Hacker News Reader

Comment by duskwuff | Hacker News Reader

Given that it's supposedly also installing a trojaned version of SSH(d?), it's probably not an Apache exploit at all. It's some other sort of method which gives it root access - either an exploit or just guessing root passwords. :)

View on HN

If I had to guess, it might be related to this: http://www.cloudlinux.com/blog/clnews/sshd-exploit.php

The details on that page are weak and there are all sorts of problems with the content in general (namely asking users to run a script blindly), but it seems to mimic what is described.

It's very disappointing that they didn't bother to update that news article. The actual source of that "exploit" was compromised admin machines. Everyone that kept having their servers hacked was found to have a rootkit on their local machine. I would not be surprised if this new "exploit" was the same thing.

Or maybe there are still a lot of people out there who are running Apache as root.

I guess it wouldn't be too hard to gain root access once code runs on the server: There are plenty of local privilege attacks in the Linux Kernel and not everybody updates and reboots regularly

By plenty you mean "plenty if you accumulate all the legacy kernel versions", right?

That does matter in the real world, since people routinely fail to update, or are unwilling to update because they cannot afford the minute or two of downtime required to reboot their servers. I know one guy who works with Solaris systems from the mid-90s that cannot be upgraded to anything more recent for various (non-technical) reasons.

If security did not have a human element, these problems would have been solved long ago.

The problems already have been solved long ago, it's just a matter of cost. Ksplice can update the kernel without a reboot, but has a cost. 2 minutes of downtime has a cost. As does not having a backup server and losing the one and only production server.

Yes, of course. But for Linux kernels, for every new release for the few maintained stable kernels, they always tell you it's better to update without giving specific details if there are vulnerabilities and who is affected. I personally don't bother to upgrade all the time with minor versions (at least on the systems where the kernel is not from the distribution). Therefore, running something not as root is good, but I should still be afraid of any exploit!

While I agree it's not an Apache exploit, your post makes no sense. SSH is often tainted via permission elevation due to vulnerabilities in other daemons.

Reply on news.ycombinator.com