{"id":115822,"date":"2024-05-16T08:59:20","date_gmt":"2024-05-16T06:59:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym"},"modified":"2024-05-16T08:59:20","modified_gmt":"2024-05-16T06:59:20","slug":"ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","title":{"rendered":"SSH le\u0111a vrata, postavljena prilikom hakiranja kernel.org, ostala su neprimije\u0107ena dvije godine","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Istra\u017eiva\u010di iz kompanije ESET objavili su 43-strani izve\u0161taj sa analizom rootkita Ebury i povezanih aktivnosti. Navodi se da se Ebury koristi od 2009. godine i da je od tada instaliran na vi\u0161e od 400.000 servera koji koriste Linux i nekoliko stotina sistema zasnovanih na FreeBSD, OpenBSD i Solaris. Oko 110.000 servera ostalo je zara\u017eeno Ebury-jem do kraja 2023. godine. Istra\u017eivanje je od posebnog interesa s obzirom na to da je Ebury kori\u0161\u0107en u napadu na kernel.org, \u0161to otkriva neke nove detalje kompromitacije infrastrukture za razvoj Linux jezgra, otkrivene 2011. godine. Ebury je tako\u0111e otkriven na serverima registra domena, kripto berzama, izlaznim \u010dvorovima Tor-a i kod nekoliko hosting provider-a<\/a>, \u010dija imena nisu navedena. <\/p>\n

Prvobitno se verovalo da su napada\u010di servere<\/a> Na kernel.org napada\u010di su ostali neprimije\u0107eni 17 dana, ali prema podacima ESET-a, to vrijeme izra\u010dunava se od trenutka kada je zara\u017een rootkitom Phalanx, dok je backdoor Ebury bio na poslu\u017eiteljima od 2009. godine i mogao je biti kori\u0161ten za dobivanje root pristupa poslu\u017eiteljima gotovo dvije godine. Maliciozni softver Ebury i Phalanx postavljen je u okviru razli\u010ditih napada, koji se me\u0111usobno ne preklapaju i provode ih razli\u010dite grupe napada\u010da. Uvo\u0111enje backdoora Ebury utjecalo je na najmanje 4 poslu\u017eitelja u infrastrukturi kernel.org, od kojih su dva bila zara\u017eena otprilike tijekom dvije godine, dok su preostala dva - tijekom 6 mjeseci. <\/p>\n

Napada\u010di su dobili pristup hash-ovima lozinki 551 korisnika sme\u0161tenih u \/etc\/shadow, me\u0111u kojima su bili svi odr\u017eavaoci jezgra (naloge su koristili za pristup Git-u; nakon incidenta lozinke su zamenjene, a model pristupa je preispitan i pre\u0161ao je na kori\u0161\u0107enje digitalnih potpisa). Za 257 korisnika napada\u010dima je uspelo da identifikuju lozinke u otvorenom obliku, pretpostavljaju\u0107i da su to postigli brute force napadom na hash-ove i kroz presretanje lozinki kori\u0161\u0107enih u SSH od strane malicioznog komponenta Ebury. <\/p>\n

Maliciozni komponent Ebury \u0161irio se kao dijeljena biblioteka koja je, nakon instalacije, presretala funkcije kori\u0161tene u OpenSSH-u za uspostavljanje udaljenog pristupa sustavu s root pravima. Napad nije bio ciljan, a kao i drugi pogo\u0111eni tisu\u0107e hostova, serveri kernel.org kori\u0161teni su kao dio botneta za slanje spam poruka, kra\u0111u vjerodajnica za \u0161irenje na druge sustave, preusmjeravanje web prometa i obavljanje drugih zlonamjernih aktivnosti. <\/p>\n

Za prodiranje na servere kori\u0161tene su neispravljene ranjivosti u serverskom softveru, poput ranjivosti u hosting panelima, ili presretnute lozinke (pretpostavlja se da su serveri kernel.org hakirani nakon kompromitacije lozinke jednog od korisnika koji je imao shell pristup). Za podizanje privilegija kori\u0161tene su ranjivosti poput Dirty COW. <\/p>\n

Nove verzije Ebury, koje su primjenjivane posljednjih godina, uklju\u010divale su ne samo backdoor, ve\u0107 i mogu\u0107nosti kao \u0161to su moduli za Apache httpd za proksiranje prometa, preusmjeravanje korisnika i presretanje povjerljivih informacija, kernel modul za izmjene u tranzitnom HTTP prometu, alati za skrivanje vlastitog prometa od vatrozida, te skripte za izvo\u0111enje AitM napada (Adversary-in-the-Middle, dvosmjerni MiTM) za presretanje SSH vjerodajnica u mre\u017eama hosting pru\u017eatelja.

\"SSH<\/center>
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e Ebury \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441 2009 \u0433\u043e\u0434\u0430 \u0438 \u0441 \u0442\u0435\u0445 \u043f\u043e\u0440 \u0431\u044b\u043b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 400 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Linux \u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0442\u0435\u043d \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 FreeBSD, OpenBSD \u0438 Solaris. \u041e\u043a\u043e\u043b\u043e 110 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u044b Ebury […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115823,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115822","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SSH backdoor, instaliran prilikom hakiranja kernel.org, ostao je neprimije\u0107en dvije godine | ProHoster","description":"Istra\u017eiva\u010di iz tvrtke ESET objavili su 43-strani izvje\u0161taj s analizom rootkita Ebury i povezanim aktivnostima.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SSH-\u0431\u044d\u043a\u0434\u043e\u0440, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u0432\u0437\u043b\u043e\u043c\u0435 kernel.org, \u0434\u0432\u0430 \u0433\u043e\u0434\u0430 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0441\u044f \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u043c | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-16T06:59:20+00:00","article:modified_time":"2024-05-16T06:59:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115822","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:22:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 00:28:19","updated":"2026-02-09 17:22:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/115822","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=115822"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/115822\/revisions"}],"predecessor-version":[{"id":159151,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/115822\/revisions\/159151"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/115823"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=115822"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=115822"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=115822"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}