Operation Windigo - Linux ssh exploit and bot net

by
in security on (#3GE)
Here's an unpleasant start to your morning: confirmation of a long-running openSSH exploit [PDF] that has led to an extensive botnet pumping out spam, viruses, malware, and of course links to redirect farms. Symantec provides some analysis here . "Operation Windigo" as it's called has been alive since 2011, stealing SSH credentials on Windows, Linux, and BSD systems, and it has hit a couple of well-known companies, including cpanel and the Linux Foundation.

Check your system in the time it takes for your morning coffee to cool, with this command to see if you've been affected:
ssh -G 2>&1 | grep -e illegal -e unknown >/dev/null && echo "System clean" || echo "System infected"
Uninfected systems return an "error illegal option" or "unknown option" for the -G flag, plus as the usage message, whereas infected systems will return only the usage message.

If your system doesn't come up clean, you are probably one of an estimated 25,000 compromised servers currently sending out over 35 million pieces of spam.

Re: Csh syntax (Score: 1)

by vanderhoth@pipedot.org on 2014-03-20 11:38 (#PY)

I meant to ask yesterday on Soylent, but if a system is infected is there a known solution? I haven't tested my machines at home yet and I can't really see how they might be infected, but other than just formatting them, which I might do anyway because I enjoy it, is there a way to clean infections off.

I suppose I could just Google it, but fostering discussion and all that.
Post Comment
Subject
Comment
Captcha
In the number 3065180, what is the 3rd digit?