SSHD rootkit in the wild

Discussion in 'all things UNIX' started by ComputerSaysNo, Feb 23, 2013.

Thread Status:
Not open for further replies.
  1. ComputerSaysNo

    ComputerSaysNo Guest


    https://isc.sans.edu/diary/SSHD rootkit in the wild/15229

    Interesting.....
     
    Last edited by a moderator: Feb 23, 2013
    ComputerSaysNo, Feb 23, 2013
    #1
  2. Cudni

    Cudni Global Moderator

    Joined:
    May 24, 2009
    Posts:
    6,963
    Location:
    Somethingshire
    Cudni, Feb 23, 2013
    #2
  3. Gullible Jones

    Gullible Jones Guest

    Hmm. I'm somewhat more interested in knowing how the attackers are gaining root access to compromised systems.
     
    Gullible Jones, Feb 23, 2013
    #3
  4. java dude

    java dude Registered Member

    Joined:
    Aug 5, 2011
    Posts:
    76
    It's believed that the workstations used to access remote servers via SSH were infected with a keylogger (quite possibly with a malicious flash/java exploit), then used to back connect to the server and plant the rootkit. Nasty stuff.
     
    java dude, Feb 23, 2013
    #4
  5. Gullible Jones

    Gullible Jones Guest

    Nasty indeed. Time to tighten up my Noscript settings, I think.
     
    Gullible Jones, Feb 23, 2013
    #5
  6. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    10,224
    Based on?
    Mrk
     
    Mrkvonic, Feb 24, 2013
    #6
  7. NGRhodes

    NGRhodes Registered Member

    Joined:
    Jun 23, 2003
    Posts:
    2,381
    Location:
    West Yorkshire, UK
    According to the article linked by the OP (which has been updated) - The source appears to be a compromised support server at cpanel . Which then got credentials stored on support tickets so that cpanel support staff could login.

    Cheers, Nick
     
    NGRhodes, Feb 24, 2013
    #7
  8. tlu

    tlu Guest

    There's a very lengthy thread on WHT. It seems that it's not yet quite clear what's going on here (as I understand it after not reading through all 1362 posts there ;) ).
     
    tlu, Feb 24, 2013
    #8
  9. ComputerSaysNo

    ComputerSaysNo Guest

    Seems like CentOS is being hammered.
     
    ComputerSaysNo, Feb 25, 2013
    #9
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...