Is there any good literature discussing the rise of server malware? It seems to me it's much more common now and PC malware (regardless of OS) is more rare.
WordPress sites under attack from newly found Linux trojan
71–80 of 83 posts
Re: WordPress sites under attack from newly found Linux trojan
#72Earlier quoted context omitted.
Could it have a cron that runs as a user with write access to perform upgrades, while publicly-accessible processes don't?
> Could it have a cron that runs as a user with write access to perform upgrades, while publicly-accessible processes don't? In theory yes. In practice no. I think a big reason that PHP grew popular years ago was that basically all you needed in order to set up a PHP site on a host was FTP access, and in certain cases DB credentials. For example, case in point, for WordPress you only need FTP and DB access. Certainly…
>> Could it have a cron that runs as a user with write access to perform upgrades, while publicly-accessible processes don't?
> In theory yes. In practice no.
FWIW, after my one and only Wordpress installation was cracked via a vulnerability identical to the one reported in this thread (back in 2010-ish), i did exactly that: made all of the files and dirs read-only to the web user, and made the read/write only during upgrades.
Since ditching that site, though, a couple of years later, WP has remained on my blacklist and i've neither touched it nor recommended its use (and actively recommend against it for anyone who asks because of its long, glorious history of being cracked). To this day, WP is still the only server-side software i've ever run which was cracked from the outside.
Re: WordPress sites under attack from newly found Linux trojan
#73Earlier quoted context omitted.
> I don't know what the dynamics are for WordPress plugin developers to write this much vulnerable code, but WordPress itself has had very few vulnerabilities over the years. I think it’s a microcosm of the larger PHP problem: it’s a language and environment which is really easy to get started with, but requires significant skill and experience to use safely. The core developers of both have made some improvements bu…
WordPress's problems have nothing at all to do with PHP. WP is currently lagging PHP best practices by about a decade. You could in theory swap all the PHP out for, I dunno, Ruby, and if the WP architecture didn't change then it would still have all the same problems.
That's definitely not true in the sense that PHP, even in the latest versions (much less the versions most servers run), still has a lot of the fast-and-lose culture around correctness and things which are pretty uncommon outside of PHP these days such as putting files in a webroot where they're accessible to the world unless you remember to specifically prevent that and do so perfectly, and the endemic problems around aggressive type coercion or optional error handling. In our hypothetical swap for Ruby, Python, etc. those classes of error would either disappear completely or become much less common.
More importantly, however, note that I mentioned the cultural components: people learn bad habits from all of the old tutorials and tons of low-quality code floating around, and there isn't a culture of aggressively correcting that. The half-life on that stuff is a lot longer than the time it'll take to get people to upgrade to PHP 8, especially when more people got some Facebook-style “move fast and break things” ideas without the “… use linters and write tons of tests so you can ship that often” part.
Re: WordPress sites under attack from newly found Linux trojan
#74There is a nice writeup about the exploit which includes more information about the indicators of compromise (IOCs) on the (drweb) site: https://vms.drweb.com/virus/?i=25604695 For example, the binary file has a SHA1 of 215a4470063080696630fb6015378938e8c16a15. It reaches out to a C2 server with the IP address 109[.]234.38[.]69. It injects a script called "lone.js" which contacts another server. Etc. Someone has also…
How is that a nice write-up? It's describing the malware as both a backdoor and a trojan, but it's not a trojan and nothing in the description indicates that it's a backdoor. And after reading the write-up it's not even clear to me whether the Go program is running on the same machine as the WordPress (if it is, why does it need to exploit plug-in vulnerabilities? If not, how does the Go program itself spread? Is thi…
I would agree that the author of the write-up took some creative liberties in applying certain malware category terms like "trojan" and "backdoor" and that it lacks the polish and depth found in other reports from malware reverse engineers.
However it contains enough basic information for a site operator to search their logs and filesystem to see if they have those indicators of compromise. It's "nice" in the sense that someone published the details of an attack quickly and provided some key details to the community, who can expand on these findings or use them in signature-based antivirus detection tools.
I also linked to the Virustotal report which has more information about the go executable including headers, exported symbols and debug information that you can see for free, and which has more detailed analysis for security researchers who have an enterprise subscription.
Re: WordPress sites under attack from newly found Linux trojan
#75This article is written so badly.. I suspect it could be a ChatGPT or some variant.. > which targets 32-bit versions of Linux and also can run on 64-bit versions of the platform. I don't fully understand what they mean by this.. > Vulnerabilities are not uncommon. Pointing out the obvious here. But in general Wordpress has a high surface area of attack sure, but it allows bad 'developers' to publish websites which ar…
This may be a better write-up: https://arstechnica.com/information-technology/2023/01/hundr...
Re: WordPress sites under attack from newly found Linux trojan
#76Earlier quoted context omitted.
How is that a nice write-up? It's describing the malware as both a backdoor and a trojan, but it's not a trojan and nothing in the description indicates that it's a backdoor. And after reading the write-up it's not even clear to me whether the Go program is running on the same machine as the WordPress (if it is, why does it need to exploit plug-in vulnerabilities? If not, how does the Go program itself spread? Is thi…
I would agree that the author of the write-up took some creative liberties in applying certain malware category terms like "trojan" and "backdoor" and that it lacks the polish and depth found in other reports from malware reverse engineers. However it contains enough basic information for a site operator to search their logs and filesystem to see if they have those indicators of compromise. It's "nice" in the sense t…
I wouldn't really call it "creative liberties", I would simply call it misleading the reader. Words mean things, and seeing it described as a "trojan horse" might lead you to think you're safe if you haven't downloaded and run anything dubious.
But I agree that among the BS, there is useful information there. It's worth reading for people who may be affected even if I don't think it's "nice".
Re: WordPress sites under attack from newly found Linux trojan
#77I don't think linux has anything to do with it. It injects JS code into an existing wordpress site to redirect visitors to spam/scam etc. Any plugin that is allowed to write to disk and has a vulnerability is a problem. "Linux.Backdoor.WordPressExploit.1 is a trojan application for 32-bit and 64-bit Linux operating systems that targets x86-compatible devices. The backdoor is written in the Go (Golang) programming lan…
When a Virus targets I.E. or Office macros or other software, in general it all gets clumped up as Windows viruses and no one bats an eye. IMO I think the platform the binary payload is targeting is a valid criteria to characterize a threat, so no problem in calling it a Linux virus, just as we have no problem calling those "Windows viruses".
Office and IE are from Microsoft too, so makes sense to clump them together with Windows. -- You could call them "Microsoft vulnerabilities".
But if it was WP on Windows, that'd be different
Re: WordPress sites under attack from newly found Linux trojan
#78I don't think linux has anything to do with it. It injects JS code into an existing wordpress site to redirect visitors to spam/scam etc. Any plugin that is allowed to write to disk and has a vulnerability is a problem. "Linux.Backdoor.WordPressExploit.1 is a trojan application for 32-bit and 64-bit Linux operating systems that targets x86-compatible devices. The backdoor is written in the Go (Golang) programming lan…
This is why I shy away from the Wordpress ecosystem. You end up relying on a mass on plugins and you have to just hope they work together and don’t do anything sketchy. I’ve always felt worried by that.
With other open source systems, there are large active repositories involved so you can trust things a lot easier. Although the npm / react ecosystems make me a little worried too, since dependencies are added so causally
Re: WordPress sites under attack from newly found Linux trojan
#79Earlier quoted context omitted.
Yeah, typically, a web server should be setup such that the web servers process runs as say: www-data:www-data, and then the web files should be: joe:www-data and those web files should be 644. In this manner, the web server process can read the files, but the files can neither be written to nor run. This very basic stuff that most of the world seems to ignore completely.
Wordpress typically has write access to itself so it can auto-install updates right away, which is also a good idea for security. But I t’s definitely a tradeoff in that it also increases the potential harm from bugs.
You can actually set WordPress to use SFTP/SSH or ftpsockets for filesystem access, but this will break many popular plugins.
Re: WordPress sites under attack from newly found Linux trojan
#80Earlier quoted context omitted.
I would agree that the author of the write-up took some creative liberties in applying certain malware category terms like "trojan" and "backdoor" and that it lacks the polish and depth found in other reports from malware reverse engineers. However it contains enough basic information for a site operator to search their logs and filesystem to see if they have those indicators of compromise. It's "nice" in the sense t…
I wouldn't really call it "creative liberties", I would simply call it misleading the reader. Words mean things, and seeing it described as a "trojan horse" might lead you to think you're safe if you haven't downloaded and run anything dubious. But I agree that among the BS, there is useful information there. It's worth reading for people who may be affected even if I don't think it's "nice".
What would you consider a misleading about its description of the behavior as a “backdoor?
The write-up describes it as a persistent executable payload and goes on to enumerate the C2 commands that it reportedly received from a remote server, for which some IPs are provided.
Whether or not it’s a trojan depends on how it got onto the system in the first place. There isn’t more information in the article about how the system was infected, but maybe the author didn’t have evidence to share. That doesn’t mean it’s wrong, just that more details would be needed to substantiate that aspect of the attack.