Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In regards to the following:

http://blog.solidshellsecurity.com/2013/02/18/0day-linuxcentos-sshd-spam-exploit-libkeyutils-so-1-9/ http://www.reddit.com/r/netsec/comments/18ro3c/sshd_rootkit/

There apparently seems to be a bunch of redhat servers being backdoored via a library. Does anyone have advice on how to track and find the initial breach of contact?

share|improve this question

closed as off topic by mdpc, EEAA, Khaled, Tom O'Connor, Bryan Feb 20 '13 at 12:14

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
You may receive better answers to this question on our sister site Information Security. Be sure to check their FAQ and search for previous questions about this issue. –  Michael Hampton Feb 19 '13 at 22:03

1 Answer 1

As per the links:

"Sounds more like they get in through php, then back-door sshd using a bad library once they have root. The initial attack vector is not a vulnerability in sshd.

After further reading consensus appears to be that the initial attack is done through cpanel on poorly-secured machines. Only 64-bit machines get the back-doored sshd, which is done through /lib64/libkeyutils.so.1.9, which shouldn't be present on the system otherwise."

Now why PHP based vulnerability ends up allowing root access is mystery. May be apache was running with root privileges and thus PHP files also got executed with similar access. Unless you have PHP / apache running with root privileges, there should be anything to worry about. As suggested "rpm -qf /lib/libkeyutils.so.1.9" commands can be used to see if you are affected or not.

share|improve this answer
    
I would have to beg to differ. For PHP to be the cause on over 1000 machines means there is some more at fault especially systems running the latest kernels and not too mention CageFS being broken out of. This screams a service exploit –  Tiffany Walker Feb 20 '13 at 6:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.