{"id":330,"date":"2021-07-23T12:27:55","date_gmt":"2021-07-23T12:27:55","guid":{"rendered":"https:\/\/ssdsunucum.com\/blog\/determine-your-system-status\/"},"modified":"2021-07-23T12:27:55","modified_gmt":"2021-07-23T12:27:55","slug":"determine-your-system-status","status":"publish","type":"post","link":"https:\/\/ssdsunucum.com\/blog\/determine-your-system-status\/","title":{"rendered":"Determine Your System Status"},"content":{"rendered":"<\/p>\n
\n
<\/div>\n
\n

Overview<\/h2>\n

cPanel\u2019s Technical Support department detected the following security issues:<\/p>\n

    \n
  • Compromised RPMs in the OpenSSH binaries.<\/li>\n
  • Compromised libkeyutils<\/code> directories.<\/li>\n
  • root<\/code>-level compromises.<\/li>\n<\/ul>\n

    In these cases, Trojan horses (Trojans) affected files that these directories and binaries contain. We strongly<\/strong> recommend that hosting providers and system administrators use this document to determine the status of their systems.<\/p>\n

    \n
    Note:<\/div>\n
    \n The affected OpenSSH Binaries and libkeyutils<\/code> directories produce similar network traffic.\n <\/div>\n<\/div>\n

    If you experience any issues while you perform these checks or you suspect that someone has compromised your server, contact your hosting provider for assistance.<\/p>\n

    \n
    Note:<\/div>\n
    \n
      \n
    • \n

      To check your system for compromises unrelated to the OpenSSH Binaries and libkeyutils<\/code> directories, use WHM\u2019s Security Advisor<\/em> interface (WHM >> Home >> Security Center >> Security Advisor<\/em>).<\/p>\n<\/li>\n

    • \n

      We strongly<\/strong> recommend that you read our Tips to Make Your Server More Secure documentation.<\/p>\n<\/li>\n<\/ul><\/div>\n<\/div>\n

      Compromised systems<\/h2>\n

      Open SSH rpms<\/h3>\n

      On CentOS and Red Hat\u00ae Enterprise Linux\u00ae systems, we determined that the following OpenSSH binaries contain the Ebury Trojan:<\/p>\n

        \n
      • The sshd<\/code> binary.<\/li>\n
      • The ssh<\/code> binary.<\/li>\n
      • The ssh-keygen<\/code> binary.<\/li>\n
      • The ssh-askpass<\/code> binary.<\/li>\n<\/ul>\n

        This Trojan\u2019s code collects authentication credentials for inbound and outbound network connections, as well as the SSH keys that these binaries generate.<\/p>\n

        Use the following checks to determine whether the Trojan compromised your system\u2019s OpenSSH binaries.<\/p>\n

        Check for malicious processes<\/h4>\n

        To check for malicious processes on your server, run the following command: <\/p>\n

        \n
        netstat -<\/span>plan |<\/span> grep atd<\/code><\/pre>\n<\/div>\n
        This command does not return output on non-compromised systems. On compromised systems, this command returns output that resembles the following example: <\/p>\n
        \n
        unix 2<\/span> [ ACC ] STREAM LISTENING 103713<\/span> 8119<\/span>\/atd @\/<\/span>tmp\/<\/span>dbus-<\/span>ZP7tFO4xsL<\/code><\/pre>\n<\/div>\n
        Check the RPMs\u2019 change logs.<\/h4>\n
        To check an RPM version\u2019s change log, run the following command: <\/p>\n
        \n
        rpm -<\/span>q --changelog <\/span>openssh-<\/span>5.3<\/span>p1-<\/span>209<\/span>.<\/span>el6 |<\/span> head -<\/span>10<\/span><\/code><\/pre>\n<\/div>\n
        In this example, openssh-5.3p1-209.el6<\/code> represents the OpenSSH RPM binary that you wish to check.<\/p>\n
        Non-compromised RPMs contain a signature. A compromised RPM\u2019s change log contains no entries.<\/p>\n
        Check your system\u2019s yum logs.<\/h4>\n
        Open your system\u2019s \/var\/log\/yum.log<\/code> file with a text editor and search for the OpenSSH binaries. The file\u2019s contents resemble the following example:<\/p>\n
        \n
        \n\n\n
        \n
         1\n<\/span> 2\n<\/span> 3\n<\/span> 4\n<\/span> 5\n<\/span> 6\n<\/span> 7\n<\/span> 8\n<\/span> 9\n<\/span>10\n<\/span>11\n<\/span>12\n<\/span>13\n<\/span>14\n<\/span><\/code><\/pre>\n<\/td>\n
        		\n
        Jun<\/span> 22<\/span> 10<\/span>:33<\/span>:00<\/span> Installed<\/span>: geronimo<\/span>-<\/span>jms<\/span>-<\/span>1.1.1<\/span>-<\/span>19.<\/span>el7<\/span>.noarch<\/span>\nJun<\/span> 22<\/span> 10<\/span>:33<\/span>:00<\/span> Installed<\/span>: xml<\/span>-<\/span>commons<\/span>-<\/span>apis<\/span>-<\/span>1.4.01<\/span>-<\/span>16.<\/span>el7<\/span>.noarch<\/span>\nJun<\/span> 22<\/span> 10<\/span>:33<\/span>:00<\/span> Installed<\/span>: xml<\/span>-<\/span>commons<\/span>-<\/span>resolver<\/span>-<\/span>1.2<\/span>-<\/span>15.<\/span>el7<\/span>.noarch<\/span>\nJun<\/span> 22<\/span> 10<\/span>:33<\/span>:00<\/span> Installed<\/span>: xalan<\/span>-<\/span>j2<\/span>-<\/span>2.7.1<\/span>-<\/span>23.<\/span>el7<\/span>.noarch<\/span>\nJun<\/span> 22<\/span> 10<\/span>:33<\/span>:00<\/span> Installed<\/span>: xerces<\/span>-<\/span>j2<\/span>-<\/span>2.11.0<\/span>-<\/span>17.<\/span>el7_0<\/span>.noarch<\/span>\nJun<\/span> 22<\/span> 10<\/span>:33<\/span>:01<\/span> Installed<\/span>: avalon<\/span>-<\/span>framework<\/span>-<\/span>4.3<\/span>-<\/span>10.<\/span>el7<\/span>.noarch<\/span>\nJun<\/span> 22<\/span> 10<\/span>:33<\/span>:01<\/span> Installed<\/span>: tomcat<\/span>-<\/span>el<\/span>-<\/span>2.2<\/span>-<\/span>api<\/span>-<\/span>7.0.69<\/span>-<\/span>11.<\/span>el7_3<\/span>.noarch<\/span>\nJun<\/span> 22<\/span> 10<\/span>:33<\/span>:01<\/span> Installed<\/span>: tomcat<\/span>-<\/span>lib<\/span>-<\/span>7.0.69<\/span>-<\/span>11.<\/span>el7_3<\/span>.noarch<\/span>\nJun<\/span> 22<\/span> 10<\/span>:33<\/span>:02<\/span> Installed<\/span>: tomcat<\/span>-<\/span>7.0.69<\/span>-<\/span>11.<\/span>el7_3<\/span>.noarch<\/span>\nJun<\/span> 22<\/span> 10<\/span>:33<\/span>:02<\/span> Installed<\/span>: openssh<\/span>-<\/span>6.6.1<\/span>p1<\/span>-<\/span>35.<\/span>el7_3<\/span>.x86_64<\/span>\nJun<\/span> 22<\/span> 10<\/span>:33<\/span>:02<\/span> Installed<\/span>: libssh2<\/span>-<\/span>1.4.3<\/span>-<\/span>10.<\/span>el7_2<\/span>.1<\/span>.x86_64<\/span>\nJun<\/span> 22<\/span> 10<\/span>:33<\/span>:02<\/span> Installed<\/span>: openssh<\/span>-<\/span>server<\/span>-<\/span>6.6.1<\/span>p1<\/span>-<\/span>35.<\/span>el7_3<\/span>.x86_64<\/span>\nJun<\/span> 22<\/span> 10<\/span>:33<\/span>:02<\/span> Installed<\/span>: cpanel<\/span>-<\/span>perl<\/span>-<\/span>524<\/span>-<\/span>Net<\/span>-<\/span>OpenSSH<\/span>-<\/span>0.74<\/span>-<\/span>1.<\/span>cp1162<\/span>.noarch<\/span>\nJun<\/span> 22<\/span> 10<\/span>:33<\/span>:02<\/span> Installed<\/span>: openssh<\/span>-<\/span>clients<\/span>-<\/span>6.6.1<\/span>p1<\/span>-<\/span>35.<\/span>el7_3<\/span>.x86_64<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n
        If your system\u2019s \/var\/log\/yum.log<\/code> file does not contain the OpenSSH RPMs, the server may exist in a compromised state.<\/p>\n
        The libkeysutils utilities<\/h3>\n
        To check your libkeysutils<\/code> utility for the Ebury Trojan, perform the following steps:<\/p>\n
        \n
        Important:<\/div>\n
        \n
          \n
        • \n
          We recommend that you perform each of the following steps to fully determine your server\u2019s status.<\/p>\n<\/li>\n
        • \n
          Your server\u2019s architecture determines the output that you receive when you run the commands in this section. 32-bit systems use lib<\/code>. 64-bit systems use the \/lib64<\/code> library. The \/lib64<\/code> library may also contain a lib<\/code> directory with 32-bit libraries for compatibility purposes. To find your server\u2019s architecture, run the arch<\/code> command: <\/p>\n
          \n
          [user@host ~<\/span>]$ arch<\/code><\/pre>\n<\/div>\n
           The output will resemble one of the following examples:<\/p>\n
            \n
          • 64-bit server \u2014 x86_64<\/code><\/li>\n
          • 32-bit server \u2014 i386<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul><\/div>\n<\/div>\n
            Verify the keyutils-libs package.<\/h4>\n
            Changes should not occur on your system without your consent. To check for changes on your system, run either of the following commands:\n<\/p>\n
            \n
            \n\n\n
            \n
            1\n<\/span>2\n<\/span><\/code><\/pre>\n<\/td>\n
            		\n
            rpm<\/span> -<\/span>V<\/span> keyutils<\/span>-<\/span>libs<\/span>\nnetstat<\/span> -<\/span>plan<\/span> | grep<\/span> atd<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n
            This command does not<\/strong> return output on non-compromised systems. On compromised systems, this command returns the following output: <\/p>\n
            \n
            \u2026.<\/span>L\u2026<\/span>    \/lib64\/<\/span>libkeyutils.<\/span>so.1<\/span><\/code><\/pre>\n<\/div>\n
            \n
            Note:<\/div>\n
            \n        Ebury control system operators often patch the MD5 sums of the libkeyutils1<\/code> package to match the old packages, so an MD5 check may not reveal compromised packages.\n    <\/div>\n<\/div>\n
            Check the files\u2019 installation source.<\/h4>\n
            If the command in Step 1 returns output, verify whether an RPM provided the files. To do this, run the following command: <\/p>\n
            \n
            rpm -<\/span>qf \/lib64\/<\/span>libkeyutils.<\/span>so.1<\/span><\/code><\/pre>\n<\/div>\n
            \n
            Note:<\/div>\n
            \n        In this example, \/lib64\/libkeyutils.so.1<\/code> represents the file to verify.\n    <\/div>\n<\/div>\n
            On non-compromised systems, the output resembles the following example: <\/p>\n
            \n
            keyutils-<\/span>libs-<\/span>1.4<\/span>-<\/span>5<\/span>.<\/span>el6.<\/span>i686<\/code><\/pre>\n<\/div>\n
            On compromised systems, the output resembles the following example: <\/p>\n
            \n
            file \/lib64\/<\/span>tls\/<\/span>libkeyutils.<\/span>so.1.5<\/span> is not<\/span> owned by any package<\/span><\/code><\/pre>\n<\/div>\n