Thread: Duqu Command & Control Servers included Hacked Linux Systems by D. Dieterle

some interesting information released yesterday in follow duqu analysis report kapersky labs. highlights article include:

• the duqu c&c servers operated november 2009.
• many different servers hacked around world, in vietnam, india, germany, singapore, switzerland, uk, netherlands, belgium, south korea name few locations. of hacked machines running centos linux. both 32-bit , 64-bit machines hacked.
• the servers appear have been hacked bruteforcing root password. (we not believe in openssh 4.3 0-day theory – scary!)
• the attackers have burning desire update openssh 4.3 version 5 control of hacked server.
• a global cleanup operation took place on 20 october 2011. attackers wiped every single server used in distant past, e.g. 2009. unfortunately, interesting server, c&c proxy in india, cleaned hours before hosting company agreed make image. if image had been made earlier, it’s possible we’d know lot more inner workings of network.
• the “real” duqu mothership c&c server remains mystery attackers’ identities.

wait minute, “most of hacked machines running centos linux“. linux gets hacked? of think linux invulnerable, may eye opener.
interesting though how did it? leads more questions. recovered sshd log server in germany caught might evidence of brute force password attack:

odd logged in, 1 of first things done update openssh (used remote access) 4.3 5, snip recovered bash shell history shows :

has led quite debate, saying hackers got in using openssh 0 day exploit, while others claiming needed updated features of 5 make command , control more uniform across board.
interesting see how many times files , manuals referenced in above capture. why powerful stuxnet attackers breached iran’s secure nuclear facilities , have created several 0-day attacks need reference files frequently?
simple solution not familiar distribution of linux. more familiar red hat linux enterprise linux centos based on.
brute force password hacking or stuxnet 0-day, duqu shows linux vulnerable hackers too. , it’s growing install base, supplanting windows desktops in many facilities, expect become more of target.

really interesting stuff. lot posting! thought kapersky blog post referred read.

https://www.securelist.com/en/blog/6...ontrol_servers

Forum The Ubuntu Forum Community Ubuntu Community Discussions The Cafe Duqu Command & Control Servers included Hacked Linux Systems by D. Dieterle

Ubuntu