Operation Windigo - Linux ssh exploit and bot net

by
in security on (#3GE)
Here's an unpleasant start to your morning: confirmation of a long-running openSSH exploit [PDF] that has led to an extensive botnet pumping out spam, viruses, malware, and of course links to redirect farms. Symantec provides some analysis here . "Operation Windigo" as it's called has been alive since 2011, stealing SSH credentials on Windows, Linux, and BSD systems, and it has hit a couple of well-known companies, including cpanel and the Linux Foundation.

Check your system in the time it takes for your morning coffee to cool, with this command to see if you've been affected:
ssh -G 2>&1 | grep -e illegal -e unknown >/dev/null && echo "System clean" || echo "System infected"
Uninfected systems return an "error illegal option" or "unknown option" for the -G flag, plus as the usage message, whereas infected systems will return only the usage message.

If your system doesn't come up clean, you are probably one of an estimated 25,000 compromised servers currently sending out over 35 million pieces of spam.

openssh exploit??? (Score: 2, Interesting)

by odm@pipedot.org on 2014-03-20 09:32 (#PV)

This is a very sophisticated bit of kit, but from glancing through the pdf yesterday I was under the impression that initial access was gained by other means and then openssh was later patched with a backdoor. Someone correct me if I'm wrong, but I don't think there's anything to panic about if your system comes up clean (assuming they haven't remotely updated their exploit kit to cover the test - which is certaily possible)
Post Comment
Subject
Comment
Captcha
The name of William is?