{"id":115822,"date":"2024-05-16T08:59:20","date_gmt":"2024-05-16T06:59:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym"},"modified":"2024-05-16T08:59:20","modified_gmt":"2024-05-16T06:59:20","slug":"ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","title":{"rendered":"SSH-tagauks, mis paigaldati kernel.orgi r\u00fcnnaku k\u00e4igus, j\u00e4i kaheks aastaks m\u00e4rkamatuks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

ESETi teadlased avaldasid 43-lehek\u00fcljelise aruande Ebury puhtuse ja sellega seotud tegevuse anal\u00fc\u00fcsist. V\u00e4idetavalt on Ebury-d kasutatud alates 2009. aastast ning see on paigaldatud rohkem kui 400 000 Linuxi serverisse ja mitmesse sajasse FreeBSD, OpenBSD ja Solaris s\u00fcsteemi. 2023. aasta l\u00f5puks j\u00e4i umbes 110 000 serverit Ebury-ga nakatunud. Uuring on eriliselt huvitav, kuna Ebury-d kasutati kernel.org r\u00fcnnaku korral, avades teatud uusi detaile Linuxi tuumade arendusstruktuuri kompromiteerimisest, mis tuvastati 2011. aastal. Ebury tuvastati ka domeeni registreerijate, kr\u00fcptovaluutade b\u00f6rside, Tor-i v\u00e4ljuvate s\u00f5lmede ning mitmete hostingu pakkujate<\/a>, kelle nimesid ei avalikustata. <\/p>\n

Alguses arvati, et r\u00fcndajad serverid<\/a> kernel.org k\u00fcberkurjused j\u00e4id m\u00e4rkamatuks 17 p\u00e4evaks, kuid ESETi andmetel arvutatakse see aeg alates Phalanx rootkiti sissetoomisest, samas kui Ebury tagauks oli serverites alates 2009. aastast ja umbes kaks aastat v\u00f5is seda kasutada root-juurdep\u00e4\u00e4su saamiseks serveritele. Kahjulikud programmid Ebury ja Phalanx olid paigaldatud erinevate r\u00fcnnakute raames, mis \u00fcksteisega ei kattunud ja mille viisid ellu erinevad kurjategijate grupid. Ebury tagaukse sissetoomine puudutas v\u00e4hemalt 4 serverit kernel.org infrastruktuuris, millest kaks olid m\u00f5jutatud ligikaudu kahe aasta jooksul, samas kui \u00fclej\u00e4\u00e4nud kaks - umbes 6 kuu jooksul. <\/p>\n

R\u00fcndajad said juurdep\u00e4\u00e4su \/etc\/shadow failis hoitud 551 kasutaja paroolih\u00e4dudele, sealhulgas k\u00f5igile tuumade hooldajatele (kontod kasutati Git-i juurdep\u00e4\u00e4suks; p\u00e4rast intsidenti vahetati paroolid ning juurdep\u00e4\u00e4su mudel l\u00e4biti ja viidi \u00fcle digitaalsete allkirjadeni). 257 kasutaja paroolide avastamine \u00f5nnestus r\u00fcndajatel selges tekstis ilmselt paroolide v\u00e4ljat\u00f6\u00f6tamise ja Ebury pahavara komponendi kaudu SSH-s kasutatud paroolide salajase \u00fclekande t\u00f5ttu. <\/p>\n

Kahjulik komponent Ebury jagati jagatavina raamatukoguna, mis p\u00e4rast installimist p\u00fc\u00fcdis kinni OpenSSH-s kasutatavaid funktsioone, et korraldada kaug\u00fchendust s\u00fcsteemiga root \u00f5igustega. R\u00fcnnak ei olnud sihitud ja nagu teisedki tuhanded m\u00f5jutatud hostid, kasutati kernel.org servereid botiv\u00f5rguna r\u00e4mpsposti saatmiseks, kasutajakoodide varastamiseks teiste s\u00fcsteemide levitamiseks, veebiliikluse suunamiseks ja muude kahjulike tegevuste tegemiseks. <\/p>\n

Serveritesse sisenemiseks kasutati plaastrimata haavatavusi serveri tarkvaras, nagu n\u00e4iteks haavatavused hostimispaneelides, v\u00f5i kustutatud paroole (eeldatakse, et kernel.org serverid h\u00e4kiti \u00fche kasutaja, kellel oli shell-juurdep\u00e4\u00e4s, parooli kompromiteerimise t\u00f5ttu). Privileegide t\u00f5stmiseks kasutati selliseid haavatavusi nagu Dirty COW. <\/p>\n

Viimastel aastatel rakendatud uued versioonid Ebury, lisaks tagauksele, h\u00f5lmasid ka selliseid funktsioone nagu Apache httpd moodulite kasutamine liikluse vaheline suunamine, kasutajate suunamine ja konfidentsiaalsete andmete p\u00fc\u00fcdmine, tuumamoodul HTTP liikluse transiidi muutmiseks, t\u00f6\u00f6riistad enda liikluse varjamiseks tulem\u00fc\u00fcridest, skripte AitM r\u00fcnnakute (Adversary-in-the-Middle, kahepoolne MiTM) l\u00e4biviimiseks SSH kasutajakoodide p\u00fc\u00fcdmise jaoks hostimisteenuste v\u00f5rgus.

\"SSH-tagauks,<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e Ebury \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441 2009 \u0433\u043e\u0434\u0430 \u0438 \u0441 \u0442\u0435\u0445 \u043f\u043e\u0440 \u0431\u044b\u043b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 400 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Linux \u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0442\u0435\u043d \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 FreeBSD, OpenBSD \u0438 Solaris. \u041e\u043a\u043e\u043b\u043e 110 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u044b Ebury […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115823,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115822","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SSH tagaukse, mis pandi paika kernel.org h\u00e4kkerimise k\u00e4igus, j\u00e4i kaheks aastaks m\u00e4rkamatuks | ProHoster","description":"ESETi teadlased avaldasid 43-lehek\u00fcljelise aruande Ebury rootkit'i ja sellega seotud tegevuste anal\u00fc\u00fcsiga.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SSH-\u0431\u044d\u043a\u0434\u043e\u0440, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u0432\u0437\u043b\u043e\u043c\u0435 kernel.org, \u0434\u0432\u0430 \u0433\u043e\u0434\u0430 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0441\u044f \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u043c | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-16T06:59:20+00:00","article:modified_time":"2024-05-16T06:59:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115822","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:22:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 00:28:19","updated":"2026-02-09 17:22:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115822","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=115822"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115822\/revisions"}],"predecessor-version":[{"id":159151,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115822\/revisions\/159151"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/115823"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=115822"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=115822"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=115822"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}