Comments on: Another Round of Beladen? Or, The New "Go" Infection http://wewatchyourwebsite.com/wordpress/2009/07/another-round-of-beladen-or-the-new-go-infection/ Website Security Mon, 30 Aug 2010 14:19:02 +0000 hourly 1 http://wordpress.org/?v=3.0.1 By: admin http://wewatchyourwebsite.com/wordpress/2009/07/another-round-of-beladen-or-the-new-go-infection/#comment-44 admin Wed, 20 Jan 2010 12:30:44 +0000 http://www.wewatchyourwebsite.com/wordpress/?p=202#comment-44 Yes. They also include it in legitimate .php files. That way, whenever that file is accessed or included in another file, their process runs and re-infects the site. What kind of errors on your getting with the perl script? I haven't tested it on Centos5 but I can try and help you debug it. I have seen where the child processes will re-activate after a re-boot. Like mentioned above, sometimes the code will be in a legitimate file so as soon as that .php file is called, either by a browser or as an included file, it will fire off the child process and re-activate. If you have root access to the server, you can scan all .php files for eval(base64_decode and examine those files. If it's a shared server you're scanning, the website you find those files on, is probably the one that infected the server. I would suggest contacting the website owner and making them aware of the infection so they can scan all their PCs for viruses that may compromised their FTP credentials. Yes. They also include it in legitimate .php files. That way, whenever that file is accessed or included in another file, their process runs and re-infects the site.

What kind of errors on your getting with the perl script? I haven’t tested it on Centos5 but I can try and help you debug it.

I have seen where the child processes will re-activate after a re-boot. Like mentioned above, sometimes the code will be in a legitimate file so as soon as that .php file is called, either by a browser or as an included file, it will fire off the child process and re-activate.

If you have root access to the server, you can scan all .php files for eval(base64_decode and examine those files. If it’s a shared server you’re scanning, the website you find those files on, is probably the one that infected the server. I would suggest contacting the website owner and making them aware of the infection so they can scan all their PCs for viruses that may compromised their FTP credentials.

]]> By: SEO-Bliss http://wewatchyourwebsite.com/wordpress/2009/07/another-round-of-beladen-or-the-new-go-infection/#comment-43 SEO-Bliss Fri, 15 Jan 2010 18:11:30 +0000 http://www.wewatchyourwebsite.com/wordpress/?p=202#comment-43 Some questions: -Is there any other way that hackers "activate" this script, other than the POST method? -About the perl script: has anyone gotten this to work on Centos5? -Has anyone seen child processes stay alive after a re-boot? Thanks. Some questions:
-Is there any other way that hackers “activate” this script, other than the POST method?
-About the perl script: has anyone gotten this to work on Centos5?
-Has anyone seen child processes stay alive after a re-boot?
Thanks.

]]> By: Kepi http://wewatchyourwebsite.com/wordpress/2009/07/another-round-of-beladen-or-the-new-go-infection/#comment-42 Kepi Thu, 12 Nov 2009 13:56:24 +0000 http://www.wewatchyourwebsite.com/wordpress/?p=202#comment-42 Thank you very much an ISP Admin! With small tweaks in you perl script, we successfully manage to detect this problem Thank you very much an ISP Admin! With small tweaks in you perl script, we successfully manage to detect this problem

]]> By: Dilip Kumar http://wewatchyourwebsite.com/wordpress/2009/07/another-round-of-beladen-or-the-new-go-infection/#comment-41 Dilip Kumar Tue, 06 Oct 2009 17:07:06 +0000 http://www.wewatchyourwebsite.com/wordpress/?p=202#comment-41 <a href="http://dilipkumar.in/" rel="nofollow">My Website </a> http://dilipkumar.in hosted on a shared webhosting service is also having the same problem from pretty long time. I many times contacted The Hosting providers - but they are unable to understand the problem fully.... and are opining that the problem is with mallicious code on my website. The treat is such a thing it appears very randomly initially I used to think the problem is only with homepage.. but the problem is with every file.. Once it happened that My robots.txt as cached by the Google (as seen in webmaster tools) also shown that obfuscated javascript cookie code.. huff.... If some one found out the problem.. please let the people know..... All my hard earned meager traffic will be lost .. if not addressed soon.. Thanks for the Post My Website http://dilipkumar.in hosted on a shared webhosting service is also having the same problem from pretty long time. I many times contacted The Hosting providers – but they are unable to understand the problem fully…. and are opining that the problem is with mallicious code on my website.
The treat is such a thing it appears very randomly initially I used to think the problem is only with homepage.. but the problem is with every file.. Once it happened that My robots.txt as cached by the Google (as seen in webmaster tools) also shown that obfuscated javascript cookie code.. huff….
If some one found out the problem.. please let the people know…..
All my hard earned meager traffic will be lost .. if not addressed soon..
Thanks for the Post

]]> By: an ISP Admin http://wewatchyourwebsite.com/wordpress/2009/07/another-round-of-beladen-or-the-new-go-infection/#comment-40 an ISP Admin Sun, 04 Oct 2009 23:39:56 +0000 http://www.wewatchyourwebsite.com/wordpress/?p=202#comment-40 Hi, Admin is right. He has hit the nail right on the head. I spent 6 days chasing this problem down myself and found the problem was initiated by PHP scripts that were taking over apache children and serving malicious redirect requests. I made a write-up about this with all the gory details, including a couple of different detection methods. http://smaert.com/apache_mischief/writeup.txt Hope it helps. -an isp admin Hi,

Admin is right. He has hit the nail right on the head. I spent 6 days chasing this problem down myself and found the problem was initiated by PHP scripts that were taking over apache children and serving malicious redirect requests.

I made a write-up about this with all the gory details, including a couple of different detection methods.

http://smaert.com/apache_mischief/writeup.txt

Hope it helps.
-an isp admin

]]> By: admin http://wewatchyourwebsite.com/wordpress/2009/07/another-round-of-beladen-or-the-new-go-infection/#comment-39 admin Thu, 01 Oct 2009 13:44:46 +0000 http://www.wewatchyourwebsite.com/wordpress/?p=202#comment-39 @Csaba, You probably won't see any suspicious process or even a modified binary, what we've found is that there is an infectious .php file that contains some base64 code. The code is the binary (ELF) that takes advantage of an Apache APR bug of some sort. Whenever the .php file is POSTed to with the correct parameters, the infection is live for some period of time. There is no binary to find because it's obfuscated in the base64 code. If you have access to the root of the server, you can search all websites for a .php file with base64_decode in it as a start. However, we've been seeing where the .php file has hidden the base64_decode like this: ?php $PyIqJDl='#####e##############################v###a####l(b########a####s###e###########6##4##########_##d###eco###d####e#######(#\'ZXJ Then there's a piece of code at the end that looks like this: $PyIqJDl=str_replace('#', '', $PyIqJDl); Which removes all of the #'s and reveals the eval(base64_decode(... string. Do you have root access to this server? If so, please let me know as I would like to gather as much information as possible and let the world know, what to look for. Have you seen any POST requests in the access.log? It might look like this: 2xx.2xx.2xx.14 - - [30/Sep/2009:18:24:51 +0100] "POST /test/php/test.php HTTP/1.1" 200 281 "http://www.google.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Alexa Toolbar)" 7x.x2.1xx.1xx - - [30/Sep/2009:18:24:52 +0100] "POST /test/php/test.php HTTP/1.1" 200 8976 "http://www.google.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Alexa Toolbar)" Let me know... @Csaba,

You probably won’t see any suspicious process or even a modified binary, what we’ve found is that there is an infectious .php file that contains some base64 code. The code is the binary (ELF) that takes advantage of an Apache APR bug of some sort. Whenever the .php file is POSTed to with the correct parameters, the infection is live for some period of time. There is no binary to find because it’s obfuscated in the base64 code.

If you have access to the root of the server, you can search all websites for a .php file with base64_decode in it as a start. However, we’ve been seeing where the .php file has hidden the base64_decode like this:

?php $PyIqJDl=’#####e##############################v###a####l(b########a####s###e###########6##4##########_##d###eco###d####e#######(#\’ZXJ

Then there’s a piece of code at the end that looks like this:

$PyIqJDl=str_replace(‘#’, ”, $PyIqJDl);

Which removes all of the #’s and reveals the eval(base64_decode(… string.

Do you have root access to this server? If so, please let me know as I would like to gather as much information as possible and let the world know, what to look for.

Have you seen any POST requests in the access.log? It might look like this:

2xx.2xx.2xx.14 – - [30/Sep/2009:18:24:51 +0100] “POST /test/php/test.php HTTP/1.1″ 200 281 “http://www.google.com” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Alexa Toolbar)”
7x.x2.1xx.1xx – - [30/Sep/2009:18:24:52 +0100] “POST /test/php/test.php HTTP/1.1″ 200 8976 “http://www.google.com” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Alexa Toolbar)”

Let me know…

]]> By: Csaba http://wewatchyourwebsite.com/wordpress/2009/07/another-round-of-beladen-or-the-new-go-infection/#comment-38 Csaba Wed, 30 Sep 2009 14:21:49 +0000 http://www.wewatchyourwebsite.com/wordpress/?p=202#comment-38 Hi, I also found a server with this new "n_sess_id" infection. I couldn't find any suspicious process or even modified binary (of course, this check is not 100% correct on a running server). The interesting thing is the apache sometimes gives this infected content instead of a static page even! So, there is no PHP or anything else is used... Hi,

I also found a server with this new “n_sess_id” infection. I couldn’t find any suspicious process or even modified binary (of course, this check is not 100% correct on a running server). The interesting thing is the apache sometimes gives this infected content instead of a static page even! So, there is no PHP or anything else is used…

]]> By: admin http://wewatchyourwebsite.com/wordpress/2009/07/another-round-of-beladen-or-the-new-go-infection/#comment-37 admin Mon, 21 Sep 2009 11:39:44 +0000 http://www.wewatchyourwebsite.com/wordpress/?p=202#comment-37 Yes. The latest attack is creating the cookies with n_sess_id and from what we've seen, quite often it's a server side compromise. We don't have any real details on it as far as what to look for. But it does seem like it's a process running as the same user as Apache is. So it's very similar to previous server side infections. Do you have access to any servers that have been hit by this? Yes. The latest attack is creating the cookies with n_sess_id and from what we’ve seen, quite often it’s a server side compromise. We don’t have any real details on it as far as what to look for. But it does seem like it’s a process running as the same user as Apache is. So it’s very similar to previous server side infections.

Do you have access to any servers that have been hit by this?

]]> By: NetPanther http://wewatchyourwebsite.com/wordpress/2009/07/another-round-of-beladen-or-the-new-go-infection/#comment-36 NetPanther Sun, 13 Sep 2009 17:43:17 +0000 http://www.wewatchyourwebsite.com/wordpress/?p=202#comment-36 Just now I detected another attack here in Germany, which seems similar to those noticed before. When calling a php file, a fake virus warning shows up randomly (x out of 100 times). The scripts sets a cookie called "n_sess_id" and redirects to a page called "best[minus]virus[minus]scanner5[dot]com". Maybe a new round? Just now I detected another attack here in Germany, which seems similar to those noticed before. When calling a php file, a fake virus warning shows up randomly (x out of 100 times).

The scripts sets a cookie called “n_sess_id” and redirects to a page called “best[minus]virus[minus]scanner5[dot]com”. Maybe a new round?

]]> By: Helvetica http://wewatchyourwebsite.com/wordpress/2009/07/another-round-of-beladen-or-the-new-go-infection/#comment-35 Helvetica Sat, 01 Aug 2009 16:40:17 +0000 http://www.wewatchyourwebsite.com/wordpress/?p=202#comment-35 Our forum (Switzerland) has been hit by these swine. Very annoying and I hope that our programmer can fix it, as I have no more access to our server. Our forum (Switzerland) has been hit by these swine. Very annoying and I hope that our programmer can fix it, as I have no more access to our server.

]]>