{"id":115822,"date":"2024-05-16T08:59:20","date_gmt":"2024-05-16T06:59:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym"},"modified":"2024-05-16T08:59:20","modified_gmt":"2024-05-16T06:59:20","slug":"ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","title":{"rendered":"Az SSH-h\u00e1ts\u00f3 ajt\u00f3, amely a kernel.org felt\u00f6r\u00e9s\u00e9vel ker\u00fclt telep\u00edt\u00e9sre, k\u00e9t \u00e9vig \u00e9szrev\u00e9tlen maradt","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Az ESET kutat\u00f3i k\u00f6zz\u00e9tettek egy 43 oldalas jelent\u00e9st az Ebury rootkit elemz\u00e9s\u00e9vel \u00e9s a hozz\u00e1 kapcsol\u00f3d\u00f3 tev\u00e9kenys\u00e9gekkel kapcsolatban. \u00c1ll\u00edtj\u00e1k, hogy az Ebury 2009 \u00f3ta m\u0171k\u00f6dik, \u00e9s eddig t\u00f6bb mint 400 000 Linux alap\u00fa szerveren, valamint t\u00f6bb sz\u00e1z FreeBSD, OpenBSD \u00e9s Solaris rendszeren telep\u00edtett\u00e9k. 2023 v\u00e9g\u00e9ig k\u00f6r\u00fclbel\u00fcl 110 000 szerver volt m\u00e9g mindig Ebury \u00e1ltal fert\u0151z\u00f6tt. A kutat\u00e1s k\u00fcl\u00f6n\u00f6s jelent\u0151s\u00e9ggel b\u00edr, figyelembe v\u00e9ve, hogy az Ebury r\u00e9szt vett a kernel.org elleni t\u00e1mad\u00e1sban, ami \u00faj r\u00e9szleteket t\u00e1r fel a Linux kernel fejleszt\u00e9si infrastrukt\u00far\u00e1j\u00e1nak kompromitt\u00e1l\u00e1s\u00e1r\u00f3l, amely 2011-ben der\u00fclt ki. Az Ebury-t domain regisztr\u00e1torok szerverein, kriptovaluta t\u0151zsd\u00e9ken, Tor kimeneti csom\u00f3pontokon \u00e9s flere host szolg\u00e1ltat\u00f3k<\/a>, akiknek nev\u00e9t nem hozz\u00e1k nyilv\u00e1noss\u00e1gra. <\/p>\n

Kezdetben azt felt\u00e9telezt\u00e9k, hogy a t\u00e1mad\u00f3k szerverek<\/a> A kernel.org t\u00e1mad\u00f3i 17 napig \u00e9szrev\u00e9tlenek maradtak, de az ESET adatai szerint ez az id\u0151tartam a Phalanx rootkit telep\u00edt\u00e9s\u00e9t\u0151l sz\u00e1m\u00edtva \u00e1llt fenn, m\u00edg az Ebury h\u00e1ts\u00f3ajt\u00f3 m\u00e1r 2009 \u00f3ta a szervereken volt, \u00e9s k\u00f6r\u00fclbel\u00fcl k\u00e9t \u00e9vig haszn\u00e1lhat\u00f3 volt a szerverekhez val\u00f3 root hozz\u00e1f\u00e9r\u00e9s megszerz\u00e9s\u00e9re. Az Ebury \u00e9s Phalanx rosszindulat\u00fa programokat k\u00fcl\u00f6nb\u00f6z\u0151, egym\u00e1ssal nem \u00f6sszefon\u00f3d\u00f3 t\u00e1mad\u00e1sok keret\u00e9ben telep\u00edtett\u00e9k, amelyeket k\u00fcl\u00f6nb\u00f6z\u0151 b\u0171n\u00f6z\u0151 csoportok hajtottak v\u00e9gre. Az Ebury h\u00e1ts\u00f3ajt\u00f3 legal\u00e1bb 4 szervert \u00e9rintett a kernel.org infrastrukt\u00far\u00e1j\u00e1ban, ezek k\u00f6z\u00fcl kett\u0151 k\u00f6r\u00fclbel\u00fcl k\u00e9t \u00e9ve volt fert\u0151z\u00f6tt, a m\u00e1sik kett\u0151 pedig 6 h\u00f3napig. <\/p>\n

A t\u00e1mad\u00f3k hozz\u00e1f\u00e9rtek a \/etc\/shadow f\u00e1jlban t\u00e1rolt 551 felhaszn\u00e1l\u00f3 jelszav\u00e1nak hash \u00e9rt\u00e9keihez, bele\u00e9rtve a kernel minden karbantart\u00f3j\u00e1t (a fi\u00f3kokat Git hozz\u00e1f\u00e9r\u00e9sre haszn\u00e1lt\u00e1k; az incidens ut\u00e1n a jelszavakat megv\u00e1ltoztatt\u00e1k, \u00e9s a hozz\u00e1f\u00e9r\u00e9si modellt \u00e1ttekintett\u00e9k, digitalis al\u00e1\u00edr\u00e1sokra v\u00e1ltottak). 257 felhaszn\u00e1l\u00f3 eset\u00e9ben a t\u00e1mad\u00f3knak siker\u00fclt tiszt\u00e1n azonos\u00edtaniuk a jelszavakat, feltehet\u0151en a hash \u00e9rt\u00e9kekhez t\u00f6rt\u00e9n\u0151 jelsz\u00f3keres\u00e9ssel \u00e9s az Ebury rosszindulat\u00fa \u00f6sszetev\u0151 \u00e1ltali SSH jelszavak lehallgat\u00e1s\u00e1val. <\/p>\n

A k\u00e1ros Ebury komponens megosztott k\u00f6nyvt\u00e1rk\u00e9nt terjedt, amely telep\u00edt\u00e9se ut\u00e1n megfigyelte az OpenSSH \u00e1ltal haszn\u00e1lt funkci\u00f3kat, hogy t\u00e1voli hozz\u00e1f\u00e9r\u00e9st biztos\u00edtson a rendszerhez root jogosults\u00e1gokkal. A t\u00e1mad\u00e1s nem c\u00e9lzott volt, \u00e9s a kernel.org szerverek, mint m\u00e1s ezer \u00e9rintett hoszt, a spamk\u00fcld\u00e9s, hiteles\u00edt\u0151 adatok lop\u00e1sa m\u00e1s rendszerek elleni elterel\u00e9s \u00e9s egy\u00e9b k\u00e1ros tev\u00e9kenys\u00e9gek r\u00e9szek\u00e9nt botnetk\u00e9nt haszn\u00e1lt\u00e1k. <\/p>\n

A szerverekre val\u00f3 behatol\u00e1s sor\u00e1n a szerver szoftver\u00e9ben tal\u00e1lhat\u00f3 jav\u00edtatlan s\u00e9r\u00fcl\u00e9kenys\u00e9geket, p\u00e9ld\u00e1ul a webhosting paneleiben l\u00e9v\u0151 hib\u00e1kat, vagy ellopott jelszavakat haszn\u00e1ltak (feltehet\u0151en a kernel.org szervereket egy shell-hozz\u00e1f\u00e9r\u00e9si joggal rendelkez\u0151 felhaszn\u00e1l\u00f3 jelszav\u00e1nak kompromitt\u00e1l\u00e1s\u00e1val t\u00f6rt\u00e9k fel). A jogosults\u00e1gok emel\u00e9s\u00e9re olyan s\u00e9r\u00fcl\u00e9kenys\u00e9geket alkalmaztak, mint a Dirty COW. <\/p>\n

Az ut\u00f3bbi \u00e9vekben haszn\u00e1lt \u00faj Ebury verzi\u00f3k, a h\u00e1ts\u00f3ajt\u00f3 mellett, olyan k\u00e9pess\u00e9geket is tartalmaztak, mint az Apache httpd modulok forgalom proxiz\u00e1s\u00e1ra, felhaszn\u00e1l\u00f3k \u00e1tir\u00e1ny\u00edt\u00e1s\u00e1ra \u00e9s bizalmas inform\u00e1ci\u00f3k megfigyel\u00e9s\u00e9re, egy kernelmodul a tranzit HTTP-forgalom m\u00f3dos\u00edt\u00e1s\u00e1ra, eszk\u00f6z\u00f6k a saj\u00e1t forgalom elrejt\u00e9s\u00e9re t\u0171zfalak el\u0151l, valamint szkriptek AitM t\u00e1mad\u00e1sok lebonyol\u00edt\u00e1s\u00e1ra (Adversary-in-the-Middle, k\u00e9tt\u00e9nyez\u0151s MiTM) az SSH hiteles\u00edt\u0151 adatok megszerz\u00e9s\u00e9hez a hosting szolg\u00e1ltat\u00f3k h\u00e1l\u00f3zataiban.

\"Az<\/center>
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e Ebury \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441 2009 \u0433\u043e\u0434\u0430 \u0438 \u0441 \u0442\u0435\u0445 \u043f\u043e\u0440 \u0431\u044b\u043b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 400 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Linux \u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0442\u0435\u043d \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 FreeBSD, OpenBSD \u0438 Solaris. \u041e\u043a\u043e\u043b\u043e 110 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u044b Ebury […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115823,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115822","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Az SSH h\u00e1ts\u00f3ajt\u00f3, amelyet a kernel.org hackel\u00e9se sor\u00e1n telep\u00edtettek, k\u00e9t \u00e9vig \u00e9szrev\u00e9tlen maradt | ProHoster","description":"Az ESET kutat\u00f3i 43 oldalas jelent\u00e9st tettek k\u00f6zz\u00e9 az Ebury rootkitr\u0151l \u00e9s a hozz\u00e1 kapcsol\u00f3d\u00f3 tev\u00e9kenys\u00e9gekr\u0151l.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SSH-\u0431\u044d\u043a\u0434\u043e\u0440, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u0432\u0437\u043b\u043e\u043c\u0435 kernel.org, \u0434\u0432\u0430 \u0433\u043e\u0434\u0430 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0441\u044f \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u043c | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-16T06:59:20+00:00","article:modified_time":"2024-05-16T06:59:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115822","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:22:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 00:28:19","updated":"2026-02-09 17:22:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/115822","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=115822"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/115822\/revisions"}],"predecessor-version":[{"id":159151,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/115822\/revisions\/159151"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/115823"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=115822"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=115822"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=115822"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}