{"id":115822,"date":"2024-05-16T08:59:20","date_gmt":"2024-05-16T06:59:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym"},"modified":"2024-05-16T08:59:20","modified_gmt":"2024-05-16T06:59:20","slug":"ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","title":{"rendered":"Un backdoor SSH, instalat \u00een timpul hack-ului kernel.org, a r\u0103mas neobservat timp de doi ani","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la ESET au publicat un raport de 43 de pagini care analizeaz\u0103 rootkit-ul Ebury \u0219i activitatea asociat\u0103 acestuia. Se afirm\u0103 c\u0103 Ebury este utilizat din 2009 \u0219i a fost instalat pe mai mult de 400.000 de servere care ruleaz\u0103 Linux \u0219i pe c\u00e2teva sute de sisteme bazate pe FreeBSD, OpenBSD \u0219i Solaris. Aproximativ 110.000 de servere r\u0103m\u00e2neau afectate de Ebury la sf\u00e2r\u0219itul anului 2023. Studiul este deosebit de interesant av\u00e2nd \u00een vedere c\u0103 Ebury a fost implicat \u00een atacul asupra kernel.org, ceea ce dezv\u0103luie unele detalii noi despre compromiterea infrastructurii de dezvoltare a nucleului Linux, descoperit\u0103 \u00een 2011. Ebury a fost, de asemenea, identificat pe servere ale registratorilor de domenii, bursei de criptomonede, nodurilor de ie\u0219ire Tor \u0219i la c\u00e2\u021biva furnizori de g\u0103zduire<\/a>, ale c\u0103ror nume nu sunt dezv\u0103luite. <\/p>\n

Ini\u021bial, se presupunea c\u0103 atacatorii servere<\/a> Atacan\u021bii kernel.org au r\u0103mas neobserva\u021bi timp de 17 zile, dar datele de la ESET arat\u0103 c\u0103 aceast\u0103 durat\u0103 este calculat\u0103 de la momentul instal\u0103rii rootkit-ului Phalanx, \u00een timp ce backdoor-ul Ebury era prezent pe servere din 2009 \u0219i a fost utilizat timp de aproximativ doi ani pentru a ob\u021bine acces de root la servere. Malware-ul Ebury \u0219i Phalanx a fost instalat \u00een cadrul unor atacuri distincte, desf\u0103\u0219urate de grupuri diferite de atacatori. Implementarea backdoor-ului Ebury a afectat cel pu\u021bin 4 servere din infrastructura kernel.org, dintre care dou\u0103 au fost compromise timp de aproximativ doi ani, iar celelalte dou\u0103 - timp de 6 luni. <\/p>\n

Atacatorii au ob\u021binut acces la hash-urile parolelor a 551 de utilizatori din \/etc\/shadow, printre care se num\u0103rau to\u021bi men\u021bin\u0103torii nucleului (conturile erau utilizate pentru acces \u00een Git; dup\u0103 incident, parolele au fost schimbate, iar modelul de acces a fost revizuit \u0219i s-a trecut la utilizarea semn\u0103turilor digitale). Pentru 257 de utilizatori, atacatorilor le-a reu\u0219it s\u0103 identifice parolele \u00een clar, cel mai probabil printr-o metod\u0103 de \u00eencercare \u0219i eroare bazat\u0103 pe hash-uri \u0219i prin interceptarea parolelor utilizate \u00een SSH de c\u0103tre componenta malware Ebury. <\/p>\n

Componentul malicious Ebury a fost distribuit sub form\u0103 de bibliotec\u0103 partajat\u0103, care, dup\u0103 instalare, intercepta func\u021biile utilizate \u00een OpenSSH pentru a organiza o conexiune la sistem cu drepturi de root. Atacul nu a fost \u021bintit \u0219i, precum alte mii de servere afectate, serverele kernel.org au fost folosite ca parte a unui botnet pentru a trimite spam, pentru a fura date de autentificare \u00een vederea propag\u0103rii pe alte sisteme, pentru a redirec\u021biona traficul web \u0219i pentru a desf\u0103\u0219ura alte activit\u0103\u021bi d\u0103un\u0103toare. <\/p>\n

Pentru a penetra serverele, au fost utilizate vulnerabilit\u0103\u021bi necorectate \u00een software-ul serverului, de exemplu, vulnerabilit\u0103\u021bi \u00een panourile de control de hosting, sau parole interceptate (se presupune c\u0103 serverele kernel.org au fost compromise \u00een urma compromiterii parolei unui utilizator cu acces shell). Pentru a ob\u021bine privilegii mai mari, au fost utilizate vulnerabilit\u0103\u021bi precum Dirty COW. <\/p>\n

Noile versiuni de Ebury aplicate \u00een ultimii ani, pe l\u00e2ng\u0103 backdoor, au inclus func\u021bionalit\u0103\u021bi precum module pentru Apache httpd pentru a face proxy pentru trafic, redirec\u021bionarea utilizatorilor \u0219i interceptarea informa\u021biilor confiden\u021biale, un modul kernel pentru modificarea traficului HTTP \u00een tranzit, instrumente pentru a ascunde propriul trafic de firewalls, scripturi pentru a desf\u0103\u0219ura atacuri AitM (Adversary-in-the-Middle, MiTM bidirec\u021bional) pentru a intercepta datele de autentificare SSH \u00een re\u021belele furnizorilor de hosting.

\"Un<\/center>
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e Ebury \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441 2009 \u0433\u043e\u0434\u0430 \u0438 \u0441 \u0442\u0435\u0445 \u043f\u043e\u0440 \u0431\u044b\u043b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 400 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Linux \u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0442\u0435\u043d \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 FreeBSD, OpenBSD \u0438 Solaris. \u041e\u043a\u043e\u043b\u043e 110 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u044b Ebury […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115823,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115822","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Backdoor SSH, instalat \u00een urma compromiterii kernel.org, a r\u0103mas neobservat timp de doi ani | ProHoster","description":"Cercet\u0103torii de la ESET au publicat un raport de 43 de pagini cu analiza rootkitului Ebury \u0219i a activit\u0103\u021bilor asociate.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SSH-\u0431\u044d\u043a\u0434\u043e\u0440, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u0432\u0437\u043b\u043e\u043c\u0435 kernel.org, \u0434\u0432\u0430 \u0433\u043e\u0434\u0430 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0441\u044f \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u043c | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-16T06:59:20+00:00","article:modified_time":"2024-05-16T06:59:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115822","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:22:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 00:28:19","updated":"2026-02-09 17:22:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/115822","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=115822"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/115822\/revisions"}],"predecessor-version":[{"id":159151,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/115822\/revisions\/159151"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/115823"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=115822"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=115822"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=115822"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}