Ongoing malware attack targeting Apache hijacks 20,000 sites

Re:Ongoing malware attack targeting Apache hijacks 20,000 sites by duskwuff on Tuesday April 02, 2013 @12:02PM (#5480118)

Given that it's supposedly also installing a trojaned version of SSH(d?), it's probably not an Apache exploit at all. It's some other sort of method which gives it root access - either an exploit or just guessing root passwords. :)

[ Parent | on HN ]

Re:Ongoing malware attack targeting Apache hijacks 20,000 sites by afreak on Tuesday April 02, 2013 @12:27PM (#5480286)

If I had to guess, it might be related to this: http://www.cloudlinux.com/blog/clnews/sshd-exploit.php

The details on that page are weak and there are all sorts of problems with the content in general (namely asking users to run a script blindly), but it seems to mimic what is described.

[ Parent | on HN ]

Re:Ongoing malware attack targeting Apache hijacks 20,000 sites by devicenull on Tuesday April 02, 2013 @02:20PM (#5481123)

It's very disappointing that they didn't bother to update that news article. The actual source of that "exploit" was compromised admin machines. Everyone that kept having their servers hacked was found to have a rootkit on their local machine. I would not be surprised if this new "exploit" was the same thing.

[ Parent | on HN ]

Re:Ongoing malware attack targeting Apache hijacks 20,000 sites by betterunix on Tuesday April 02, 2013 @12:05PM (#5480133)

Or maybe there are still a lot of people out there who are running Apache as root.

[ Parent | on HN ]

Re:Ongoing malware attack targeting Apache hijacks 20,000 sites by atesti on Tuesday April 02, 2013 @12:09PM (#5480152)

I guess it wouldn't be too hard to gain root access once code runs on the server: There are plenty of local privilege attacks in the Linux Kernel and not everybody updates and reboots regularly

[ Parent | on HN ]

Re:Ongoing malware attack targeting Apache hijacks 20,000 sites by antihero on Tuesday April 02, 2013 @12:25PM (#5480262)

By plenty you mean "plenty if you accumulate all the legacy kernel versions", right?

[ Parent | on HN ]

Re:Ongoing malware attack targeting Apache hijacks 20,000 sites by atesti on Tuesday April 02, 2013 @02:30PM (#5481210)

Yes, of course. But for Linux kernels, for every new release for the few maintained stable kernels, they always tell you it's better to update without giving specific details if there are vulnerabilities and who is affected. I personally don't bother to upgrade all the time with minor versions (at least on the systems where the kernel is not from the distribution). Therefore, running something not as root is good, but I should still be afraid of any exploit!

[ Parent | on HN ]

Re:Ongoing malware attack targeting Apache hijacks 20,000 sites by betterunix on Tuesday April 02, 2013 @12:43PM (#5480421)

That does matter in the real world, since people routinely fail to update, or are unwilling to update because they cannot afford the minute or two of downtime required to reboot their servers. I know one guy who works with Solaris systems from the mid-90s that cannot be upgraded to anything more recent for various (non-technical) reasons.

If security did not have a human element, these problems would have been solved long ago.

[ Parent | on HN ]

Re:Ongoing malware attack targeting Apache hijacks 20,000 sites by brokenparser on Tuesday April 02, 2013 @02:36PM (#5481246)

The problems already have been solved long ago, it's just a matter of cost. Ksplice can update the kernel without a reboot, but has a cost. 2 minutes of downtime has a cost. As does not having a backup server and losing the one and only production server.

[ Parent | on HN ]

Re:Ongoing malware attack targeting Apache hijacks 20,000 sites by alekseyk on Tuesday April 02, 2013 @02:50PM (#5481338)

While I agree it's not an Apache exploit, your post makes no sense. SSH is often tainted via permission elevation due to vulnerabilities in other daemons.

[ Parent | on HN ]