{"id":115822,"date":"2024-05-16T08:59:20","date_gmt":"2024-05-16T06:59:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym"},"modified":"2024-05-16T08:59:20","modified_gmt":"2024-05-16T06:59:20","slug":"ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","title":{"rendered":"SSH-bagd\u00f8r, der blev installeret under hackingen af kernel.org, forblev uopdaget i to \u00e5r","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskere fra ESET har offentliggjort en 43-siders rapport med en analyse af rootkit'et Ebury og den tilknyttede aktivitet. Det h\u00e6vdes, at Ebury har v\u00e6ret i brug siden 2009 og siden da er blevet installeret p\u00e5 mere end 400.000 servere, der k\u00f8rer Linux, samt flere hundrede systemer baseret p\u00e5 FreeBSD, OpenBSD og Solaris. Omkring 110.000 servere forblev inficeret med Ebury ved udgangen af 2023. Unders\u00f8gelsen er af s\u00e6rlig interesse, da Ebury var involveret i et angreb p\u00e5 kernel.org, hvilket \u00e5bner op for nogle nye detaljer om kompromitteringen af infrastrukturen for udvikling af Linux-kernen, der blev afsl\u00f8ret i 2011. Ebury er ogs\u00e5 blevet identificeret p\u00e5 servere hos dom\u00e6neregistratorer, kryptob\u00f8rser, udgangsnoder af Tor og hos flere hostingudbydere<\/a>, hvis navne ikke offentligg\u00f8res. <\/p>\n

Oprindeligt blev det antaget, at angriberne servere<\/a> Angreb p\u00e5 kernel.org var uset i 17 dage, men if\u00f8lge ESET er denne periode beregnet fra tidspunktet for inds\u00e6ttelsen af r\u00f8dder-kittet Phalanx, mens Ebury-bagd\u00f8ren har v\u00e6ret til stede p\u00e5 serverne siden 2009 og kunne have v\u00e6ret brugt til at opn\u00e5 root-adgang i n\u00e6sten to \u00e5r. Malware Ebury og Phalanx blev installeret som en del af forskellige angreb, der ikke overlapper hinanden og udf\u00f8res af forskellige grupper af angribere. Inds\u00e6ttelsen af Ebury-bagd\u00f8ren ber\u00f8rte mindst 4 servere i kernel.org's infrastruktur, hvoraf to var blevet kompromitteret i cirka to \u00e5r, og de andre to \u2014 i l\u00f8bet af 6 m\u00e5neder. <\/p>\n

Angriberne fik adgang til de password-hashes for 551 brugere, der var gemt i \/etc\/shadow, blandt hvilke var alle vedligeholdere af kernen (konti blev brugt til adgang til Git; efter h\u00e6ndelsen blev adgangskoderne \u00e6ndret, og adgangsmodellen blev revideret og overf\u00f8rt til brug af digitale underskrifter). For 257 brugere lykkedes det angrebere at identificere adgangskoderne i klartekst, angiveligt ved at g\u00e6tte adgangskoderne ud fra hashes og ved at opsnappe adgangskoder, der blev brugt i SSH af det ondsindede Ebury-komponent. <\/p>\n

Den skadelige komponent Ebury blev spredt som et delt bibliotek, der efter installationen opsnappede funktioner brugt i OpenSSH for at oprette en fjernforbindelse til systemet med root-rettigheder. Angrebet var ikke rettet mod specifikke m\u00e5l, og ligesom med de tusindvis af andre ber\u00f8rte v\u00e6rter blev serverne kernel.org brugt som en del af et botnet til at sende spam, stj\u00e6le legitimationsoplysninger til spredning p\u00e5 andre systemer, omdirigere webtrafik og udf\u00f8re anden skadelig aktivitet. <\/p>\n

For at f\u00e5 adgang til serverne blev der brugt uoprettede sikkerhedshuller i serversoftware, s\u00e5som s\u00e5rbarheder i hosting-paneler, eller opsnappede adgangskoder (det antages, at serverne kernel.org blev kompromitteret som f\u00f8lge af en bruger, der havde shell-adgang, der fik sin adgangskode stj\u00e5let). For at opn\u00e5 forh\u00f8jede rettigheder blev s\u00e5rbarheder som Dirty COW udnyttet. <\/p>\n

De nye versioner af Ebury, der er blevet anvendt de seneste \u00e5r, inkluderede udover bagd\u00f8ren funktioner som moduler til Apache httpd til at proxy trafik, omdirigere brugere og opsnappe fortrolige oplysninger, et kerne-modul til at lave \u00e6ndringer i transit-HTTP-trafik, v\u00e6rkt\u00f8jer til at skjule sin egen trafik for firewalls, samt scripts til at udf\u00f8re AitM-angreb (Adversary-in-the-Middle, tovej MiTM) for at opsnappe SSH-legitimationsoplysninger i hostingudbyderes netv\u00e6rk.

\"SSH-bagd\u00f8r,<\/center>
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e Ebury \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441 2009 \u0433\u043e\u0434\u0430 \u0438 \u0441 \u0442\u0435\u0445 \u043f\u043e\u0440 \u0431\u044b\u043b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 400 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Linux \u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0442\u0435\u043d \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 FreeBSD, OpenBSD \u0438 Solaris. \u041e\u043a\u043e\u043b\u043e 110 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u044b Ebury […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115823,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115822","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SSH-bagd\u00f8r installeret ved kompromittering af kernel.org forblev uopdaget i to \u00e5r | ProHoster","description":"Forskere fra ESET har offentliggjort en 43-siders rapport om analyse af rootkit'et Ebury og den relaterede aktivitet.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SSH-\u0431\u044d\u043a\u0434\u043e\u0440, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u0432\u0437\u043b\u043e\u043c\u0435 kernel.org, \u0434\u0432\u0430 \u0433\u043e\u0434\u0430 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0441\u044f \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u043c | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-16T06:59:20+00:00","article:modified_time":"2024-05-16T06:59:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115822","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:22:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 00:28:19","updated":"2026-02-09 17:22:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/115822","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=115822"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/115822\/revisions"}],"predecessor-version":[{"id":159151,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/115822\/revisions\/159151"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/115823"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=115822"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=115822"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=115822"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}