'Mayhem' malware on Linux and FreeBSD

[ocabj]

There's apparently a piece of malware that infects Linux and FreeBSD web hosts.

https://www.virusbtn.com/virusbulletin/archive/2014/07/vb201407-Mayhem

All it requires is the execution of the malicious php script (injection script) to get it going and it does *NOT* require root privileges to inject.

It's essentially a botnet node at that point and is able to run 'plug-ins', so if the C&C creates new code, they can actually update the node with new functionality.

If you guys aren't running HIDS, definitely start. OSSEC is free, so there's no reason not to run it at this point.

[meaty-btz]

Once again the primary method of infection is through malicious web-traffic.

For those that don't know most of the advertisement sites operate without oversight and then resell through third parties who then sell the ad links to sites who run them.

There was and still are malicious ads being sent across the advertising networks. I still remember when some big viruses moved through MSNBC's front page ads.

No script, Ad Block, and DNTs are pretty much the best bet to keep stuff like this off your system. OSSEC is still an endpoint solution. Stop the attack BEFORE it starts by preventing script execution.

The fancy, pretty internet of today is a giant trap for the foolish.

End points can always be bypassed. One of the smarter attack vectors I have seen is the "multi-part" virus. It dances about the endpoint's detection system by not delivering or activating the malicious package all in one piece. Instead first you get part A, then Part B, then the two very benign packages are activated by a third script which itself is also benign looking. The virus then executes locally. Ran into one just like this once, it infected thousands of computers and the up to date AV did nothing to stop it because, well they can only block it once it is known. This little bugger once active brought you into a bot-net that would update the virus from there on out and call on it to infect more machines on the local network as well as do DOS attacks, etc. It would also disable the AV, ROOT the system, and present a hacked UI for the user to use that would prevent detection visually of the virus or it's activates. If a malicious site can get ANYTHING, even something benign looking to your system, it's game over.

[ocabj]

Once again the primary method of infection is through malicious web-traffic.

I think you misunderstand this malware. It doesn't infect visitors perse. The attacker attempts to inject Mayhem onto the actual web servers. The goal of the attacker is to run php code on the target server (a webserver) via injection (e.g. SQL, unsanitized PHP code, etc). Once the attacker successfully executes the PHP code on the server itself, then the attacker now 'owns' the server since it will communicate with the C&C. From there they can control the server and run various attacks on the server itself (e.g. enumeration of users, brute force attack local passwords, etc) and launch attacks on other servers to infect them.

This is why people need to run HIDS and real time log analysis with active response (e.g. OSSEC) so they can detect these types of code injections and react accordingly.

[meaty-btz]

I think you misunderstand this malware. It doesn't infect visitors perse. The attacker attempts to inject Mayhem onto the actual web servers. The goal of the attacker is to run php code on the target server (a webserver) via injection (e.g. SQL, unsanitized PHP code, etc). Once the attacker successfully executes the PHP code on the server itself, then the attacker now 'owns' the server since it will communicate with the C&C. From there they can control the server and run various attacks on the server itself (e.g. enumeration of users, brute force attack local passwords, etc) and launch attacks on other servers to infect them.

This is why people need to run HIDS and real time log analysis with active response (e.g. OSSEC) so they can detect these types of code injections and react accordingly.

This is a server side injection..

Indeed. I thought this was a different target. My bad.

[yellowsulphur]

Just curious, I don't run a server, can one use SELinux to map out policy rules to prevent this?

[ocabj]

Just curious, I don't run a server, can one use SELinux to map out policy rules to prevent this?

From what I understand SELinux can do as far as finegrained ACL enforcement on filesystems, it's possible. Although, I'm not entirely sure where Mayhem tries to write it's files to. It's highly likely where it will write to is some place the server admin will have given explicit rights to the httpd process to write to (not just in standard unix permissions, but in the SELinux ACLs).

[stilly]

Do you have a sample?

That is it! I am getting a PC- hey wait a second...