Operation Windigo - Linux ssh exploit and bot net

by
in security on (#3GE)
Here's an unpleasant start to your morning: confirmation of a long-running openSSH exploit [PDF] that has led to an extensive botnet pumping out spam, viruses, malware, and of course links to redirect farms. Symantec provides some analysis here . "Operation Windigo" as it's called has been alive since 2011, stealing SSH credentials on Windows, Linux, and BSD systems, and it has hit a couple of well-known companies, including cpanel and the Linux Foundation.

Check your system in the time it takes for your morning coffee to cool, with this command to see if you've been affected:
ssh -G 2>&1 | grep -e illegal -e unknown >/dev/null && echo "System clean" || echo "System infected"
Uninfected systems return an "error illegal option" or "unknown option" for the -G flag, plus as the usage message, whereas infected systems will return only the usage message.

If your system doesn't come up clean, you are probably one of an estimated 25,000 compromised servers currently sending out over 35 million pieces of spam.

Csh syntax (Score: 2, Informative)

by dnied@pipedot.org on 2014-03-20 10:39 (#PX)

To not leave all the fun to [ba]sh users, here's the same test in [t]csh:
(ssh -G |& grep -e illegal -e unknown >/dev/null)&&echo "System clean"||echo "System infected"
Post Comment
Subject
Comment
Captcha
If a person is called Daniel, what is their name?