{"id":35281,"date":"2019-10-31T22:03:25","date_gmt":"2019-10-31T19:03:25","guid":{"rendered":"https:\/\/prohoster.info\/blog\/massovaya-ataka-na-uyazvimye-pochtovye-servery-na-osnove-exim\/"},"modified":"2019-10-31T22:03:25","modified_gmt":"2019-10-31T19:03:25","slug":"massovaya-ataka-na-uyazvimye-pochtovye-servery-na-osnove-exim","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/massovaya-ataka-na-uyazvimye-pochtovye-servery-na-osnove-exim","title":{"rendered":"Atac masiv asupra serverelor po\u0219tale vulnerabile bazate pe Exim","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii \u00een securitate de la Cybereason au avertizat<\/a><\/noindex> administratorilor de servere de email despre detectarea unui atac automatizat \u00een mas\u0103, care exploateaz\u0103 o vulnerabilitate critic\u0103<\/a><\/noindex> (CVE-2019-10149) \u00een Exim, descoperit\u0103 s\u0103pt\u0103m\u00e2na trecut\u0103. \u00cen timpul atacului, atacatorii reu\u0219esc s\u0103 execute codul lor cu privilegii de root \u0219i instaleaz\u0103 pe server malware pentru mineritul criptomonedelor.<\/p>\n

Conform statisticilor din iunie, sondare automatizat\u0103<\/a><\/noindex> Cota Exim este de 57.05% (anul trecut 56.56%), Postfix este utilizat pe 34.52% (33.79%) din serverele de po\u0219t\u0103, Sendmail \u2014 4.05% (4.59%), Microsoft Exchange \u2014 0.57% (0.85%). Pe informa\u021biile<\/a><\/noindex> serviciului Shodan, peste 3.6 milioane de servere de email r\u0103m\u00e2n poten\u021bial vulnerabile \u00een re\u021beaua global\u0103, care nu au fost actualizate la ultima versiune disponibil\u0103 Exim 4.92. Aproximativ 2 milioane de servere poten\u021bial vulnerabile sunt g\u0103zduite \u00een SUA, 192 de mii \u00een Rusia. Conform informa\u021bii<\/a><\/noindex> companiei RiskIQ, 70% din serverele cu Exim au migrat deja la versiunea 4.92.<\/p>\n

\"Atac<\/center><\/p>\n

Administratorii sunt sf\u0103tui\u021bi s\u0103 instaleze de urgen\u021b\u0103 actualiz\u0103rile, care au fost preg\u0103tite \u00eenc\u0103 de s\u0103pt\u0103m\u00e2na trecut\u0103 de distribu\u021bii (Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, openSUSE<\/a><\/noindex>, Arch Linux<\/a><\/noindex>, Fedora<\/a><\/noindex>, EPEL pentru RHEL\/CentOS<\/a><\/noindex>). \u00cen cazul \u00een care sistemul con\u021bine vulnerabilit\u0103\u021bi din versiunile Exim (\u00eentre 4.87 \u0219i 4.91 inclusiv), este necesar s\u0103 se verifice dac\u0103 sistemul nu a fost compromis, control\u00e2nd crontab pentru apeluri suspecte \u0219i asigur\u00e2ndu-se c\u0103 nu exist\u0103 chei suplimentare \u00een directorul \/root\/.ssh. O activitate suspect\u0103 \u00een jurnalul firewall-ului din adresele an7kmd2wp4xo7hpr.tor2web.su, an7kmd2wp4xo7hpr.tor2web.io \u0219i an7kmd2wp4xo7hpr.onion.sh poate indica de asemenea un atac, acestea fiind utilizate \u00een procesul de desc\u0103rcare a malware-ului. <\/p>\n

Primele \u00eencerc\u0103ri de atac asupra serverelor Exim au fost observate<\/a><\/noindex> au avut loc pe 9 iunie. P\u00e2n\u0103 pe 13 iunie, atacul a luat<\/a><\/noindex> caracterul<\/a><\/noindex> masiv. Dup\u0103 exploatarea vulnerabilit\u0103\u021bii prin portalurile tor2web de pe serviciul ascuns Tor (an7kmd2wp4xo7hpr) este desc\u0103rcat un script, care verific\u0103 existen\u021ba OpenSSH (dac\u0103 nu exist\u0103, instaleaz\u0103<\/a><\/noindex>), schimb\u0103 set\u0103rile (permite<\/a><\/noindex> accesul cu root \u0219i autentificarea prin chei) \u0219i seteaz\u0103 pentru utilizatorul root o cheie RSA<\/a><\/noindex>, care ofer\u0103 acces privilegiat la sistem prin SSH.<\/p>\n

Dup\u0103 configurarea unui backdoor \u00een sistem, se instaleaz\u0103 un scanner de porturi pentru a identifica alte servere vulnerabile. De asemenea, se caut\u0103 \u00een sistem minerii de criptomonede deja existen\u021bi, care sunt \u0219ter\u0219i \u00een cazul \u00een care sunt g\u0103si\u021bi. \u00cen ultima etap\u0103, se \u00eencarc\u0103 \u0219i se registreaz\u0103 \u00een crontab un miner propriu. Minerul este \u00eenc\u0103rcat sub forma unui fi\u0219ier ico (de fapt este un arhiv\u0103 zip cu parola \u201eno-password\u201d), \u00een care este ambalat un fi\u0219ier executabil \u00een format ELF pentru Linux cu Glibc 2.7+.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Cybereason \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-10149) \u0432 Exim, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435. \u0412 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0434\u043e\u0431\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0434\u043b\u044f \u043c\u0430\u0439\u043d\u0438\u043d\u0433\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442. \u0412 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0438\u044e\u043d\u044c\u0441\u043a\u0438\u043c \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043e\u043f\u0440\u043e\u0441\u043e\u043c \u0434\u043e\u043b\u044f Exim \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 57.05% (\u0433\u043e\u0434 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26492,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35281","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Atacuri de amploare asupra serverelor po\u0219tale vulnerabile bazate pe Exim | ProHoster","description":"Cercet\u0103torii \u00een securitate de la compania Cybereason au avertizat.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/massovaya-ataka-na-uyazvimye-pochtovye-servery-na-osnove-exim","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Exim | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Cybereason \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/massovaya-ataka-na-uyazvimye-pochtovye-servery-na-osnove-exim","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:03:25+00:00","article:modified_time":"2019-10-31T19:03:25+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35281","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 22:39:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:06:25","updated":"2026-01-21 22:39:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/35281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=35281"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/35281\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/26492"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=35281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=35281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=35281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}