Linux/Cdorked backdoor exposes 100,000 Web visitors to potent Blackhole exploits.
This was posted originally on Arstechnica.
Security researchers have uncovered an ongoing and widespread attack that causes sites running three of the Internet’s most popular Web servers to push potent malware exploits on visitors.
Linux/Cdorked.A, as the malicious backdoor behind the attacks is known, has been observed infecting at least 400 Web servers, 50 of them from the Alexa top 100,000 ranking, researchers from antivirus provider Eset said. The backdoor infects sites running the Apache, nginx, and Lighttpd Web servers and has already exposed almost 100,000 end users running Eset software to attack (the AV apps protect them from infection). Because Eset sees only a small percentage of overall Internet users, the actual number of people affected is presumed to be much higher.
“This is the first time I’ve seen an attack that will actually target different Web servers, meaning the attacker is willing to create the backdoor for Apache, Lightttp, and nginx,” Pierre-Marc Bureau, Eset’s security intelligence program manager, told Ars. “Somebody is running an operation that can victimize various Web servers and in my opinion this is the first time that has ever happened. This is a stealthy, sophisticated, and streamlined distribution mechanism for getting malware on end users’ computers.”
Previously, Cdorked was known to infect only sites that ran on Apache, which remains by far the Internet’s most popular Web server application. According to this month’s server survey from Netcraft, Apache and nginx are the No. 1 and No. 3 packages respectively, with about 53 percent and 16 percent of websites. The survey didn’t rank Lighttpd, a Web server designed for speed-critical sites that’s used by sites including Meebo, YouTube, and Wikimedia, according to Wikipedia. The report of the susceptibility of nginx came as its maintainers issued an update that patches a remote-code execution vulnerability in the open-source Web server. (There’s no evidence the vulnerability is related to the Cdorked infection.)
Linux/Cdorked.A is one of at least two backdoors recently observed causing trusted and often popular websites to push exploits that attempt to surreptitiously install malware on visitors’ computers. Like Darkleech, a backdoor estimated to have infected 20,000 Apache websites, it redirects users to a series of third-party sites that host malicious code from the Blackhole exploit kit. A recent blog postfrom security firm Invincea reports another rash of website hijackings, but they appear to be unrelated to Cdorked, and there’s no indication Darkleech is involved, either.
Also similar to Darkleech, the Cdorked backdoor makes it extremely difficult for end users and even security researchers to notice their computers are being attacked. Users who speak Russian, Ukrainian, and at least four other languages are never exposed, and people who have already been attacked in recent days are also spared. Common configurations include a large list of IP addresses that are also blocked from exploits.
“We believe the operators behind this malware campaign are making significant efforts to keep their operation under the radar and to hinder monitoring efforts as much as possible,” Eset researcher Marc-Etienne M.Léveillé wrote in a blog post published Tuesday. “For them, not being detected seems to be a priority over infecting as many victims as possible.”
Cdorked-infected servers are also advanced enough to distinguish among different computing platforms used by end users visiting infected sites. Those using Windows machines are directed to sites that mostly host exploits from Blackhole. People using Apple iPads or iPhones are redirected to porn sites that may also be hosting malicious code. Cdorked also stores most of its inner workings in a server’s shared memory, making it hard for some admins to know their sites are infected. Compromised systems can receive up to 70 different encrypted commands, a number that gives attackers fairly granular control that can be remotely and stealthily invoked.
In another testament to the ambition of its operators, Cdorked relies on compromised domain name system servers to resolve the IP addresses of redirected sites. The use of “trojanized DNS server binaries” adds another layer of obscurity to the attacks, since they make it easier for attackers to serve different sites to different end users.
“They are using the compromised DNS server to very accurately filter out who is going to visit the next stage Web server,” Bureau said in an interview. “This means, for example, that security researchers will have a very hard time being served the same content as a victim. It makes the investigation and tracking this operation harder. They are trying to control every step along the way to make every visit very traceable but also very hard to recreate.”
Researchers still don’t know how servers are being infected with Cdorked. Because compromised machines are running a variety of administration controls, cPanel and competing software aren’t obvious suspects. Cdorked doesn’t have the ability to spread by itself and doesn’t exploit a vulnerability in any other specific piece of software, either.
Readers who want to ensure their websites aren’t infected should use the rpm –verify command to see if the HTTP daemon they use has been altered. Eset researchers have also released this free python script (zip file) to examine a server’s shared memory for signs it is under the control of Cdorked.
Bureau said he believes Cdorked and Darkleech are two competing toolkits for exploiting Web servers. Their prevalence, combined with Invincea’s discovery of popular websites also exposing visitors to malware attacks, suggests exploits are expanding beyond the traditional base of machines running Microsoft-based software.
“A couple years ago malware against the Linux operating system was really in the age of its proof of concept,” he said. “Whenever we would discover something everybody would say: ‘It’s not really in wild. It’s just somebody trying to prove a point.’ Now the fact that we see so many instances of infected Web servers out there really shows we’re past the era of the proof of concept. Now serious operators are making serious money by victimizing these web servers.”
Story updated to add detail in the fourth paragraph that there’s no evidence nginx vulnerability is related to Cdorked infections.