heads up, nginx exploit

[sth]

http://www.h-online.com/open/news/item/Rootkit-infects-Linux-web-servers-1753969.html

[alaricljs]

While that's interesting it does not indicate that nginx is the culprit.  Whatever infected his system is using kernel modules and root level processes to hijack data between nginx and the NIC.  Would probably do the same thing with apache.

So until someone serious figures out the infection vector, this is just some dude that got pwned in an unknown way.

[sth]

sorry i kind of smushed that all together.
it's either a buggy or replaced kernel module that they were able to get on the system or exploit on a system that already had it, and then load it when it is needed. then, to actually take advantage of the rootkit they were able to exploit a different hole in nginx.

i know this stuff is usually very focused in the nix world compared to windows servers. i also don't know or care to know anything about the hardware/software that GH runs on but it's hard not to know that the site runs on top of nginx when we see timeouts from time to time

the reason i was a bit alarmed and decided to post was because it affects a very stable kernel (the one used in deb6). creative destruction!

[alaricljs]

What hole in nginx?  It's sticking code in the network handling part of the kernel.  Has nothing to do with nginx.

[sth]

from what i gathered they were serving up malware pages using nginx. no mention of other webservers.

if you don't think it's a big deal I trust you

[alaricljs]

deeper in it is explained that nginx was producing the correct response and it was mangled inside the kernel between nginx and the network stack.

[sth]

deeper in it is explained that nginx was producing the correct response and it was mangled inside the kernel between nginx and the network stack.

got it. i've been paging back to the exploit analysis in between work stuff and getting a better picture of it.
i raise the alarm as soon as i see smoke, no fire necessary

[SmallFry]

Somebody PM iMav, I know he runs nginx.

[sth]

It's not an nginx exploit afawk

[mkawa]

who says we're even running deb6?