A malicious Apache module found operating in the wild turns sites running the Internet's most popular Web server into platforms that surreptitiously install malware on visitors' computers.
The plugin, which was discovered by researchers from antivirus provider Eset, is an x64 Linux binary that streamlines the process of injecting malicious content into compromised websites. It was found running on an undisclosed website that exposed end users to a variety of exploits that installed the ZeuS banking trojan, also known as Win32/Zbot. It also pushed malware from Sweet Orange, a newer exploit kit hosted by servers in Lithuania that competes with ZeuS. When Eset discovered the plugin last month, it was connecting to command and control servers in Germany and was being used to target banking customers in Russia and elsewhere in Europe.
"This complicated case spreads across three different countries, targeting users from a fourth one, making it very hard for law enforcement agencies to investigate and mitigate," Pierre-Marc Bureau, Eset's security intelligence program manager, wrote in a blog post. "It is not clear at this point in time if the same group of people are behind the whole operation, or if multiple gangs collaborated, perhaps with one to drive traffic to the exploit pack and sell the infected computers to another gang operating a botnet based on Win32/Zbot."
The Apache plugin, which Eset software flags as Linux/Chapro.A, contains several features designed to make infections stealthy. To prevent being widely detected, it doesn't serve malicious content when a visitor's browser user agent indicates it's coming from Google or another automated search-engine agent. It also holds its fire against IP addresses that connect to the Web server over SSH-protected channels, preventing site administrators from being exposed. It also uses browser cookies and IP logging to prevent visitors from being exposed to exploits more than once. By hiding the attacks from search engines and admins—and making it hard to determine how end-user machines are infected—the features make it harder to identify the site as compromised.
The compromised site found by Bureau was injecting invisible iframe tags into otherwise legitimate webpages. The iframes he observed attempted to exploit at least four previously patched security bugs in Microsoft Internet Explorer, Adobe Reader, and Oracle's Java software framework. The plugin has the capability to inject malicious JavaScript into Web content, giving it another powerful avenue for attack.
Bureau didn't say how the site running the plugin was hacked. Many legitimate websites used in malware attacks are commandeered after administrator credentials are compromised. He said the malicious Apache plugin is separate from a Linux rootkit discovered last month that also injects malicious content into otherwise legitimate webpages.
Engineers who develop and maintain Apache offer programming interfaces that allow anyone to write modules that give the Web server additional capabilities. The module discovered by Eset is almost certainly written by a third party that has no affiliation with the Apache Foundation.
Post updated to add the last paragraph.
Listing image by geograph.ie
reader comments
21