Re: barbut anyone?

On Wed, 2011-11-16 at 15:03 +1300, Tomislav Skunca wrote:
> On Wed, Nov 16, 2011 at 11:47, Steve Holdoway <[email protected]> wrote:
> > I'm trying to find out any info about malware that generates an
> > executable called barbut[0-9], owned by root that keeps infecting a
> > CentOS5 - patched to current - server.
> >
> > My google fu gets me to posts from 2007, and I'd be surprised if the
> > same attack vector would be open. Still looking, but v. worried about
> > the root ownership...
> >
> > rkhunter, log mining, etc find nothing untoward.
> >
> > Please feel free to contact me offlist if you feel it more appropriate.
> >
> > Cheers,
> >
> > Steve
> >
> 
> It's probably this:
>   http://bit.ly/vJ1xUN
>   http://bit.ly/uSgXlE
> 
> You could compile the source and check the MD5 hash to see if it's the
> same Trojan.
> 
> It might be in your init scripts or a .bashrc file and it could be
> disguised as a 'normal' binary in /usr/bin. Check if it's connecting
> to an IRC channel. As for the entry vector, do you have packages that
> are not in the CentOS repos and potentially out of date? It would be
> smart to take a snapshot of the current machine
> 
> If rebooting is a problem I'd setup a new machine, transfer any
> services to it and then rebuild the infected machine. That way you can
> migrate to CentOS 6 if you want to and only have to check the
> transfered files for tampering.
> 

Yes, that's the one. Clam does recognise the executable ( barbut1.i386:
Trojan.Tsunami.B FOUND ), and I've found the source code. I've scanned
the whole server now, and not found anything. 

All packages are up to date, although checking all this plesk ( yeugh! )
stuff is difficult to prove. Published services are ftp, ssh, mail, dns,
web, mysql, plesk.

I think I've found the vector... /etc/rc.d/rc.local contains

touch /var/lock/subsys/local
/usr/include/php/dropbear
/usr/sbin/iptables -I OUTPUT 1 -p tcp --dport 45295 -j DROP


and /usr/include/php also contains a copy of busybox. That would give it
root privileges at least. I've never come across dropbear installed on
CentOS, who would install it there...

As an aside, I'm extremely concerned about the state of CentOS, as the
patch time for 6.0 is measured in months of delay when compared to RH.
The key departure of Dag Wieers is even more worrying. I won't be
voluntarily migrating to CentOS 6 ( RH is already 6.1 ). My fave server
distro is currently debian squeeze.

Cheers,

Steve




-- 
Steve Holdoway BSc(Hons) MNZCS <[email protected]>
http://www.greengecko.co.nz
MSN: [email protected]
Skype: sholdowa

_______________________________________________
NZLUG mailing list [email protected]
http://www.linux.net.nz/cgi-bin/mailman/listinfo/nzlug