wants to use the product without paying for it, so they just take it. It is a completely selfish act, and a label with a negative tone is quite apt.
I'm not going to go all Marge Simpson here and say "don't do that". All I ask is that the pirates don't try and sugar coat what they do as something noble.
Firewall (Score:3)
Would blocking unusual portnumbers in the firewall be a solution?
Re: (Score:3)
Er, yeah - any decent hosting setup should have all unused ports firewalled off, hopefully on a separate device.
Again, poor configuration is the target, not any weakness in the actual technology.
Re: (Score:1)
A solution would be an admin who friggin sets permissions on their apache config and checks the logs.
Re: (Score:1)
Taking security seriously would be the solution.
The chances are the intruders have root privileges (since they can re-configure Apache). So they can unblock any ports as easily.
So if admins don't watch their servers, they won't even know that something's wrong.
Re: (Score:2)
Having root privileges on the web server isn't the same as having access to configure the firewall, assuming the firewall is a separate device and you're not simply relying on a software firewall on the web server itself. But yeah, if they can reconfigure Apache, you're already in trouble.
Re: (Score:3)
Technically, apache's config file permissions could be set so the apache user could reconfigure them without root privs, so the attacker might not have root...to start with.
Of course, if they can reconfigure apache as a normal user, they can configure it to, tada, run as root, which neatly solves the whole 'not having root' problem.
I'm a little amazed that attackers are reconfiguring apache instead of coming up with some rootkity http server of their own.
Re:Firewall (Score:4, Interesting)
No need to access or change the normal Apache config.
Usually they just spawn a new apache process as the hacked user with something like apache2 -d /tmp/haxorsite -c "listen 13675" ...
Suffice to gain user shell access and inject some content te serve.
Thats why any decent hosting provider uses some front end servers, eventually with mod_security, so the back-end cluster has very restricted network setup only able to talk to the front servers.
Re: (Score:2)
Thats why any decent hosting provider uses some front end servers, eventually with mod_security, so the back-end cluster has very restricted network setup only able to talk to the front servers.
Or maybe they should use IIS7 instead of Apache, more secure :).
Re: (Score:1)
Interesting point.
Still makes no excuse why admins leave open ports and don't notice malicious activity on their servers for months
Re: (Score:2)
Usually they just spawn a new apache process as the hacked user with something like apache2 -d /tmp/haxorsite -c "listen 13675" ...
Well that's just stupid not to notice. I thought we were talking about something in the apache config, where you'd have to notice either the port being open or config files.
That's not really anything to do with apache at all. They could run netcat from a shell script or something with that.
Thats why any decent hosting provider uses some front end servers, eventually with mo
Here's an example break-in. (Score:5, Informative)
Here's a typical break-in, at University of Oakland. [oakland.edu]. This has a good search position in Google for "64 bit Windows". This leads to a software-for-sale page with phony seals of approval from Microsoft, Verisign, etc. That's hosted at Starnet, in Moldovia. The payment site for the sales site is "payment8ltd.net", also hosted on Starnet in Moldovia. They're selling pirated copies of brand-name software at roughly half retail price.
That site has a TrustWave seal, which pops up a popup for Paym8, a real payment processor in Zaire. TrustWave's seal server doesn't check the referrer when displaying a seal popup, so it can be spoofed. [trustwave.com] Nor does the TrustWave seal even give the domains to which it applies. Verisign and BBBonline check this, but not TrustWave.
It looks like the actual payment processing occurs at "https://payment8ltd.net/shop/order/process/"; that's where the order goes on "Submit". The site has one of those worthless GoDaddy "Domain control only validated" SSL certs.
Starnet presents itself as an Internet and telecom service provider, offering the usual data, voice, colocation, and hosting. Headquarters of Starnet seems to be at Vlaicu Parcalab, 63, Chisinau, Republic of Moldova. That's a property of Flexi Offices [flexioffices.com], one of those small-office rental places. Interestingly, Microsoft also has an office in that building.
There's actual Whois information for that site:
Registrant Contact: Viktor Menshikov
Viktor Menshikov (loyal@yourisp.ru)
ul.V.Urdasha d.36 kv.1
Rakovo, Respublika Tatarstan, RU 422455
P: +7.8435122221 F: +7.8435122221
That location exists; it's a farm town about 500Km east of Moscow. Probably not a real address.
Searching for "yourisp.ru" brings up a large number of scam reports. The domain itself is registered but not in DNS.
Most of this recent batch of attacks seem to have similar underlying information.
Re: (Score:3)
This is exactly the crap that Microsoft's genuine advantage is designed to stop. Small-scale personal piracy is one thing, but I fully support efforts to squash unctuous commercial enterprises like this one.
Re: (Score:1)
Go easier on stuff you are smoking. f..king WGA is designed to spy on end users and to increase profits.
Re: (Score:1)
The Whois information is forged. They just use a database of stolen contact details and use them to register domain names.
Note how registration times of their many domains differ only by seconds.
Not a lot of sympathy (Score:2)
Re: (Score:2)
Pssst. Email.
Yes, you're right, but if someone can change web server config files, they're root. (Or will soon be.)
So any firewall on the machine is easy to disable.
Granted, you could use an external firewall, but at this point you're boarding up windows so that the assassins who are wandering in and out of your house can only shoot out the doorway to kill people. That is not an actual solution to the actual problem you have, which is 'there are assassins wandering around inside your house trying to kil
Re: (Score:1)
Re: (Score:2)
No, having an external firewall is not a solution to the problem that attackers are running programs as root on your server.(1)
Neither is stopping them from doing one particular thing, like opening another port.
1) As someone else mentioned, they might not be running as root, just launching apache with a new config file...at which point iptables would work fine stopping them from opening additional ports.
This seems easy to fix on the Google side (Score:2)
If the page-rank algorithm is currently automatically counting different web servers at the same address but on a different port as the same site, stop that.
Re: (Score:1)
Re: (Score:2)
Why should people like myself, who have a legitimate reason for services on different ports, be punished because others lack the skills to properly secure their networks? Are you suggesting that I should have to proxy all of my services through apache even when their is no benefit to doing so? This isn't a problem that will be fixed from the top down I'm afraid.
You're misunderstanding. Alternate ports shouldn't be inherently penalized. They just shouldn't get a pagerank bump by being on the same hostname as something else. If your content is legit, there really shouldn't be any worry.
Re: (Score:2)
They just shouldn't get a pagerank bump by being on the same hostname as something else.
Why not? If google thinks that's a useful way to treat pages, that's fine.
If this is 'fixed', attacks will just go back to hosting files in hidden directories. The 'alternate ports' aspect of this isn't the problem, it's the fact that people don't locate malicious files they are hosting.
Re: (Score:2)
Why would Google do anything about this? Are the sites involved using Google Ad Words? Sure they are. Google is supporting this.
How do I check this on a hosted server? (Score:1)
I host sites on a reseller account. What's a good way to check up on this and make sure my hosted sites are OK? I'm not going to go check every link in every site and compare that to every file on the servers for each site. There has to be an easier way.
Re:How do I check this on a hosted server? (Score:4, Informative)
FTP down the entire contents of your site, and see if anything seems wrong. Directories you don't remember with frame pages, stuff like that.
If you have a CMS like Joomla or Drupal, download a clean copy of the same version, extract it somewhere, and run something like WinMerge on the entire two directories. See what's different...should only be stuff you've installed, like themes and components, unless you've done some manual hacking.
Likewise, if it's just 'your site', if you're the only editor, and you upload it using FTP...download it to a different directory, and run WinMerge to compare. They obviously should be identical.
Downloading via FTP will also run a virus scan on it if you have real-time scanning, although feel free to also do that manually.
Incidentally, that won't do anything for this problem. If they've hacked your hoster to put extra web sites up on your domain on other ports, it's unlikely you'll be able to notice this, and they certainly won't be in your directories. But doing that requires root access, and this article is idiotic...if attackers have root on your server, the fact they can add extra http servers is the least of your problems.
Checking all the files helps for the more common attack of them putting up a directory on your site, and sticking malicious stuff in there, or including javascript files that pull in malicious stuff from elsewhere.
Also, checking every link won't help.You don't have to have a link to that stuff for it to get into Google.