{"id":115822,"date":"2024-05-16T08:59:20","date_gmt":"2024-05-16T06:59:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym"},"modified":"2024-05-16T08:59:20","modified_gmt":"2024-05-16T06:59:20","slug":"ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","title":{"rendered":"SSH backdoor, kter\u00fd byl nainstalov\u00e1n p\u0159i hacku kernel.org, z\u016fstal nezpozorov\u00e1n po dobu dvou let","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdzkumn\u00edci z firmy ESET zve\u0159ejnili 43str\u00e1nkovou zpr\u00e1vu s anal\u00fdzou rootkitu Ebury a souvisej\u00edc\u00ed aktivity. Tvrd\u00ed, \u017ee Ebury je pou\u017e\u00edv\u00e1n od roku 2009 a byl instalov\u00e1n na v\u00edce ne\u017e 400 tis\u00edc\u00edch serverech b\u011b\u017e\u00edc\u00edch na Linuxu a n\u011bkolika stovk\u00e1ch syst\u00e9m\u016f zalo\u017een\u00fdch na FreeBSD, OpenBSD a Solarisu. P\u0159ibli\u017en\u011b 110 tis\u00edc server\u016f z\u016fstalo infikov\u00e1no Ebury ke konci roku 2023. Studie m\u00e1 zvl\u00e1\u0161tn\u00ed v\u00fdznam s ohledem na to, \u017ee Ebury byl zapojen do \u00fatoku na kernel.org, co\u017e odhaluje n\u011bkter\u00e9 nov\u00e9 podrobnosti o kompromitaci infrastruktury v\u00fdvoje j\u00e1dra Linuxu, kter\u00e1 byla odhalena v roce 2011. Ebury byl tak\u00e9 zji\u0161t\u011bn na serverech registr\u00e1tora dom\u00e9n, kryptoburz\u00edch, v\u00fdstupn\u00edch uzlech Tor a u n\u011bkolika hostingov\u00fdch poskytovatel\u016f<\/a>, jejich\u017e jm\u00e9na nejsou uvedena. <\/p>\n

P\u016fvodn\u011b se p\u0159edpokl\u00e1dalo, \u017ee \u00fato\u010dn\u00edci servery<\/a> \u00dato\u010dn\u00edci na kernel.org z\u016fstali nezpozorov\u00e1ni po dobu 17 dn\u016f, ale podle \u00fadaj\u016f ESET byl tento \u010das vypo\u010d\u00edt\u00e1n od okam\u017eiku vkl\u00e1d\u00e1n\u00ed rootkitu Phalanx, zat\u00edmco backdoor Ebury byl na serverech od roku 2009 a mohl b\u00fdt p\u0159ibli\u017en\u011b dva roky pou\u017e\u00edv\u00e1n k z\u00edsk\u00e1n\u00ed root p\u0159\u00edstupu k server\u016fm. Malware Ebury a Phalanx byl nasazen v r\u00e1mci r\u016fzn\u00fdch \u00fatok\u016f, kter\u00e9 se navz\u00e1jem nep\u0159ekr\u00fdvaly a byly prov\u00e1d\u011bny r\u016fzn\u00fdmi skupinami \u00fato\u010dn\u00edk\u016f. Vlo\u017een\u00ed backdooru Ebury zas\u00e1hlo nejm\u00e9n\u011b 4 servery v infrastruktu\u0159e kernel.org, z nich\u017e dva byly napadeny p\u0159ibli\u017en\u011b po dobu dvou let, zat\u00edmco dal\u0161\u00ed dva \u2014 po dobu 6 m\u011bs\u00edc\u016f. <\/p>\n

\u00dato\u010dn\u00edci z\u00edskali p\u0159\u00edstup k hash\u016fm hesel 551 u\u017eivatel\u016f ulo\u017een\u00fdm v \/etc\/shadow, mezi nimi\u017e byli v\u0161ichni maintain\u00e9\u0159i j\u00e1dra (\u00fa\u010dty byly pou\u017eity pro p\u0159\u00edstup do Gitu; po incidentu byla hesla vym\u011bn\u011bna a model p\u0159\u00edstupu byl p\u0159ehodnocen a p\u0159eveden na pou\u017eit\u00ed digit\u00e1ln\u00edch podpis\u016f). Pro 257 u\u017eivatel\u016f se \u00fato\u010dn\u00edk\u016fm poda\u0159ilo ur\u010dit hesla v otev\u0159en\u00e9 podob\u011b, pravd\u011bpodobn\u011b pomoc\u00ed hrub\u00e9 s\u00edly k hash\u016fm a prost\u0159ednictv\u00edm zachycen\u00ed hesel pou\u017e\u00edvan\u00fdch v SSH \u0161kodlivou komponentou Ebury. <\/p>\n

Malware component Ebury was distributed as a shared library that, once installed, intercepted functions used in OpenSSH to establish remote connections to the system with root privileges. The attack was non-targeted, and like other affected thousands of hosts, the kernel.org servers were used as part of a botnet for sending spam, stealing credentials for distribution on other systems, redirecting web traffic, and engaging in other malicious activities. <\/p>\n

To gain access to the servers, unpatched vulnerabilities in server software were exploited, such as vulnerabilities in hosting panels, or intercepted passwords (it is believed that the kernel.org servers were compromised as a result of a password breach from one of the users with shell access). Privilege escalation was achieved using vulnerabilities like Dirty COW. <\/p>\n

Recent versions of Ebury implemented in the last few years, in addition to the backdoor, included features such as modules for Apache httpd for traffic proxying, user redirection, and interception of sensitive information, a kernel module to modify transit HTTP traffic, tools to hide their own traffic from firewalls, scripts for conducting AitM attacks (Adversary-in-the-Middle, bidirectional MiTM) to capture SSH credentials in hosting provider networks.

\"SSH<\/center>
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e Ebury \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441 2009 \u0433\u043e\u0434\u0430 \u0438 \u0441 \u0442\u0435\u0445 \u043f\u043e\u0440 \u0431\u044b\u043b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 400 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Linux \u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0442\u0435\u043d \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 FreeBSD, OpenBSD \u0438 Solaris. \u041e\u043a\u043e\u043b\u043e 110 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u044b Ebury […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115823,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115822","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47The SSH backdoor established during the kernel.org hack went unnoticed for two years | ProHoster","description":"Researchers from ESET published a 43-page report analyzing the Ebury rootkit and its related activities.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SSH-\u0431\u044d\u043a\u0434\u043e\u0440, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u0432\u0437\u043b\u043e\u043c\u0435 kernel.org, \u0434\u0432\u0430 \u0433\u043e\u0434\u0430 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0441\u044f \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u043c | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-16T06:59:20+00:00","article:modified_time":"2024-05-16T06:59:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115822","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:22:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 00:28:19","updated":"2026-02-09 17:22:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/115822","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=115822"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/115822\/revisions"}],"predecessor-version":[{"id":159151,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/115822\/revisions\/159151"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/115823"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=115822"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=115822"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=115822"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}