6 ms·

https://www.reddit.com/r/technology/comments/34m5d5/unnoticed_for_years_malware_turned_linux_and_bsd/ https://www.reddit.com/r/technology/comments/34m5d5/unnoti

by Hello71 11y ago

https://www.reddit.com/r/technology/comments/34m5d5/unnoticed_for_years_malware_turned_linux_and_bsd/ https://www.reddit.com/r/technology/comments/34m5d5/unnotice... top comment: > If it was unnoticed for years then the sysadmins were shit. Why is this newsworthy? > > Any sysadmin worth their salt will be monitoring the systems they manage. This thing made outgoing connections every 15 minutes using a cron job. Any 15 year old can create "malware" like this. If you do not notice this for years, you shouldn't be allowed to manage servers.

mhurron 11y ago
Not to say there aren't a lot of shitty admins, however - > compromised via Joomla and Wordpress exploits Lots of Wordpress installations are not run by someone who should know better. Hell a lot of servers on the internet are run by people who shouldn't manage servers, not because they're lazy, but because they're aren't admins. Many tools have been created to let people without knowing how to do things do them but the security of those tools has not kept up.
- ChuckMcM 11y ago
  One of my ops folks characterized Wordpress as a rootkit with a blogging package ride along. So hard not to see the ultimate truth in that
  - DCoder 11y ago
    That observation is probably related to http://www.bash.org/?949214 http://www.bash.org/?949214 :)
sliverstorm 11y ago
What would your monitoring strategy of choice be to notice these things, for a small "hobby" server? I've apprenticed as a junior sysadmin in the past, and I can easily see how a professional operation would detect or prevent this by design. But a lot of those methods are more than a little over the top for a one-of, single-user, low-end VPS.
- noinsight 11y ago
  I agree that this is a problem and I've been researching this for some time now. Ideally you would want a HIDS system for small deployments (i.e. a single server) but there doesn't seem to exist too many of those and there's little information about them online (as far as I can find). OSSEC is one example but I'm not convinced it installs too cleanly. At least FreeBSD has a package for it however. Actual configuration would be a mystery. I think information about this sort of stuff (intrusion detection) seems to be hard to come by in general. At least stuff that is written by knowledgeable people. I haven't seen much about it from major vendors either - it seems to be a black box kind of technology. I'd love to have a "lightweight" simple daemon that does this. I guess ideally you would monitor logs for stuff, user and group modifications, cron additions etc.
  - sliverstorm 11y ago
    I tried using AIDE for a while, but it was a mild PITA and I was never convinced an attacker with a brain couldn't just patch the database to hide his changes.
  - detaro 11y ago
    tripwire, rkhunter, ... are relatively simple options. And then hope that your configuration prevents the attacker from getting root or if they do, then they/their automated scripts are not prepared to break them.
    - noinsight 11y ago
      RE: hashing files and whatnot: FreeBSD with a high enough securelevel allows you to set files append-only or immutable so that not even root can touch them. But then updating the index becomes problematic, you would need to create delta files (which themselves are also immutable) that contain the changed information and combine the data. Even then, I'm not convinced you could get that much valuable information from a full filesystem hash (or whatever) scan. The amount of information would probably be overwhelming. You would need to apply heuristics or filters. Checking filetypes with libmagic would work, mostly. You could only alert on new executables or whatever, etc..

by Hello71 11y ago

mhurron 11y ago

Not to say there aren't a lot of shitty admins, however - > compromised via Joomla and Wordpress exploits Lots of Wordpress installations are not run by someone who should know better. Hell a lot of servers on the internet are run by people who shouldn't manage servers, not because they're lazy, but because they're aren't admins. Many tools have been created to let people without knowing how to do things do them but the security of those tools has not kept up.

ChuckMcM 11y ago
One of my ops folks characterized Wordpress as a rootkit with a blogging package ride along. So hard not to see the ultimate truth in that
- DCoder 11y ago
  That observation is probably related to http://www.bash.org/?949214 http://www.bash.org/?949214 :)

sliverstorm 11y ago

What would your monitoring strategy of choice be to notice these things, for a small "hobby" server? I've apprenticed as a junior sysadmin in the past, and I can easily see how a professional operation would detect or prevent this by design. But a lot of those methods are more than a little over the top for a one-of, single-user, low-end VPS.

noinsight 11y ago
I agree that this is a problem and I've been researching this for some time now. Ideally you would want a HIDS system for small deployments (i.e. a single server) but there doesn't seem to exist too many of those and there's little information about them online (as far as I can find). OSSEC is one example but I'm not convinced it installs too cleanly. At least FreeBSD has a package for it however. Actual configuration would be a mystery. I think information about this sort of stuff (intrusion detection) seems to be hard to come by in general. At least stuff that is written by knowledgeable people. I haven't seen much about it from major vendors either - it seems to be a black box kind of technology. I'd love to have a "lightweight" simple daemon that does this. I guess ideally you would monitor logs for stuff, user and group modifications, cron additions etc.
- sliverstorm 11y ago
  I tried using AIDE for a while, but it was a mild PITA and I was never convinced an attacker with a brain couldn't just patch the database to hide his changes.
- detaro 11y ago
  tripwire, rkhunter, ... are relatively simple options. And then hope that your configuration prevents the attacker from getting root or if they do, then they/their automated scripts are not prepared to break them.
  - noinsight 11y ago
    RE: hashing files and whatnot: FreeBSD with a high enough securelevel allows you to set files append-only or immutable so that not even root can touch them. But then updating the index becomes problematic, you would need to create delta files (which themselves are also immutable) that contain the changed information and combine the data. Even then, I'm not convinced you could get that much valuable information from a full filesystem hash (or whatever) scan. The amount of information would probably be overwhelming. You would need to apply heuristics or filters. Checking filetypes with libmagic would work, mostly. You could only alert on new executables or whatever, etc..