Security researchers at ESET®,
in collaboration with CERT-Bund, the Swedish National Infrastructure for
Computing as well as other agencies, have uncovered a widespread cybercriminal
campaign that has seized control of over 25,000 Unix servers worldwide.
The attack, which has been
dubbed "Operation Windigo" by security experts, has resulted in
infected servers sending out millions of spam emails. Its complex knot of sophisticated
malware components are designed to hijack servers, infect the computers that
visit them, and steal information.
Victims of “Operation Windigo”
have included cPanel and kernel.org.
ESET's security research team,
which uncovered Windigo, today published a detailed technical paper, presenting
the findings of the team’s investigations and malware analysis. The paper also
provides guidance on how to find out if your systems are affected and
instructions for removing the malicious code.
OPERATION WINDIGO: Gathering Strength For Over Three Years
While some experts have
spotted elements of the Windigo cybercriminal campaign, the sheer size and
complexity of the operation has remained largely unrealised by the security
community.
"Windigo has been gathering strength, largely unnoticed by the
security community, for over two and a half years, and currently has 10,000
servers under its control,"
said ESET security researcher Marc-Étienne Léveillé. "Over
35 million spam messages are being sent every day to innocent users' accounts,
clogging up inboxes and putting computer systems at risk. Worse still, each day over half a million
computers are put at risk of infection, as they visit websites that have been
poisoned by web server malware planted by Operation Windigo redirecting to malicious
exploit kits and advertisements."
Interestingly, although
Windigo-affected websites attempt to infect visiting Windows computers with
malware via an exploit kit, Mac users are typically served adverts for dating
sites and iPhone owners are redirected to pornographic online content.
An Appeal To Sysadmins To Take Action Against Windigo
Over 60% of the world's
websites are running on Linux servers, and ESET researchers are calling on
webmasters and system administrators to check their systems to see if they have
been compromised.
"Webmasters and IT staff already have a lot of headaches and things
on their mind, so we hate to add to their workload - but this is
important. Everyone wants to be a good
net citizen, and this is your chance to play your part and help protect other
internet users," says
Léveillé. "The last thing anyone should want is to be part of the problem,
adding to the spread of malware and spam.
A few minutes can make the difference, and ensure you are part of the
solution."
How To Tell If Your Server Has Fallen Foul Of Windigo
ESET researchers, who named
Windigo after a mythical creature from Algonquian Native American folklore
because of its cannibalistic nature, are appealing for Unix system
administrators and webmasters to run the following command which will tell them
if their server is compromised or not:
$ ssh -G
2>&1 | grep -e illegal -e unknown > /dev/null && echo
"System clean" || echo "System infected"
Tough Medicine For Windigo Victims
"The Ebury backdoor deployed by the Windigo cybercrime operation
does not exploit a vulnerability in Linux or OpenSSH," continued Léveillé. "Instead it is manually installed by a malicious attacker. The
fact that they have managed to do this on tens of thousands of different
servers is chilling. While anti-virus and two factor authentication is common
on the desktop, it is rarely used to protect servers, making them vulnerable to
credential stealing and easy malware deployment."
If sysadmins discover their
systems are infected, they are advised to wipe affected computers and reinstall
the operating system and software. It is
essential that fresh passwords and private keys are used, as the existing credentials
must be considered compromised.
For a higher level of protection
in future, technology such as two-factor authentication should be considered.
"We realise that wiping your server and starting again from scratch
is tough medicine, but if hackers have stolen or cracked your administrator
credentials and had remote access to your servers, you cannot take any
risks," explains
Léveillé. "Sadly, some of the victims we have been in touch with know that
they are infected, but have done nothing to clean up their systems -
potentially putting more internet users in the firing line."
All computer users are
reminded that they should never reuse or choose easy-to-crack passwords.
Further Information
ESET has published a detailed
investigation into the "Operation Windigo" cybercrime campaign, and
the various malware components which make up the threat.
To download the full report,
please visit welivesecurity.com/windigo.
To follow the developing story
on Facebook, Google+ or Twitter, please use hashtag #windigo
