Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
DRM Privacy Security Linux Technology IT

Researchers Help Shut Down Spam Botnet That Enslaved 4,000 Linux Machines (arstechnica.com) 47

An anonymous reader shares an article on Ars Technica: A botnet that enslaved about 4,000 Linux computers and caused them to blast the Internet with spam for more than a year has finally been shut down. Sophisticated Mumblehard spamming malware flew under the radar for five years. Known as Mumblehard, the botnet was the product of highly skilled developers. It used a custom "packer" to conceal the Perl-based source code that made it run, a backdoor that gave attackers persistent access, and a mail daemon that was able to send large volumes of spam. Command servers that coordinated the compromised machines' operations could also send messages to Spamhaus requesting the delisting of any Mumblehard-based IP addresses that sneaked into the real-time composite blocking list, or CBL, maintained by the anti-spam service. "There was a script automatically monitoring the CBL for the IP addresses of all the spam-bots," researchers from security firm Eset wrote in a blog post published Thursday. "If one was found to be blacklisted, this script requested the delisting of the IP address. Such requests are protected with a CAPTCHA to avoid automation, but OCR (or an external service if OCR didn't work) was used to break the protection."
This discussion has been archived. No new comments can be posted.

Researchers Help Shut Down Spam Botnet That Enslaved 4,000 Linux Machines

Comments Filter:
  • In the year of our lord 2016 I can't believe this shit is still going on. Its been a few yrs since I checked in. Everything in the firehose was spam a few times, and the one article I did promote drew some flak. *sigh* wonderful.

  • How exactly did Mumblehard initially infect the Linux and BSD systems?
    • FTFA (Score:5, Informative)

      by Anonymous Coward on Saturday April 09, 2016 @05:42PM (#51876297)

      The Eset researchers still aren't certain how Mumblehard is installed. Based on their analysis of the infected server, they suspect the malware may take hold by exploiting vulnerabilities in the Joomla and WordPress content management systems. Their other theory is that the infections are the result of installing pirated versions of the DirecMailer program.

      Look for cron jobs executing code from /var/tmp.

      They did such a beautiful and informative report(PDF) [welivesecurity.com] it's a damn shame not to read it.

      • by gweihir ( 88907 )

        Skimming the report, I found no information at all about the attack vectors.

        • Re:FTFA (Score:4, Informative)

          by ecotax ( 303198 ) on Sunday April 10, 2016 @05:23AM (#51878363)
          They mention at least one previously used: downloads of the 'free, unsupported' DirectMailer software. So they were apparently targeting people who wanted to send bulk email for free. Poetic injustice? Just guessing, but they could use the same trick with other 'free' products now. From the report:

          5.1. "Cracked" DirectMailer
          On the homepage, Yellsoft makes sure to tell its visitors that the company doesn’t o er support for copies of the software downloaded from [link deleted], with a link to the page. This page is hosted on narod.ru, a free web hoster. Let’s see if we can get a copy of DirectMailer from there. Figure 9 Softexp web page with DirectMailer download link as seen in 2014 Sure enough, in 2014 you could download a directmailer-retail.zip le with a copy of DirectMailer. Since ESET Anti-Virus products started detecting DirectMailer as malicious, the software is no longer being distributed on softexp.narod.ru. The zip archive contains a dm.pl executable le. Despite the .pl extension, it is not a Perl script, but an ELF executable. This executable le contains a Perl script packed with the Mumblehard packer. Analysis of the Perl script shows that a function called bdrp is invoked before the main program is started. This function has a uuencoded blob, which, once decoded, generates another ELF le. This ELF le is a packed Perl script consisting of the Mumblehard backdoor. It is written to the le system and a cron job is added to run it every 15 minutes.

          • by gweihir ( 88907 )

            Thanks. I saw that but discounted it as an attack-vector, because it is not really one (well, not a technological one). But if that is the only thing they mention, then we may just have 4000 terminally stupid system administrators as the root-cause.

    • I run OpenBSD and was unaffected.
      • by donaldm ( 919619 )

        I run OpenBSD and was unaffected.

        That's funny I run Fedora 23 and was unaffected.

        Go figere

    • there are two plausible infection vectors used to spread Mumblehard. The most popular vector seems to be the use of Joomla and Wordpress exploits. The other is through the distribution of backdoored "pirated" copies of a Linux and BSD program known as DirectMailer, software that Yellsoft sells on their website for $240

      backdoored !

  • no need... (Score:4, Funny)

    by Anonymous Coward on Saturday April 09, 2016 @05:37PM (#51876271)

    It used a custom "packer" to conceal the Perl-based source code that made it run...

    I think writing it in Perl provides sufficient obfuscation all by itself.

  • Evil (Score:5, Interesting)

    by markdavis ( 642305 ) on Saturday April 09, 2016 @06:13PM (#51876399)

    >"There was a script automatically monitoring the CBL for the IP addresses of all the spam-bots, If one was found to be blacklisted, this script requested the delisting of the IP address"

    Oooh, that is really clever/evil. And that went on for years and Spamhaus never discovered they were getting automated requests? I would think that would be pretty easy to detect if they get ANOTHER report of spam coming from the same machine and ANOTHER delisting request...

    • Re: (Score:3, Insightful)

      by Anonymous Coward

      History tells us that Spamhaus is not synonymous with competence.

      • by Cramer ( 69040 )

        It's hard to achieve perfection in an automated anti-spam system. Or would you rather have the listed-forever, extortion-esq system from SORBS? (the internet never forgets, or forgives)

  • which distro was mostly effected, forensics should be able to figure that out and then some more snooping find the culprets, if they are developers that contribute to Linux then they need to be found out and blacklisted and removed and maybe send a goon squad to go break their knees and fingers
    • by gweihir ( 88907 )

      Indeed. And it would help even more if they told us how the machines were infected. As the number is quite low, I expect some configuration mistake that is not commonplace.

      • by donaldm ( 919619 )

        Indeed. And it would help even more if they told us how the machines were infected. As the number is quite low, I expect some configuration mistake that is not commonplace.

        That seems to be the problem and I struck this similar thing over 30 years ago. Basically it went like this "The sky if falling, everyone panic" and when asked the reply was "Oh that's a secret". It appears nothing has changed. Sigh!

        Fortunately there are people who give these smug whistle blowers a binary four finger and tell every one.

  • by xiando ( 770382 ) on Saturday April 09, 2016 @10:31PM (#51877311) Homepage Journal
    Now why am I not shocked these two pieces of spaghetti code were used as an attack vector? It's always important to lock down and isolate each /vhost/ but these who really exemplify why that is so important. Specially WordPress has been one huge security disaster after another.
    • by dbIII ( 701233 )
      No it's all a conspiracy - wordpress was set up to fail just like explosives were planted in that building that couldn't possibly have burned down when it was on fucking fire.
      • Sir, you have been watching too much die hard.

        • by dbIII ( 701233 )
          Read the guys sig and follow the link. His mind does not dwell in reality and he's insulting everyone apart from the terrorists with the shit he's spewing.
    • let's not leave out of discussion out the other piece of PHP poo, Drupal

How many NASA managers does it take to screw in a lightbulb? "That's a known problem... don't worry about it."

Working...