Posted on 05/01/2013 6:54:11 AM PDT by ShadowAce
CSO - Apache servers are being ambushed by a particularly pernicious malware program called Linux/Cdorked.A that's infecting visitors to the sick machines with the Blackhole malware kit.
Discovered by security researchers at Sucuri and Eset, they describe the malware a a sophisticated and stealthy backdoor meant to drive traffic to malicious websites.
Eset explained in a blog post that the malware is one of the most sophisticated Apache backdoors it has seen so far. So far, hundreds of servers have been compromised, it said.
The backdoor leaves no traces of compromised hosts on the hard drive other than a modified binary file, it continued. In addition, all of the information related to the backdoor is stored in shared memory and information on its command and control activity isn't recorded in any Apache logs, making it difficult for defenders to identify it.
"It resides all in memory so if you're doing forensics or incident response, and you're looking for signs on your hard drive that something bad has happened, you won't find them," Eset senior researcher Cameron Camp said in an interview.
"It has the ability to redirect visitors to your website to terrible places where they will get infected through the Blackhole exploit kit, which is a nasty piece of malware," he added.
Since the malware resides in memory, if the server is rebooted, the malware will disappear. Reboots occur when Apache is upgraded or patched. The problem is, those patches aren't always installed in a timely fashion.
"Web servers are updated ad hoc," Camp said. "There's no set schedule."
"If a fix is released," he continued, "some more vigilant folks will update right away, but it's not uncommon to see an Apache server that hasn't been patched for weeks or months."
It's also still uncertain how the malware is reaching the server in the first place. So even the malware is flushed out of memory, it could be re-infected within a short period of time.
"Unless you actively patch how they got into your server, they can get right back in," Camp said.
"That's what's so troubling right now -- whether this is being spread by a Web exploit or by brute force attacks on the server," he added.
Making matters worse is that the attacks are being targeted at hosting servers. "They tend to be much more secure than an average website or server, and yet they're still getting compromised," said Mary Landesman, a senior security researcher with Cisco.
"There's a lot at stake for them to gain the necessary access and plant a backdoor," she added, "because when that server gets compromised, every website hosted by that server becomes a vector for malware."
This malware departs from previous infections in a worrisome way, Landesman said. "With past infections, once you knew what to look for, it was fairly easy to find them," she said. "With this evolution, it's going to be much harder."
These kinds of attacks on hosting servers is a growing trend in the digital underground, replacing the old practice of mass registering domain names to be used for harmful activity, noted Paul Ferguson, vice president for threat intelligence at Internet Identity.
"There's been a dramatic decline in domains that were registered for sheer malicious purposes in favor of hacking servers and using them to perpetrate other crimes," he told CSO.
"Servers have become the low hanging fruit," he said
Those savages
"Back in the day" it was a badge of honor to have your Novell server up and running > 365 days. :)
We have Solaris servers here that have been online for over 6 years without a reboot. Sometimes things just work.
I wonder who they are just working for now?...
Somebody needs to embed corbomite coding into every server.
They house a bunch of data analytics information. We’re in the process of migrating data off of them, but they’re not exposed to the external world. They’re solely internal machines.
Apache updates do not require a reboot.
Understood, but I’m not a Solaris admin. Doesn’t matter to me. hehe
I’ve got some Cisco 6500-E routers that have been up continuously for almost 4 years.
X uptime is 3 years, 34 weeks, 5 days, 2 hours, 35 minutes
Uptime for this control processor is 3 years, 34 weeks, 5 days, 1 hour, 36 minutes
Time since X switched to active is 3 years, 34 weeks, 5 days, 1 hour, 45 minutes
System returned to ROM by reload at 09:50:03 CDT Tue Sep 1 2009 (SP by reload)
System restarted at 09:56:56 CDT Tue Sep 1 2009
No they don't.
> Apache updates do not require a reboot.
Right.
Maybe what the article was trying to convey was that as long as you had the httpd down or was restarting for a patch, you might as well reboot the whole server.
Must be written by a Windows admin, LOL.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.