[important]Exploit!

[AWS]

It's looking like a kernel exploit.

https://access.redhat.com/security/cve/CVE-2013-0871

That seems to be the consensus many are coming to now.

 

[x3sphere]

Given so many attack vectors have been ruled out already I wouldn't be surprised if this is a case of the admins' machines getting infected.

 

[Mike Edge]

It's looking like a kernel exploit.

https://access.redhat.com/security/cve/CVE-2013-0871

That seems to be the consensus many are coming to now.

agree, I'm pretty confident at this point it is the kernel.

 

[AWS]

Given so many attack vectors have been ruled out already I wouldn't be surprised if this is a case of the admins' machines getting infected.

I doubt that. Here's why.

One person had 10 servers online. 3 were hacked.
Another had 3 servers. 1 hacked.
One admin said his company has 262 CentOS servers and 20 were compromised.
All reports are from servers running CentOS and 1 person saying a Debian server was exploited.

If the admins computer was hacked why aren't all the servers he maintains compromised?
Why is this specific to CentOS?
Wouldn't the hacker have access to distros including Windows servers?

I am starting to think this is something that might never be solved because there hasn't been an real press about it yet. While WHT is a big community it is a small group that is discussing this. Until it gets main stream coverage from the big news outlets the real good forensic people will not be looking at it. I have no doubt that if this was a Windows exploit the fix and patch would already be main stream. It's sad to say, but, Linux while widely used as a server OS does not get the the big security boys looking at it until a site like Facebook, Twitter or Google are exploited. Then it's big news.

 

[MattW]

It's actually looking like a locally infected PC used by the administrator of the servers and sending keystrokes back to the attacking machines

http://www.webhostingtalk.com/showpost.php?p=8566599&postcount=830

 

[Weppa333]

thanks for the heads up.

 

[D.O.A.]

you'd think if this was a kernel 0-day or any type of 0-day for that matter then these hackers would be doing more then using it on small fish (it's even being manually re-added by the hacker/s, as some claim after wiping their OS). Even for spammers it seems like a waste of a perfectly good exploit (if it is). Another Debian guy here claiming to be hacked as well;

lrwxrwxrwx 1 root root 18 Nov 16 22:05 libkeyutils.so.1 -> libkeyutils.so.1.9

 

[p4guru]

http://www.webhostingtalk.com/showthread.php?t=1235797

wow that 15+ page thread took me a better part of an entire day to read and still no definite conclusion to where it's coming from !

Got 31 servers here, 28x CentOS 6.3 64bit based some with whm/cpanel others no control panel and 3x Oracle Linux 6.3 64bit based. Just checked all, none have the exploit. All servers are loaded from day 1 with CSF firewall.

 

[Mike Edge]

It's actually looking like a locally infected PC used by the administrator of the servers and sending keystrokes back to the attacking machines

http://www.webhostingtalk.com/showpost.php?p=8566599&postcount=830

Not really sure how much I trust someone with only 200 posts on WHT, no company sig.. etc.

 

[Mike Edge]

All servers are loaded from day 1 with CSF firewall.

Be sure to update to latest CSF released yesterday with the checker/notify for it.

 

[p4guru]

Be sure to update to latest CSF released yesterday with the checker/notify for it.

Yeah already confirmed most of the servers auto updated CSF, with an exception of 3 servers which needed manual updating despite being set to auto update

 

[p4guru]

Not really sure how much I trust someone with only 200 posts on WHT, no company sig.. etc.

post counts don't mean much, quality over quantity

 

[Mike Edge]

post counts don't mean much, quality over quantity

Agree, but it is WHT after all where 300 ppl have 300 different stories.

 

[Adam Howard]

For the time being I've disabled all mail servers and processes.

XenForo only needs the built in php send mail command to function anyways... ie... You can setup a server without any mail and php alone will send out email.

exim
mailman
imap
spamd


All gone. Can't play with what is not there

While this may not be perfect... There is no current cure, resolve, or solution to this problem (for anyone). It is the only means that seems to work, for now.

 

[MattW]

Apparently confirmed keylogger

http://www.webhostingtalk.com/showthread.php?p=8567829#post8567829

 

[SneakyDave]

Wow, some people really know how to derail and troll a thread to make it all about Debian vs CentOS

 

[MattW]

I know, I'm fed up of having to read through all the crap just to get the facts. I've installed AVG Free on both my VPS as that is now able to detect the infected file regardless of the name being used.

 

[Adam Howard]

Apparently confirmed keylogger

http://www.webhostingtalk.com/showthread.php?p=8567829#post8567829

I doubt that is the cause.....

I'm running off a LIVE CD with no physical hard drive. I basically have a fresh system every time I reboot.

 

[AWS]

Did you put all those files you had upload to the new server on the LiveCD?

I do think this is a local compromise of boxes connecting to the server. The main reason I suspect this is none of the big security guys have talked about it yet. It is pretty much specific to WHT and a couple other sites. Someone mentioned that maybe an ad on WHT served up the malware. This is possible. I am an admin at a site iNet the owner of WHT used to own. The new owner uses the same ad network. Last month one of the ads was serving up malware. When we took apart and analyzed the payload binary we found it was a keylogger and rootkit and it was using an exploit in flash player to drop the payload.

Also speedtest.net was compromised a couple weeks ago so there is no telling how many people might have been hacked.

 

[Slavik]

The blackhole exploit was updated to be particularly vicious at the end of last year, unfortunately it never got much coverage and many MANY people are vunerable.

Given the cost of renting it ($600 per day iirc) people using this exploit would be specifically targetting high value users such as server admins.

If it was something such as a kernel exploit, I doubt it would be so confined, outside of WHT this exploit has basically no traction in real terms of being achknowledged aside from the usual "hey look theres something".

Keylogger is my best guess also.