Christine Kronberg wrote:
> On Sun, 19 Feb 2006, Gadi Evron wrote:
>
>> Today, we received a notification about a new Linux malware ItW (In
>> the Wild).
>
>
> They are not exactly new. I've seen them floating around for about
> two months now. There a different binaries running around doing the
> same work (different the way that they have been compiled on different
> linux distributions). Part of that work is to be distributed by trying
> to get in via vulnerable php scripts. Look to me like being part of a
> worm.
>
> Cheers,
>
>
> Christine Kronberg.
>

Indeed, the most annoying thing about the PHP worms today is that these
PHP vulnerabilities being exploited are everywhere.

As I already mentioned, this recent Linux worm has more to it, but
that's in another post.

These vulnerabilities being exploited are very difficult to protect from
because:
1. PHP is the "serious" or at least open-source/Linux/security freak's
choice for web development. Mine as well (although as many still say,
Perl does a better job).

2. Developing secure applications in PHP is difficult, as one of PHP's
creators said recently - even to him after years of trying.

3. Staying on top of new PHP vulnerabilities has become impossible,
popping around everywhere.

4. Determining how secure a PHP application is, looking at the code and
for how silly past vulnerabilities were (i.e. looking at the coder
rather than the code) is now more important than the actual application.

Much like their self criticism said, PHP needs to grow to a far more
secure language, much like we need to chose more carefully what PHP
software we use.

Some of us have been joking for a while about creating a script to
choose from different paragraph we create, and email bugtraq
re-assembling the randomly with a new PHP bug and a random PHP
application name every few hours. Would any of us be able to readily
tell the difference?

From all the fish we can barely see the water. :(

As to the worms, been going on longer than 2 mounths like you mentioned,
but you are correct.

One note I'd like to make, is that even if the second (interesting)
payload in the Linux worm wasn't there, just because someone utilizes
old malware in the creation of new malware doesn't mean it is new, or
99.9% of any "virus" every written would be old.

Does Bagle.**** ring a bell with anyone? :)

Like I already mentioned, if any of you are interested in sharing web
server logs and be notified of new PHP problems we all notice online,
drop me a note.

Gadi.

--
http://blogs.securiteam.com/

"Out of the box is where I live".
-- Cara "Starbuck" Thrace, Battlestar Galactica.

[ reply ]