Linux Servers Hijacked to Mine Cryptocurrency via SambaCry Vulnerability

itman · Jun 10, 2017

It's not just Windows anymore ...............

An unknown threat actor is using a vulnerability in Samba installations to take over Linux machines and use them as pawns in a vast cryptocurrency mining operation.

According to public data, their actions started about five days after the Samba team announced they patched CVE-2017-7494, a vulnerability in all Samba versions released since 2010.

Because the vulnerability is exploitable via the SMB protocol, and because the issue came to light so close to the WannaCry ransomware outbreak, some researchers started referring to the bug as SambaCry or EternalRed.

Attacks started on May 30
At the technical level, a successful SambaCry exploit would allow an attacker to open a "pipe" on Samba servers, upload malicious code, and have it executed. Depending on the attacker's skill level, one could very easily achieve full server takeover.

This is exactly what happened. Starting around May 30, one such threat group has carried out mass scans that were looking for vulnerable Samba file sharing servers.

After finding exposed Samba installations, the attacker tested his ability to upload and execute code by loading eight files on a user's machine.

If he was successful, he then uploaded two malicious files. The first was a remote shell with full root access, while the second was a modified version of a popular cryptocurrency mining tool called cpuminer.

The attacker uses the remote shell to install the modified cpuminer, which some researchers have started calling EternalMiner.
Click to expand...

https://www.bleepingcomputer.com/ne...ne-cryptocurrency-via-sambacry-vulnerability/

Palancar · Jun 10, 2017

According to public data, their actions started about five days after the Samba team announced they patched CVE-2017-7494
Click to expand...

I call foul against Linux being accused here. The Samba team did what was "right" and fixed and notified users of a weakness issuing a valid PATCH. Microsoft and others do the same thing. If a careless and lazy server operator neglects (irresponsibly) to install the patch, than that isn't Linux but an operator error. My take on this.

Log in or Sign up

Linux Servers Hijacked to Mine Cryptocurrency via SambaCry Vulnerability

itman Registered Member

Palancar Registered Member

Log in or Sign up

Linux Servers Hijacked to Mine Cryptocurrency via SambaCry Vulnerability

itman Registered Member

Palancar Registered Member

Useful Searches