Have They Really Uncovered a Linux Web Server Botnet?
- Sep 14, 2009 6:10 PM EST
- [num] Comments
Reports are spreading based on an article in The H Security to the effect that a botnet of Linux web servers has been uncovered, serving Windows malware.
The servers all seem to be running the nginx web server, a lesser-known but significant web server. The article doesn't cite a vulnerability in nginx, but guesses that the servers were compromised through weak password policies: "Sinegubko [the analyst who discovered the issue] speculates that some admins may have been sloppy enough to use the root account for (S)FTP operations and to store their root passwords in FTP program settings. The hijackers may have accessed these and sniffed out the root passwords to penetrate these systems."
Given this scenario, it seems off-base to me to call this a botnet. A botnet, as I see it, is controlled through a network protocol, often through IRC, handled by malware on the system. There is no evidence presented that these systems are running any malware, and only speculation that their passwords have been compromised.
If the password scenario is in fact accurate then it's even less innovative than at first thought. We have a long history now of Linux-based web servers being compromised in order to serve Windows malware through vulnerabilities in Apache, PHP, various PHP applications, and SQL injection vulnerabilities. Nobody ever called these botnets before and it's too early to call this one a botnet either.
Finally, the first Linux botnet was actually uncovered 6 months ago running embedded on DSL modems and routers.
That said, it's an interesting problem, once again showing that Linux, like Windows, is only as secure as the administrator running it.