{"id":115822,"date":"2024-05-16T08:59:20","date_gmt":"2024-05-16T06:59:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym"},"modified":"2024-05-16T08:59:20","modified_gmt":"2024-05-16T06:59:20","slug":"ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","title":{"rendered":"Kernel.org'i h\u00e4katse k\u00e4igus paigaldatud SSH-tagaukse kaudu oli kaks aastat m\u00e4rkamatuks j\u00e4\u00e4nud.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

ESETi teadlased avaldasid 43-lehek\u00fcljelise aruande Ebury rootkiti ja sellega seotud tegevuse anal\u00fc\u00fcsist. V\u00e4idetavalt on Ebury v\u00e4lja arendatud alates 2009. aastast ja selle on paigaldanud rohkem kui 400 000 Linuxi serverit ning mitusada FreeBSD, OpenBSD ja Solaris s\u00fcsteemi. Umbes 110 000 serverit j\u00e4i Ebury haavata 2023. aasta l\u00f5puks. Uuring on eriliselt huvitav, arvestades, et Ebury oli kaasatud kernel.org-i r\u00fcnnakusse, mis paljastab uusi \u00fcksikasju Linuxi tuumade arendusinfostruktuuri kompromiteerimisest, mis tuvastati 2011. aastal. Eburyt on samuti avastatud domeeniregistraatorite, kr\u00fcptovaluutade b\u00f6rside, Tor v\u00e4ljundpunktide ja mitmete h\u00f5lvab teenusepakkujate<\/a>, kelle nimesid ei avalikustata. <\/p>\n

Alguses arvati, et r\u00fcndajad serverid<\/a> kernel.org kurjategijad j\u00e4id m\u00e4rkamatuks 17 p\u00e4eva, kuid ESETi andmetel arvutatakse see aeg alates Phalanxi rootkiti sisestamisest, samas kui Ebury tagauks on olnud serverites olemas alates 2009. aastast ja umbes kaks aastat v\u00f5is seda kasutada root-juurdep\u00e4\u00e4su hankimiseks serveritele. Ebury ja Phalanxi pahavara on paigaldatud erinevate r\u00fcnnakute raames, mis ei ole omavahel seotud ning mille on l\u00e4bi viinud erinevad kurjategijate grupid. Ebury tagaukse sisestamine m\u00f5jutas v\u00e4hemalt nelja serverit kernel.org infrastruktuuris, millest kaks olid nakatunud umbes kahe aasta jooksul ja \u00fclej\u00e4\u00e4nud kaks \u2014 kuue kuu jooksul. <\/p>\n

R\u00fcndajad p\u00e4\u00e4sesid ligi \/etc\/shadow kataloogis hoitud 551 kasutaja paroolih\u00e4kkidele, sealhulgas k\u00f5ikidele tuumahalduritele (kontosid kasutati Giti juurdep\u00e4\u00e4suks; juhtumi j\u00e4rel asendati paroolid ja juurdep\u00e4\u00e4sustrateegiat \u00fcle vaadati, muutes digitaalsed allkirjad kohustuslikuks). 257 kasutaja puhul \u00f5nnestus r\u00fcndajatel leida paroolid avatud kujul, t\u00f5en\u00e4oliselt paroolide h\u00e4kkimise ning Ebury pahavara abil SSH-s kasutatud paroolide konfiskeerimise teel. <\/p>\n

Ebury pahav kahjustav komponent levis jagatava teekina, mis p\u00e4rast installimist r\u00fcndas OpenSSH kasutatavaid funktsioone, et korraldada kaug\u00fchendust s\u00fcsteemiga root-\u00f5igustega. R\u00fcnnak ei olnud sihitud ja nagu ka teised tuhanded m\u00f5jutatud serverid, kasutati kernel.org servereid osana botnetist sp\u00e4mmimise, kontode varguse, teiste s\u00fcsteemide levitamise, veebiliikluse suunamise ja muu pahatahtliku tegevuse jaoks. <\/p>\n

Serveritesse sisenemiseks kasutati parendamata haavatavusi serveri tarkvaras, n\u00e4iteks haavatavusi hostimispaneelides v\u00f5i \u00f5nnestunud paroolide pealtkuulamist (eeldatakse, et kernel.org serverid said h\u00e4kitud \u00fche kasutaja parooli kompromiteerimise t\u00f5ttu, kellel oli shell-juurdep\u00e4\u00e4s). Privileegide t\u00f5stmiseks kasutati haavatavusi, nagu Dirty COW. <\/p>\n

Viimastel aastatel kasutusele v\u00f5etud Ebury uued versioonid sisaldasid lisaks tagauksele ka selliseid funktsioone nagu Apache httpd moodulid liikluse edastamiseks, kasutajate suunamiseks ja konfidentsiaalse teabe pealtkuulamiseks, tuumamoodul, et teha muudatusi HTTP liikluses, t\u00f6\u00f6riistad, et varjata oma liiklust tulem\u00fc\u00fcride eest, ning skriptid AitM (Adversary-in-the-Middle, kaheastmeline MiTM) r\u00fcnnakute l\u00e4biviimiseks SSH mandaadi pealtkuulamiseks paremaldamisteenuste v\u00f5rkudes.

\"Kernel.org'i<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e Ebury \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441 2009 \u0433\u043e\u0434\u0430 \u0438 \u0441 \u0442\u0435\u0445 \u043f\u043e\u0440 \u0431\u044b\u043b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 400 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Linux \u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0442\u0435\u043d \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 FreeBSD, OpenBSD \u0438 Solaris. \u041e\u043a\u043e\u043b\u043e 110 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u044b Ebury […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115823,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115822","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 SSH tagauks, mis paigaldati kernel.org'i h\u00e4kkimise k\u00e4igus, j\u00e4i kaks aastat m\u00e4rkamatuks | ProHoster","description":"ESET-i teadlased avaldasid 43-lehek\u00fcljelise aruande Ebury rootkit'i ja sellega seotud tegevuse anal\u00fc\u00fcsi kohta. V\u00e4idetavalt on Ebury kasutusel alates 2009. aastast ning seda on paigaldatud rohkem kui 400 000 Linuxi serverisse ning mitmesse sajasse FreeBSD, OpenBSD ja Solaris s\u00fcsteemi. Umbes 110 000 serverit on endiselt Eburyga nakatunud.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SSH-\u0431\u044d\u043a\u0434\u043e\u0440, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u0432\u0437\u043b\u043e\u043c\u0435 kernel.org, \u0434\u0432\u0430 \u0433\u043e\u0434\u0430 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0441\u044f \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u043c | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e Ebury \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441 2009 \u0433\u043e\u0434\u0430 \u0438 \u0441 \u0442\u0435\u0445 \u043f\u043e\u0440 \u0431\u044b\u043b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 400 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Linux \u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0442\u0435\u043d \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 FreeBSD, OpenBSD \u0438 Solaris. \u041e\u043a\u043e\u043b\u043e 110 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u044b Ebury","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-16T06:59:20+00:00","article:modified_time":"2024-05-16T06:59:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115822","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:22:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 00:28:19","updated":"2026-02-09 17:22:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115822","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=115822"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115822\/revisions"}],"predecessor-version":[{"id":159151,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115822\/revisions\/159151"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/115823"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=115822"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=115822"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=115822"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}