Malware News Hackers Infect Linux Servers With Monero Miner via 5-Year-Old Vulnerability

[Faybert]

A hacker group has made nearly $75,000 by installing a Monero miner on Linux servers after exploiting a five-year-old vulnerability in the Cacti "Network Weathermap" plugin.

Experts from US security firm Trend Micro said they found evidence connecting these attacks to past attacks on Jenkins servers —during which a hacker group made around $3 million installing a Moner miner on Jenkins installations by exploiting the CVE-2017-1000353 vulnerability.

This time around, attackers leveraged CVE-2013-2618, a vulnerability in Cacti, a PHP-based open-source network monitoring and graphing tool, and more specifically in its Network Weathermap plugin, responsible for visualizing network activity.

Just like in the previous attacks, hackers exploited the flaw to gain code execution ability on the underlying servers, where they downloaded and installed a customized version of XMRig, a legitimate Monero mining software.
.....
.....
.....

 

[Mahesh Sudula]

This further support my findings that linux can be penetrated and even get damaged by malware execution.Its rather a misconception that Yes i have installed linux on my sys and iam completely safe......Every OS can be penetrated if an USER wants to penetrate it..rather if he wants to be safe he should apply it from his side than expecting from a Kernel /Software.
3-5 yrs from now Linux soon to become a Windows ...as the malcoders are working on it
Thanks to LINUS TRAVOLDS for developing such an exciting Kernel.
Great share @Faybert

 

[AlanOstaszewski]

The vulnerability was not Linux but the plugin: "five-year-old vulnerability in the Cacti "Network Weathermap" plugin". It doesn't matter if a Windows or Linux gets infected as long as it is the fault of a plugin or software! I could get upset about theese news pages every day. The title should have been "5-Year-Old Vulnerability in Network Weathermap plugin". But doesn't bring so many clicks :/

@Mahesh Sudula Linux will never be that vulnerable to viruses if you choose the right distro. Debian is very stable and secure and Qubes OS even untouchable.

 

[Mahesh Sudula]

The vulnerability was not Linux but the plugin: "five-year-old vulnerability in the Cacti "Network Weathermap" plugin". It doesn't matter if a Windows or Linux gets infected as long as it is the fault of a plugin or software! I could get upset about theese news pages every day. The title should have been "5-Year-Old Vulnerability in Network Weathermap plugin". But doesn't bring so many clicks :/

@Mahesh Sudula Linux will never be that vulnerable to viruses if you choose the right distro. Debian is very stable and secure and Qubes OS even untouchable.

I agree with u..but the thing is SAFETY should be applied from user end then after from an OS / Kernel...
I can penetrate Linux through Firewall directly with Wireshark along with Nmap for port scanning..it's so simple...
Execution in LINUX is damn tough which I agree but see that from all the corners...
Though Superuser holds the rwx(read write execute) rights...but still I can penetrate it through FW with the Process Injection samples...
Remember :- Linux doesn't protect it's critical system files/processes from getting overwritten by an unknown external malicious code..since it's same when it comes to SELF PROTECTION like windows.
Hope u got my idea behind it@askalan
At least we learn things deeply when we discuss and fight