Hackers scalp Apache

SSH hits the fan


The website of Apache was taken offline for several hours on Friday after the SSH remote administration key on one of its servers was compromised.

SSH is a widely used technology for remote administration, so in the worst scenario the compromise created a means for hackers to upload Trojanised code onto the download section of Apache's website. Around 50 per cent of webservers run Apache, according to the latest stats from Netcraft, so any problem would be extremely widely felt.

It's unclear at present whether any code on the Apache website was actually modified. Nor do we know how the attack was carried out or who was behind it.

Apache's web site was restored after DNS records were changed so that servers based in Europe rather than at the main US site were carrying the load.

Rik Ferguson, a security researcher at Trend Micro, notes that the same type of compromised SSH key problem led to attacks that attempted to install rootkits on Linux based systems in August 2008.

Screenshots of Apache's statement on the incident, since removed, have been preserved for posterity in a blog posting by Trend Micro here and F-Secure here. ®

Bootnote

Reg reader Jack C told us on Thursday that http://httpd.apache.org/ was giving a directory listing where the index page should be. We saw this but didn't think much of it at the time. Friday's SSH glitch potentially casts this incident in a new light.


Keep Reading

Kremlin hackers are right now exploiting security hole in VMware software to hijack systems, NSA warns

So, you know, patch it

US govt warns foreign hackers 'will likely try to exploit' critical firewall bypass bug in Palo Alto gear – patch now

Bogus signatures may fool your corp network's gatekeeper

The seven deadly sins letting hackers hijack America's govt networks: These unpatched bugs leave systems open

'Unauthorized access to elections support systems' detected tho 'no evidence to date that integrity of elections data has been compromised'

One year after server hackers left NordVPN red-faced, firm's first colocated setup is online

In brief Plus: Bunch of Cisco fixes for Patch Tuesday week, Fitbit kit hit, RAT malware written in Golang, and more

Microsoft emits 83 security fixes – and miscreants are already exploiting one of the vulns in Windows Defender

Patch Tuesday Redmond keeps us hanging with on-premises Exchange flaw still to be fixed

How do you fix a problem like open-source security? Google has an idea, though constraints may not go down well

'Try telling leaders of libpng, libjpeg-turbo, openssl, ffmpeg etc they can't make "unilateral" changes to their own projects'

Europe's digital identity system needs patching after can_we_trust_this function call ignored

ExplicitKeyTrustEvaluator... True, false? Who cares, just accept it anyway

Sloppy string sanitization sabotages system security of millions of Java-powered 3G IoT kit: Patch me if you can

IBM's X-Force Red X-reveals X-flaw in Thales X-wireless X-module X-thing

Biting the hand that feeds IT © 1998–2021