The attack, originally thought to have impacted several hundred websites, actually has infected about 10,000 websites, including some in the United States but mostly in the United Kingdom.
According to the Atlanta-based managed security service provider, the exploits install a copy of Rbot and other malware on Apache servers. These are typically large files in the 144 KB to 433 KB range, and are "packed" in a way that avoids alerts for suspicious use of packets, tools that compress and scramble code in executable files.
SecureWorks says that organizations can protect against this attack by disabling dynamic loading in their Apache module configurations. The manner in which the perpetrators have injected their code into Apache servers is "very clever," Jon Ramsey, SecureWorks chief technology officer, told SCMagazineUS.com.
"[The code-injection process] changes the behavior of the Apache server to deliver malware content," he said.
Visitors to infected websites can avoid infection by ensuring their anti-virus signatures are up to date and that they have patched all vulnerable software. The attack does not take advantage of any unknown or zero-day vulnerabilities, SecureWorks added.
SecureWorks has yet to pinpoint exactly who the attackers are, Ramsey said.
"The attacks do not match any typical attack patterns from any of the well-known Russian or Chinese groups," SecureWorks said in a prepared statement. "Some signs [indicate it is] Western European or even North American in origin."
"We have some interesting clues about where the group or person may be from, but no definitive information," Ramsey said.
See original article on scmagazineus.com
Mass attack on Apache servers running Linux can be stopped by disabling server's dynamic loading: SecureWorks
By Jim Carr on Jan 25, 2008 9:47AM