{"id":115822,"date":"2024-05-16T08:59:20","date_gmt":"2024-05-16T06:59:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym"},"modified":"2024-05-16T08:59:20","modified_gmt":"2024-05-16T06:59:20","slug":"ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","title":{"rendered":"Backdoor-i SSH i instaluar gjat\u00eb komprometimit t\u00eb kernel.org mbeti i pazbuluar p\u00ebr dy vjet","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Studiuesit nga kompania ESET kan\u00eb publikuar nj\u00eb raport 43-faq\u00ebsh me analiz\u00ebn e rootkit-it Ebury dhe aktivitetit t\u00eb lidhur me t\u00eb. Sipas raportit, Ebury p\u00ebrdoret q\u00eb nga viti 2009 dhe q\u00eb at\u00ebher\u00eb \u00ebsht\u00eb instaluar n\u00eb m\u00eb shum\u00eb se 400 mij\u00eb server\u00eb me Linux, si dhe n\u00eb disa qindra sisteme t\u00eb bazuara n\u00eb FreeBSD, OpenBSD dhe Solaris. Rreth 110 mij\u00eb server\u00eb mbeteshin t\u00eb infektuar me Ebury deri n\u00eb fund t\u00eb vitit 2023. Studimi \u00ebsht\u00eb ve\u00e7an\u00ebrisht interesant duke pasur parasysh se Ebury u p\u00ebrdor edhe n\u00eb sulmin ndaj kernel.org, gj\u00eb q\u00eb zbulon disa detaje t\u00eb reja rreth komprometimit t\u00eb infrastruktur\u00ebs s\u00eb zhvillimit t\u00eb kernel-it Linux, t\u00eb identifikuar n\u00eb vitin 2011. Ebury u zbulua gjithashtu n\u00eb server\u00ebt e nj\u00eb regjistruesi domenesh, n\u00eb bursa kriptovalutash, n\u00eb nyje dal\u00ebse t\u00eb Tor dhe te disa t\u00eb ofruesve t\u00eb hostimit<\/a>persona, emrat e t\u00eb cil\u00ebve nuk b\u00ebhen publik\u00eb. <\/p>\n

Fillimisht mendohej se sulmuesit q\u00eb komprometuan server\u00ebt<\/a> agresor\u00ebt e kernel.org mbet\u00ebn t\u00eb paduksh\u00ebm p\u00ebr 17 dit\u00eb, por sipas t\u00eb dh\u00ebnave nga ESET, ky koh\u00eb \u00ebsht\u00eb llogaritur q\u00eb nga momenti i futur rrotkita Phalanx, nd\u00ebrsa backdoor Ebury ka qen\u00eb n\u00eb serverat q\u00eb nga viti 2009 dhe mund t\u00eb ket\u00eb p\u00ebrdorur acces root p\u00ebr rreth dy vjet. Malware Ebury dhe Phalanx jan\u00eb instaluar si pjes\u00eb e sulmeve t\u00eb ndryshme, q\u00eb nuk kan\u00eb pasur nd\u00ebrveprime me nj\u00ebra-tjetr\u00ebn dhe jan\u00eb realizuar nga grupe t\u00eb ndryshme agresor\u00ebsh. Futja e backdoor-it Ebury ka prekur t\u00eb pakt\u00ebn 4 servera n\u00eb infrastruktur\u00ebn e kernel.org, dy prej t\u00eb cil\u00ebve ishin t\u00eb prekur p\u00ebr af\u00ebrsisht dy vjet, nd\u00ebrsa dy t\u00eb tjer\u00eb - p\u00ebr 6 muaj. <\/p>\n

Sulmuesit mor\u00ebn akses te hash-et e fjal\u00ebkalimeve t\u00eb 551 p\u00ebrdoruesve t\u00eb ruajtura n\u00eb \/etc\/shadow, mes t\u00eb cil\u00ebve ishin t\u00eb gjith\u00eb mir\u00ebmbajt\u00ebsit e kernel-it (llogarit\u00eb p\u00ebrdoreshin p\u00ebr akses n\u00eb Git; pas incidentit fjal\u00ebkalimet u z\u00ebvend\u00ebsuan dhe modeli i aksesit u rishikua duke kaluar n\u00eb p\u00ebrdorimin e n\u00ebnshkrimeve dixhitale). P\u00ebr 257 p\u00ebrdorues, sulmuesit arrit\u00ebn t\u00eb p\u00ebrcaktonin fjal\u00ebkalimet n\u00eb form\u00eb t\u00eb hapur, me gjas\u00eb p\u00ebrmes thyerjes s\u00eb tyre nga hash-et dhe p\u00ebrmes kapjes nga komponenti keqdash\u00ebs Ebury t\u00eb fjal\u00ebkalimeve t\u00eb p\u00ebrdorura n\u00eb SSH. <\/p>\n

Komponenti keqdash\u00ebs Ebury shp\u00ebrndahej si nj\u00eb bibliotek\u00eb e p\u00ebrbashk\u00ebt q\u00eb, pas instalimit, nd\u00ebrhynte n\u00eb funksionet e p\u00ebrdorura nga OpenSSH p\u00ebr t\u00eb organizuar lidhje t\u00eb larg\u00ebt me sistemin me t\u00eb drejta root. Sulmi nuk ishte i synuar dhe, ashtu si mij\u00ebra hoste t\u00eb tjera t\u00eb prekura, server\u00ebt e kernel.org u p\u00ebrdor\u00ebn si pjes\u00eb e nj\u00eb botneti p\u00ebr d\u00ebrgimin e spam-it, vjedhjen e kredencialeve p\u00ebr p\u00ebrhapje n\u00eb sisteme t\u00eb tjera, ridrejtimin e trafikut web dhe kryerjen e veprimtarive t\u00eb tjera keqdash\u00ebse. <\/p>\n

P\u00ebr dep\u00ebrtim n\u00eb server\u00eb u p\u00ebrdor\u00ebn dob\u00ebsi t\u00eb papatchuara n\u00eb softuerin e serverit, p\u00ebr shembull dob\u00ebsi n\u00eb panelet e hostimit, ose fjal\u00ebkalime t\u00eb komprometuara (supozohet se server\u00ebt e kernel.org u shkel\u00ebn si rezultat i komprometimit t\u00eb fjal\u00ebkalimit t\u00eb nj\u00ebrit prej p\u00ebrdoruesve q\u00eb kishte shell-access). P\u00ebr rritjen e privilegjeve u p\u00ebrdor\u00ebn dob\u00ebsi si Dirty COW. <\/p>\n

Versionet e reja t\u00eb Ebury, t\u00eb p\u00ebrdorura vitet e fundit, p\u00ebrve\u00e7 backdoor-it p\u00ebrfshinin edhe funksione si module p\u00ebr Apache httpd p\u00ebr proksimin e trafikut, ridrejtimin e p\u00ebrdoruesve dhe kapjen e informacionit konfidencial, nj\u00eb modul kernel-i p\u00ebr t\u00eb b\u00ebr\u00eb ndryshime n\u00eb trafikun HTTP n\u00eb tranzit, mjete p\u00ebr t\u00eb fshehur trafikun e vet nga firewall-et, si dhe skripte p\u00ebr kryerjen e sulmeve AitM (Adversary-in-the-Middle, MiTM dykah\u00ebsh) p\u00ebr kapjen e kredencialeve SSH n\u00eb rrjetet e ofruesve t\u00eb hostimit.

\"Backdoor-i<\/center>
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e Ebury \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441 2009 \u0433\u043e\u0434\u0430 \u0438 \u0441 \u0442\u0435\u0445 \u043f\u043e\u0440 \u0431\u044b\u043b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 400 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Linux \u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0442\u0435\u043d \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 FreeBSD, OpenBSD \u0438 Solaris. \u041e\u043a\u043e\u043b\u043e 110 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u044b Ebury […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115823,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115822","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SSH-backdoor i instaluar gjat\u00eb komprometimit t\u00eb kernel.org mbeti i pazbuluar p\u00ebr dy vjet | ProHoster","description":"Studiuesit nga kompania ESET publikuan nj\u00eb raport prej 43 faqesh me analiz\u00ebn e rootkit-it Ebury dhe aktivitetit t\u00eb lidhur me t\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SSH-\u0431\u044d\u043a\u0434\u043e\u0440, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u0432\u0437\u043b\u043e\u043c\u0435 kernel.org, \u0434\u0432\u0430 \u0433\u043e\u0434\u0430 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0441\u044f \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u043c | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-16T06:59:20+00:00","article:modified_time":"2024-05-16T06:59:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115822","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:22:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 00:28:19","updated":"2026-02-09 17:22:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/115822","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=115822"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/115822\/revisions"}],"predecessor-version":[{"id":159151,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/115822\/revisions\/159151"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/115823"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=115822"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=115822"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=115822"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}