{"id":115822,"date":"2024-05-16T08:59:20","date_gmt":"2024-05-16T06:59:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym"},"modified":"2024-05-16T08:59:20","modified_gmt":"2024-05-16T06:59:20","slug":"ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","title":{"rendered":"SSH-backdoor, i instaluar gjat\u00eb sulmit n\u00eb kernel.org, ka mbetur i paduksh\u00ebm p\u00ebr dy vjet.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

K\u00ebrkuesit nga kompania ESET publikuan nj\u00eb raport 43-faqesh q\u00eb analizon rootkit-in Ebury dhe aktivitetet e lidhura me t\u00eb. Thuhet se Ebury \u00ebsht\u00eb p\u00ebrdorur q\u00eb nga viti 2009 dhe q\u00eb at\u00ebher\u00eb \u00ebsht\u00eb instaluar n\u00eb m\u00eb shum\u00eb se 400 mij\u00eb servera n\u00ebn sistemin Linux dhe disa qindra sisteme t\u00eb bazuara n\u00eb FreeBSD, OpenBSD dhe Solaris. Rreth 110 mij\u00eb servera mbet\u00ebn t\u00eb prekur nga Ebury deri n\u00eb fund t\u00eb vitit 2023. Ky studim p\u00ebrb\u00ebn nj\u00eb interes t\u00eb ve\u00e7ant\u00eb duke pasur parasysh se Ebury ishte p\u00ebrfshir\u00eb n\u00eb sulmin ndaj kernel.org, duke zbuluar disa detaje t\u00eb reja mbi kompromitimin e infrastruktur\u00ebs s\u00eb zhvillimit t\u00eb kernelit Linux, e identifikuar n\u00eb vitin 2011. Ebury gjithashtu u zbulua n\u00eb serverat e regjistruesve t\u00eb domain-eve, n\u00eb platforma k\u00ebmbimi kriptomonedhash, n\u00eb nyjat e daljes t\u00eb Tor dhe te disa ofruesve t\u00eb hostimit<\/a>, emrat e t\u00eb cil\u00ebve nuk jan\u00eb p\u00ebrmendur. <\/p>\n

Fillimisht mendohej se sulmuesit hostingut<\/a> T\u00eb dh\u00ebnat tregojn\u00eb se hakerat n\u00eb kernel.org kan\u00eb q\u00ebndruar t\u00eb pad\u00ebshmuar p\u00ebr 17 dit\u00eb, por sipas ESET, ky koha llogaritet nga momenti i vendosjes s\u00eb rrotak\u00ebs Phalanx. B\u00ebk\u00ebdoori Ebury ka qen\u00eb n\u00eb serverat q\u00eb nga viti 2009 dhe p\u00ebr rreth dy vjet mund t\u00eb jet\u00eb p\u00ebrdorur p\u00ebr t\u00eb fituar qasje root n\u00eb servera. Malware Ebury dhe Phalanx jan\u00eb instaluar n\u00eb kuad\u00ebr t\u00eb sulmeve t\u00eb ndryshme, t\u00eb cilat nuk kan\u00eb pasur nd\u00ebrlidhje me nj\u00ebra-tjetr\u00ebn dhe jan\u00eb kryer nga grupe t\u00eb ndryshme hakerash. Ngritja e b\u00ebk\u00ebdoorit Ebury ka prekur s\u00eb paku 4 servera n\u00eb infrastruktur\u00ebn e kernel.org, dy prej t\u00eb cil\u00ebve jan\u00eb sulmuar p\u00ebr af\u00ebrsisht dy vjet, nd\u00ebrsa dy t\u00eb tjer\u00ebt \u2014 p\u00ebr gjasht\u00eb muaj. <\/p>\n

Sulmuesit mor\u00ebn akses n\u00eb hash-at e fjal\u00ebkalimeve t\u00eb 551 p\u00ebrdoruesve q\u00eb ruheshin n\u00eb \/etc\/shadow, p\u00ebrfshir\u00eb t\u00eb gjith\u00eb mir\u00ebmbajt\u00ebsit e kernelit (llogarit\u00eb u p\u00ebrdor\u00ebn p\u00ebr akses n\u00eb Git; pas incidentit, fjal\u00ebkalimet u z\u00ebvend\u00ebsuan, dhe modeli i aksesit u rishikua dhe u kalua n\u00eb p\u00ebrdorimin e n\u00ebnshkrimeve digitale). P\u00ebr 257 p\u00ebrdoruesit, sulmuesve iu arrit t\u00eb identifikonin fjal\u00ebkalimet n\u00eb m\u00ebnyr\u00eb t\u00eb hapur, p\u00ebr sa duket p\u00ebrmes provave t\u00eb fjal\u00ebkalimeve nga hash-at dhe p\u00ebrmes kapjes nga komponenti malinj Ebury t\u00eb fjal\u00ebkalimeve t\u00eb p\u00ebrdorura n\u00eb SSH. <\/p>\n

Komponenti malinj Ebury u p\u00ebrhap si nj\u00eb bibliotek\u00eb e ndar\u00eb, q\u00eb pas instalimit kapte funksionet e p\u00ebrdorura n\u00eb OpenSSH, p\u00ebr t\u00eb organizuar lidhje t\u00eb larg\u00ebta me sistemin me t\u00eb drejta root. Sulmi nuk ishte i synuar dhe, ashtu si \u00e7do tjet\u00ebr nga mij\u00ebra hoste t\u00eb prekur, serverat kernel.org u p\u00ebrdor\u00ebn si pjes\u00eb e nj\u00eb botnet-i p\u00ebr d\u00ebrgimin e spam-it, vjedhjen e akteve t\u00eb identifikimit p\u00ebr shp\u00ebrndarje n\u00eb sisteme t\u00eb tjera, ridrejtimin e trafikut web dhe kryerjen e aktiviteteve t\u00eb tjera t\u00eb d\u00ebmshme. <\/p>\n

P\u00ebr t\u00eb dep\u00ebrtuar n\u00eb servera u p\u00ebrdor\u00ebn vulnerabilitete t\u00eb pap\u00ebrmir\u00ebsuara n\u00eb softuerin e server\u00ebve, p\u00ebr shembull, vulnerabilitete n\u00eb panelet e hostimit, ose fjal\u00ebkalime t\u00eb kapura (supozon se server\u00ebt kernel.org u rr\u00ebzuan si rezultat i kompromitimit t\u00eb fjal\u00ebkalimit t\u00eb nj\u00ebrit prej p\u00ebrdoruesve q\u00eb kishte qasje shell). P\u00ebr t\u00eb rritur privilegjet u p\u00ebrdor\u00ebn vulnerabilitete si Dirty COW. <\/p>\n

Versionet e reja t\u00eb Ebury q\u00eb jan\u00eb p\u00ebrdorur n\u00eb vitet e fundit, p\u00ebrve\u00e7 backdoor-it, p\u00ebrfshinin mund\u00ebsi t\u00eb tilla si module p\u00ebr Apache httpd p\u00ebr proxy-imin e trafik, ridrejtimin e p\u00ebrdoruesve dhe kapjen e informacionit t\u00eb ndjesh\u00ebm, module b\u00ebrthamore p\u00ebr t\u00eb b\u00ebr\u00eb ndryshime n\u00eb trafik HTTP kalimtar, mjete p\u00ebr t\u00eb fshehur trafik t\u00eb vet p\u00ebrgjat\u00eb firewall-eve, skripta p\u00ebr kryerjen e sulmeve AitM (Adversary-in-the-Middle, MiTM dyansh\u00ebm) p\u00ebr kapjen e akteve t\u00eb identifikimit SSH n\u00eb rrjetet e ofruesve t\u00eb hostimit.

\"SSH-backdoor,<\/center>
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e Ebury \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441 2009 \u0433\u043e\u0434\u0430 \u0438 \u0441 \u0442\u0435\u0445 \u043f\u043e\u0440 \u0431\u044b\u043b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 400 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Linux \u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0442\u0435\u043d \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 FreeBSD, OpenBSD \u0438 Solaris. \u041e\u043a\u043e\u043b\u043e 110 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u044b Ebury […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115823,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115822","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SSH-backdoor, i vendosur gjat\u00eb thyerjes s\u00eb kernel.org, mbeti i paduksh\u00ebm p\u00ebr dy vjet | ProHoster","description":"K\u00ebrkuesit nga kompania ESET publikuan nj\u00eb raport 43-faqesh q\u00eb analizon rootkit-in Ebury dhe aktivitetet e lidhura me t\u00eb. Thuhet se Ebury \u00ebsht\u00eb p\u00ebrdorur q\u00eb nga viti 2009 dhe q\u00eb at\u00ebher\u00eb \u00ebsht\u00eb instaluar n\u00eb m\u00eb shum\u00eb se 400 mij\u00eb servera n\u00ebn sistemin Linux dhe disa qindra sisteme t\u00eb bazuara n\u00eb FreeBSD, OpenBSD dhe Solaris. Rreth 110 mij\u00eb servera mbet\u00ebn t\u00eb prekur nga Ebury","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SSH-\u0431\u044d\u043a\u0434\u043e\u0440, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u0432\u0437\u043b\u043e\u043c\u0435 kernel.org, \u0434\u0432\u0430 \u0433\u043e\u0434\u0430 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0441\u044f \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u043c | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 43-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0451\u0442 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Ebury \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043d\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438. \u0423\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e Ebury \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0441 2009 \u0433\u043e\u0434\u0430 \u0438 \u0441 \u0442\u0435\u0445 \u043f\u043e\u0440 \u0431\u044b\u043b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 400 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Linux \u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0442\u0435\u043d \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 FreeBSD, OpenBSD \u0438 Solaris. \u041e\u043a\u043e\u043b\u043e 110 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u044b Ebury","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ssh-bekdor-ustanovlennyj-pri-vzlome-kernel-org-dva-goda-ostavalsya-nezamechennym","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-16T06:59:20+00:00","article:modified_time":"2024-05-16T06:59:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115822","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:22:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 00:28:19","updated":"2026-02-09 17:22:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/115822","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=115822"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/115822\/revisions"}],"predecessor-version":[{"id":159151,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/115822\/revisions\/159151"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/115823"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=115822"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=115822"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=115822"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}