The Continuing Saga of OpenSSH Attacks–Now With Backdoors

In a recent email to the Full-Disclosure mailing list there’s an interesting article that grabbed our attention. This email talks about how a hacking team claims to have compromised some Linux-based computers and have successfully installed OpenSSH backdoors.

It’s evident that the attackers probably obtained root access by a SSH-password brute-force attack, leveraging the infamous Debian OpenSSL Package Random Number Generator Weakness (CVE-2008-0166) vulnerability. According to the email, after installing this OpenSSH backdoor, the backdoor is capable of recording all information about user accounts, passwords, and IP addresses connecting to and from this host. Hence by social engineering tricks, the attackers can gather the sensitive system information of even more hosts that connect to the compromised machine. At the end of the report this team also lists some achievements they gained, some of which is information on compromised computers.

We have some suggestions for administrators to verify whether they’ve been compromised:

– First compare your devices to check whether any of these are in the records. Note: This list might not be exhaustive; thus even if your host is not present, we recommend you continue to the following steps.

– Use this command to determine whether SSHD on the host has been replaced:

echo netdump|nc localhost 22 or echo netdomp|nc localhost 22

It should output the following information if the backdoor has been installed:

SSH-2.0-OpenSSH_4.3
netdump
SSH2_OUT: 127.0.0.1 user: root pass: password (localhost)


– By using commands such as “strings /pathto/sshd | grep netdump” you can verify whether the backdoor is currently installed and is working.

– And of course, the most effective method is to have all the latest patches installed. If the system is a Debian flavor, you should definitely confirm that the OpenSSL Weakness (CVE-2008-0166) patch has been installed.

– We also suggest the use of public-key-based authentication rather than just a password-authentication mechanism.

We’ll continue to monitor this threat and will update you with more information as it becomes available.