Operation Windigo - Linux ssh exploit and bot net

by
in security on (#3GE)
Here's an unpleasant start to your morning: confirmation of a long-running openSSH exploit [PDF] that has led to an extensive botnet pumping out spam, viruses, malware, and of course links to redirect farms. Symantec provides some analysis here . "Operation Windigo" as it's called has been alive since 2011, stealing SSH credentials on Windows, Linux, and BSD systems, and it has hit a couple of well-known companies, including cpanel and the Linux Foundation.

Check your system in the time it takes for your morning coffee to cool, with this command to see if you've been affected:
ssh -G 2>&1 | grep -e illegal -e unknown >/dev/null && echo "System clean" || echo "System infected"
Uninfected systems return an "error illegal option" or "unknown option" for the -G flag, plus as the usage message, whereas infected systems will return only the usage message.

If your system doesn't come up clean, you are probably one of an estimated 25,000 compromised servers currently sending out over 35 million pieces of spam.

Re: Csh syntax (Score: 1)

by odm@pipedot.org on 2014-03-20 11:49 (#PZ)

the linked pdf has an appendix on cleaning, but basically, no, you need a complete wipe and reboot - as you would for any attack that's gained root access. By the way, unless your home machines are internet facing servers, they're not going to be affected.
Post Comment
Subject
Comment
Captcha
Twenty four, 37 and one: the 3rd number is?