2

I've installed ubuntu server 12.04 on VM two weeks ago. I've created regular snapshots. XXX time ago I've noticed unusual activity and I've found that a backdoor was installed into my server. One of backdoored files was sshd. Ive then analysed the logs and found the host which connected to my server in the first place (using my account password). The same method I've extracted from backdoored sshd worked for accessing the root account of attacking host. I've found significant amount of infected hosts (analysing attacking host's logs). And I've compared the running software. I believe I've isolated the daemon that is vulnerable.

In normal situations I would just format the VM and create a new one (I was using it just for development) but it had the latest stable ubuntu 12.04 linux. (14.04 was released days after I've created the VM) However this seems like a serios vulnerability by the number of infected hosts (and some other sensitive data) and by the fact that my server was running the latest version with all security updates and it still got hacked.

And to get to the question - What should I do next?

(I've got all the snapshots (before infection, after that), access to a lot of infected machines, and an infected server VM part of some kind of botnet that scans and infects other hosts, and some knowledge what other activites it does)

PS: Its not heartbleed as my server's openssl version is : OpenSSL 1.0.1 14 Mar 2012 built on: Mon Apr 7 20:33:29 UTC 2014

And the service I believe is vulnerable has no known vulnerabilities.

PPS: How can I check if this is known exploit?

Improve this question
7
  • You say "Ive then analysed the logs and found the host which connected to my server in the first place (using my account password). The same method I've extracted from backdoored sshd worked for accessing the root account of attacking host." - are you sure somebody did not just steal your credendials and went 'sudo -s'? Also, when you talk about "significant amount of infected hosts" - do you mean in the same domain (i.e. using the same credentials) or from the outside world?
    – lorenzog
    Commented May 1, 2014 at 13:38
  • 1
    I'm not sure that my credentials werent stolen using different means. Other infected hosts are outside my network (and country). I accessed them with password extracted from the backdoored sshd on my machine. Other hosts are running different os versions including BSD.
    – Emski
    Commented May 1, 2014 at 13:49
  • The Heartbleed bug is not dependent -directly- on the version of OpenSSL you are using but rather the certificate(s) you are using.
    – Matthew Peters
    Commented May 1, 2014 at 17:55
  • 1
    I had the impression that the builds after Apr 7th are safe. Any reference?
    – Emski
    Commented May 2, 2014 at 15:53
  • 2
    good lord people get your facts straight before commenting heartbleed is based on the OpenSSL version and whilst some 1.0.1 versions are affected, others are not. From a brief google it would appear that @Emski is correct April 7 or later builds are not vulnerable (not to say that this server wasn't vulnerable at any point in time of course) Either way Heartbleed in the general case is a memory leak not something that would provide immediate shell access to the server...
    – Rory McCune
    Commented May 3, 2014 at 18:05

2 Answers 2

Reset to default
3

To report a security vulnerability in an Ubuntu package, please file a bug, or contact [email protected].

http://www.ubuntu.com/usn/

Improve this answer
3
  • Good suggestion. However I do not know what the vulnerability is. I just suspect which one is the vulnerable package. The only proof I have is the access to compromised servers and the common software packages I've found on them.
    – Emski
    Commented May 1, 2014 at 12:31
  • 2
    It's not a production VM. Do you have logs and directorie listings to prove your case? If so mail them. Zip programs you found. Can you give them access? Set up SSH for them if they want to. My guess is you're hacked, and this is not a problem that Ubuntu or Debian has to fix.
    – SPRBRN
    Commented May 1, 2014 at 12:35
  • I'd agree with @SPRBRN on this, report it to Ubuntu in the first instance and provide as much info. as you can on the vuln. If they don't respond then you can look at other avenues (developer of the service, CERT, Full Disclosure, etc)
    – Rory McCune
    Commented May 3, 2014 at 18:09
0

There is Linux, there is Ubuntu, and then there is the developer of affected daemon. I'd notify them all. You could go the Full Disclosure route but now I'll ask what will also be asked when you report this. You stated: "I had the latest security updates" for what? Ubuntu, Linux, the daemon that got hacked? Each is a separate entity and just because you updated Ubuntu doesn't necessarily mean Ubuntu made a patch/fix for the vulnerable application. At initial glance it seems you likely have Fokirtor which just uses ssh as a stepping stone. This means, you likely have a DIFFERENT issue, and are attributing it to SSH. Without looking at the logs it is tough for me to tell so its a guessing game.

Now, you also state: "you have access to a lot of infected machines." I would stay a million miles away from accessing any of the perceived machines. With so many users, researchers, etc., using Linux, BSD, etc., I am sure others have seen what you are seeing, perhaps your analysis differs. In either event, I'd contact Ubuntu and the developer of whatever daemon you believe/perceive is the issue.

Improve this answer
4
  • I've just used sudo apt-get update and upgrade. I've seen no documentation online of for vulnerability of this kind. I'd like to confirm this is known issue somehow... Its not Fokirtor (at least dates and size differs). I certainly have different issue - that is the problem. The sshd was just a way proove it and understand how to access the other systems.
    – Emski
    Commented May 1, 2014 at 12:44
  • apt-get update and upgrade don't always solve the problem. For example, some developers offer side patches long before a distro places them into the update/upgrade rotation. Have you checked the developers page. You could also try searching exploit-db.org for information on reported vulnerabilities, bugtraq, etc., end of the day, as stated, I'd report it to Ubuntu, and the developer and if I got no response, I'd create an email to the Full Disclosure mailing list and CC Bugtraq
    – munkeyoto
    Commented May 1, 2014 at 12:52
  • as for the "risk" its as simple as creating a firewall/iptable rule blocking out ALL and allowing in only trusted sources to mitigate that risk
    – munkeyoto
    Commented May 1, 2014 at 12:53
  • Thank you, I'll check exploit-db.org. I was hoping to run a public service so blocking anyone of using that service is not an option for me.
    – Emski
    Commented May 1, 2014 at 12:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .