White cert australia 2013-19
Download 41.47 Kb.
|
- Navigate this page:
- Handling Instructions
- Background
- Details
- Indicators of compromise
- General recommendations
- Further information
- Feedback
- Incident reporting
- About CERT Australia
| In the code, the Cascading Style Sheet class name, positioning, IFRAME size, random string and IP or domain are all variable. When injected into a site’s included JavaScript files, the code is wrapped in a “document.write()” method. While some minor variation on this style has been observed, all follow a similar pattern to the code above and all injections seen by CERT Australia have used the “q.php” file in the URL. Indicators of compromiseThere are several files on the systems which may confirm compromise by the DarkLeech malware. Temporary files DarkLeech stores temporary files in the system’s /var/tmp directory. These files are known to contain a variety of information regarding banned IP’s. The files take the following format: sess_<32 character random character string> Module location There are a variety of locations where the Apache HTTP Server may store modules, though each distribution ordinarily limits this to a small number of directories. It is possible for an administrator or malicious actor to include modules from other locations so incident responders should be aware of the locations utilised by a particular server’s installation. For example, it is common for the following distribution types to use the following folders to store or link to modules: Redhat-derived distributions /usr/lib64/httpd/modules /usr/lib/ /lib64/
/usr/lib/apache2/modules /etc/apache2/mods-available /etc/apache2/mods-enabled Additionally, CERT Australia has observed several cases where a “LoadModule” directive has been inserted into a configuration file located in /etc/httpd/conf.d/ or /etc/apache2/conf.d/ directory which loads the DarkLeech module during server start-up. Identification and verification of the malicious module’s origin can be made by utilising the distribution’s package management tools (such as “rpm” or “dpkg”). Quarantining of the module(s) and removal of the references from configuration files will prevent further malicious code insertions by DarkLeech. Some files have been observed to make use of the filesystem’s extended attributes to prevent deletion and would need to be modified for successful removal. Other compromised files and services CERT Australia has received reports that other packages on affected systems have also been compromised, including a number of binaries related to the Secure Shell (SSH) services. Additionally, generic PHP backdoors have also been reported and thus incident responders need to be aware that a malicious Apache module is unlikely to be the only unauthorised file on the system. Depending on the level of compromise, detection of malicious artefacts may only be possible by examining the filesystem when offline. Specific recommendations Although the method of initial compromise related to the DarkLeech module is not currently known, CERT Australia suggests that partners consider the following specific mitigations to protect against this cyber security risk:
Please contact CERT Australia for YARA or CLAMAV detection signatures. General recommendationsCERT Australia suggests that partners consider the following general mitigations to protect against this and other cyber security risks:
Please contact CERT Australia on 1300 172 499 or info@cert.gov.au if you observe activity corresponding to this publication, or if you have any questions concerning the publication, its content or its application. Links
Further information
FeedbackCERT Australia is interested in any feedback you may have with respect to this update and/or the service we provide. Please email info@cert.gov.au or call 1300 172 499, if you would like to provide us with any comments. NOTE: Organisations need to consider the sensitivity of information sent to this email address as it will be ‘in the clear’ and not secure. If needed, secure communication channels for sensitive or incident related information are available on request. Incident reportingPartners observing any activity connected to this publication are requested to contact CERT Australia at info@cert.gov.au or 1300 172 499. This information is used to form an understanding of Australia’s cyber threat context. All information is handled internal to the CERT and in strict confidence. Secure communications mechanisms are available on request. About CERT AustraliaCERT Australia’s primary responsibility is to develop close working relationships with critical infrastructure organisations and businesses that operate systems that are important to Australia’s national interest. In this way, CERT Australia is able to help ensure that important services all Australians rely on in their daily lives, are secure and resilient. In addition to any internal or regulatory requirements that may be in place, CERT Australia partners can report cyber threats and incidents to CERT Australia on 1300 172 499. This telephone number assists CERT Australia to rapidly respond to incidents impacting those services that are critical to all Australians. Cyber crime involves the unauthorised access to or impairment of computer systems and is likely to constitute an offence under the Commonwealth’s Criminal Code Act 1995 and/or state and territory criminal laws. If CERT Australia partners suspect they have been the victim of cyber crime they should report it to the Australian Federal Police.
This document remains the property of the Australian Government. The information contained in this document is for the use of the intended recipient only and may contain confidential or privileged information. If this document has been received in error, that error does not constitute a waiver of any confidentiality, privilege or copyright in respect of this document or the information it contains. This document and the information contained herein cannot be disclosed, disseminated or reproduced in any manner whatsoever without prior written permission from the Assistant Secretary, CERT Australia, Attorney-General's Department, 3 - 5 National Circuit, Barton ACT 2600. The material and information in this document is general information only and is not intended to be advice. The material and information is not adapted to any particular person’s circumstances and therefore cannot be relied upon to be of assistance in any particular case. You should base any action you take exclusively on your own methodologies, assessments and judgement, after seeking specific advice from such relevant experts and advisers as you consider necessary or desirable. To the extent permitted by law, the Australian Government has no liability to you in respect of damage that you might suffer that is directly or indirectly related to this document, no matter how arising (including as a result of negligence). WHITE Directory: system -> files files -> Haiti Relief – esf 15 Support Organization Situation Report # 17 1/28/10 files -> Haiti Relief – esf 15 Support Organization Situation Report # 16 1/27/10 files -> Right to Carbon or Right to Life: Human Rights Approaches to Climate Change files -> Enhancing interactive learning in the classroom with Turning Point files -> Curriculum vita files -> - files -> Acknowledgements files -> Nw, Washington D. C 20037 Telephone: (202)884-1080, (202)939-6125/7 files -> Grey-headed Flying-fox Management Strategy for the Lower Hunter Grey-headed Flying-fox Download 41.47 Kb. Share with your friends:
|