Darkleech Apache Attacks Intensify

Security researchers discover hard-to-detect, memory-resident Linux malware compromising Apache servers and redirecting browsers to other infected sites.

Hundreds of servers running Apache HTTP server software have been infected with a new malicious Linux backdoor known as Cdorked. The malware appears to be connected to the so-called
Darkleech attack campaign
thats been using compromised servers and malicious Apache modules to launch drive-by attacks that target known browser vulnerabilities.
While Darkleech has been running for at least two months, attackers appear to still be upping their game. Linux/Cdorked is one of the most sophisticated Apache backdoors we have seen so far, said Pierre-Marc Bureau, security intelligence program manager for security firm ESET, in a blog post that details
how to identify and remediate servers
infected by the malware.
Cdorked uses JavaScript to attack anyone browsing the website. If the attack is successful, the malware redirects the browser to another malicious website, where a crimeware toolkit attempts to further compromise the PC. As part of the handoff, interestingly, Cdorked adds useful attack information to the invoked link, such as the URL from which the browser has been redirected and, according to Bureau, whether or not the request was originally to a JavaScript file so the server [can] provide the right [attack] payload.
[ Have a D-Link IP camera? Upgrade your firmware now. For more details, read
D-Link Camera Security Flaw: Upgrade Now
. ]
Unfortunately, detecting servers that are infected with Cdorked isnt straightforward. The backdoor leaves no traces of compromised hosts on the hard drive other than its modified httpd binary, thereby complicating forensics analysis, Bureau explained, noting that the malware stores no data on a servers hard drive. All of the information related to the backdoor is stored in shared memory. The configuration is pushed by the attacker through obfuscated HTTP requests that arent logged in normal Apache logs. This means that no command and control information is stored anywhere on the system.
Attackers access a backdoored server either
by using a reverse shell
or by using HTTP requests to relay commands. The reverse shell -- or connect-back-shellcode -- requests, however, leave traces that can help administrators identify servers that have been compromised by attackers. [When] the shell is used by the attacker, the HTTP connection creating it is hung [the backdoor code does not implement forking], said Bureau. This implies that malicious shells can be found if one has access to the server and checks for long-running HTTP connections. On the other hand, the HTTP request does not appear in Apaches log file due to the way the malicious code is hooked into Apache.
But the best way to identify infected servers, Bureau said, is to scan servers for the presence of shared memory created by the malware, which will comprise about 6 MB and store the malwares state and configuration information.
The Darkleech campaign was first spotted in early March, when a security researcher at Sophos found that malicious modules added to Apache installations were using iFrames and JavaScript to redirect visitors to websites infected with the
Blackhole crimeware toolkit
.
Early this month, meanwhile, Cisco security researcher Mary Landesman warned that an estimated 20,000 legitimate websites that use Apache HTTP server software had been compromised as part of Darkleech. Those attacks -- as with Cdorked -- have focused on infecting vulnerable Apache installations with an SSHD backdoor. Attackers were able to load malicious modules onto the servers, which then served up drive-by attacks against website visitors.
Which Apache vulnerabilities are attackers exploiting? Cisco last week reported that Darkleech attackers may be exploiting a
Horde/IMP Plesk Webmail bug
thats present in unpatched versions of the Parallels Plesk control panel software used by many Web hosting providers. By injecting malicious PHP code in the username field, successful attackers are able to bypass authentication and upload files to the targeted server, said Craig Williams, who works in Ciscos Security Intelligence Operations threat research group for (SIO), in a
blog post
.
To help block Darkleech attacks, Williams
recommended that website administrators
keep their Apache server software fully patched and updated.
Update:
A Parallels spokeswoman said via email that a patch is available for the Plesk vulnerability identified by Cisco. The exploit warned about by a Cisco researcher was in the third-party Horde webmail for Plesk 9.3 and earlier (products circa 2009 and earlier), not in the Plesk control panel itself, she said. These Plesk versions are end-of-lifed now, but
a patch was promptly issued
in February 2012.
People are your most vulnerable endpoint. Make sure your security strategy addresses that fact. Also in the new, all-digital
How Hackers Fool Your Employees
issue of Dark Reading: Effective security doesnt mean stopping all attackers. (Free registration required.)

Last News
▸ Dual security: 2FA is necessary but not sufficient ◂ Discovered: 05/01/2025 Category: security	▸ Holiday rush makes smartphones vulnerable. ◂ Discovered: 05/01/2025 Category: security	▸ Botnet operators ready to join Operation Payback. ◂ Discovered: 05/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Darkleech Apache Attacks Intensify