Information Security News
Mitsubishi Corp : NEC Corporation and Mitsubishi Corporation to Form ...
4-traders (press release)
NEC Corporation, (NEC), Mitsubishi Corporation (MC) and Infosec Corporation (Infosec), a wholly owned subsidiary of MC, have reached an agreement in which NEC will acquire a 60% equity interest in Infosec. As a result of this transaction, Infosec will ...
SANS ISC reader Christopher found the following in the crontab of a customer's CentOS machine. I include it as an image here, to keep your anti-virus from panicking on this diary six months from now ...
Roughly every 90 minutes, this crontab will download and start the latest version of a backdoor / DDoS trojan off the dgnfd564sdf website. Every minute, it will also turn off the firewall if one is running (iptables stop) and try and hide its presence (history -c, >.bash_history, etc). Current assumption is that the bad guys got in via an unknown webmin vulnerability or - most likely - via a weak password. We're still investigating the binaries:
All six are >1.2mb and of type "ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped". The wget links are currently still live, investigate at your own risk.
If you have seen the same thing or additional insights, please share in the comments below!
(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Dataguise Positioned in "Visionaries" Quadrant of the Gartner Magic Quadrant ...
@Gartner_Inc [email protected] #Visionary in 2013 Data Masking #MQ (LINK) #infosec#datasecurity. Gartner analysts Joseph Feiman and Brian Lowans wrote in the DataMasking Technology report that, "Data masking has emerged to addressrelational ...