Stories
Slash Boxes
Comments

SoylentNews is people

posted by Fnord666 on Monday August 24 2020, @11:02AM   Printer-friendly
from the pwned dept.

New P2P botnet infects SSH servers all over the world:

Researchers have found what they believe is a previously undiscovered botnet that uses unusually advanced measures to covertly target millions of servers around the world.

The botnet uses proprietary software written from scratch to infect servers and corral them into a peer-to-peer network, researchers from security firm Guardicore Labs reported on Wednesday. P2P botnets distribute their administration among many infected nodes rather than relying on a control server to send commands and receive pilfered data. With no centralized server, the botnets are generally harder to spot and more difficult to shut down.

"What was intriguing about this campaign was that, at first sight, there was no apparent command and control (CNC) server being connected to," Guardicore Labs researcher Ophir Harpaz wrote. "It was shortly after the beginning of the research when we understood no CNC existed in the first place."


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by FatPhil on Tuesday August 25 2020, @04:06AM (3 children)

    by FatPhil (863) <pc-soylentNO@SPAMasdf.fi> on Tuesday August 25 2020, @04:06AM (#1041471) Homepage
    I think I disagree. I just read the whole thing and I still don't know exactly what OS/distro/SSHserver versions are vulnerable. It mentioned journalctl, so is this restricted to ystemd-infested linux distros only?

    If it's just a brute force dictionary attack (brutes can use dictionaries too, they don't need to understand them in order to just autistically skim through them), why is there no mention of mitigation such as fail2ban? And why is there no mention of what accounts are being hit? If it's just root, why is there no mention of disabling root remote logins from SSH?
    --
    Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 2) by RS3 on Tuesday August 25 2020, @05:03AM

    by RS3 (6367) on Tuesday August 25 2020, @05:03AM (#1041490)

    I'm not sure if you disagreed, but mostly augmented, and thanks. I'm not sure if OS/distroSSHserver matters(?). I didn't gather that it's a software bug, but just guessing and finding a weak password that causes the problem.

    However, if you read the comment / Q&A at the bottom you'll see fail2ban mentioned, and how it's not going to be very effective due to the many different source IP addresses.

  • (Score: 2) by RS3 on Tuesday August 25 2020, @05:07AM (1 child)

    by RS3 (6367) on Tuesday August 25 2020, @05:07AM (#1041491)

    Sorry- I meant to add: I agree that fail2ban (or similar) should stave off the initial brute.

    Regarding root login- do people allow root login over ssh? I don't want to be one of those cantankerous jerks that say "then they deserve what they get" so I'll refrain from saying that. But it's possible just the same. :)

    • (Score: 2) by VLM on Wednesday August 26 2020, @05:01PM

      by VLM (445) Subscriber Badge on Wednesday August 26 2020, @05:01PM (#1042230)

      do people allow root login over ssh?

      Sometimes I set my sshd config to allow that but only using preshared keys not using typed in passwords.

      The problem with sudo is it arrived as a tech right about the time virtualization and automated configuration and containerization made it obsolete. Other than troubleshooting diagnosis and development, there's really not much reason to do root stuff in a machine anymore. Like I don't log into physical freebsd servers and "pkg upgrade" as root anymore, its more like update the template for all machines then spin up new DEV TEST or PROD images automatically based on that golden upgraded template. If it passes TEST, I guess its good?