<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
p.style1, li.style1, div.style1
{mso-style-name:style1;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:#006600;}
span.style11
{mso-style-name:style11;
color:#006600;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=ES-MX link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>HI All,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>We would like to share a hard to find infection on a virtual blueonyx 5106.<br><br>A user got his password compromised and allowed the upload of a few php files, that downloaded an httpd.pl file.<br><br>The Perl program was in fact some sort of smtp engine, that, injected a cronjob that ran every 15 minutes, from the /tmp directory.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Hundred thousands of emails were spewed from the ipadress without being logged at maillog.<br><br>After succesfull infection all files were deleted but the process kept running on memory , so the service was ready to use whenever the hacker wanted to use it, but the files were not on disk anymore.<br><br>To detect it,<br>1 we search at /var/log/cron for unusual entries and then found the cronjob running from there<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>2 we located the file on /tmp that run and searched on the httpd logs at /var/log/httpd/access_log for acceses at the time the file at /tmp was created (with a random name apparently)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>3 Once found the access_log we tried to find the file but it wasn’t there. So we Ran TOP command and then press the letter C, and saw the perl script trying to be disguised as httpd (apache):<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>4 Killed the processes using the pids provided by the top command (a reboot might do as well).<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>5 erased the traces of php files uploaded. As well as cleared the /tmp directory<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Hope it helps someone<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Regards<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><br>Rodrigo O<br>Xnet<o:p></o:p></span></p><p class=MsoNormal><a name="_MailEndCompose"><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></a></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> blueonyx-bounces@mail.blueonyx.it [mailto:blueonyx-bounces@mail.blueonyx.it] <b>On Behalf Of </b>Richard Barker<br><b>Sent:</b> jueves, 30 de abril de 2015 11:26 a. m.<br><b>To:</b> blueonyx@mail.blueonyx.it<br><b>Subject:</b> [BlueOnyx:17487] Re: Smart Relay Server<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have an issue that I have to remove the hostname for the Smart Relay Server<br>click save and re enter is and save about every three days<br>RC<o:p></o:p></p><div><p class=MsoNormal>-- <o:p></o:p></p><p><strong><i>Richard C. Barker Sr. </i></strong><b><i><br><strong>CEO & President </strong><br><strong>1-800-510-3139 </strong><br></i></b><span class=style11><b><i>ProBass Networks Inc. </i></b></span><br><a href="http://www.probassnetworks.net">www.probassnetworks.net</a> <br><a href="http://www.probass.net">www.probass.net</a> <br>*************************************** <br>DISCLAIMER : - <br>This e-mail is confidential and intended only for the use <br>of the individual or entity named above and may contain <br>information that is privileged. If you are not the intended <br>recipient, you are notified that any dissemination, distribution <br>or copying of this e-mail is strictly prohibited. If you have <br>received this email in error, please notify us immediately <br>by return email or telephone and destroy the original message. <o:p></o:p></p></div></div></body></html>