topic Re: Is there a Windigo signature? in General Topics

Is there a Windigo signature?

ddaniels — Thu, 20 Mar 2014 14:56:24 GMT

Hi,

Is there a Windigo signature under another name, or some other way to detect a Windigo infection or infection attempt using the Threat detection feature or something else?

From what I've read only a host based intrusion detection system could actually see an infection, though the scanning and some of the vectors of attack like web may be detectable.

10,000 Linux servers hit by malware (ars technica) [LWN.net]

Thanks,

Drew Daniels

Re: Is there a Windigo signature?

jdelio — Fri, 21 Mar 2014 15:21:17 GMT

I just checked our Threat Vault:

https://threatvault.paloaltonetworks.com/

And we do not have an entry for this.

I think that there were not just 1 or even a handful of vulnerabilities used in all of this.. but combinations of guessing passwords and using known vulnerabilities.

We cannot help against the password guessing, but we can continue to help guard against known threats and vulnerabilities.

Please let me know if this answers your question.

Re: Is there a Windigo signature?

ddaniels — Tue, 25 Mar 2014 19:15:37 GMT

Hi,

I also checked out the Threat Vault. I've now done a more thorough look and I don't see indications that most of the network based signatures are present.

A link of the article I give has some Snort signatures:

malware-ioc/windigo at master · eset/malware-ioc · GitHub lists:

Linux/Ebury
Linux/Cdorked
Linux/Onimiki
Perl/Calfbot

I don't see any of these listed either. At the end of that link it also mentions:

Win32/Glupteba.M
Win32/Boaxxe.G

Though Boaxxe is listed in the viruses section. Boaxxe.G isn't listed.

The white paper is at:

http://www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.pdf

Thanks,

Drew Daniels

Re: Is there a Windigo signature?

ddaniels — Wed, 26 Mar 2014 18:15:01 GMT

Hi,

I also ran across this:

http://www.symantec.com/connect/blogs/25000-linux-and-unix-servers-compromised-operation-windigo

The paper lists three main malicious components (ESET detection names):

Linux/Ebury – an OpenSSH backdoor used to control servers and steal credentials
Linux/Cdorked – an HTTP backdoor used to redirect Web traffic
Perl/Calfbot – a Perl script used to send spam

[...]

Symantec customers are protected against malware used in Operation Windigo with the following signatures:

IPS

System Infected: Festi Rootkit Activity

On https://threatvault.paloaltonetworks.com/ I don't see anything related to ssh in Linux for Virus or Spyware. There's not much for SSH vulnerabilities that would hit except maybe brute force, and authentication informational. I see some "Tracur" signatures, but nothing that has "gen" in the name. dropper has too many hits to be able to figure out if it's the same one. I don't see any of the other parts of the signature sub-names (e.g. I searched for cdorked, Ebury, calfbot...) from this article.

Thanks,

Drew Daniels