‘Web Server Botnets and Server Farms as Attack Platforms’


This is an article on cross platform web server malware and their massive use as botnets, spam bots and generally as attack platforms.’


‘The information has been provided by Beyond Security.
The original paper can be found at: http://www.beyondsecurity.com/whitepapers/GadiEvron_VBFeb07.pdf


‘In the February edition of the Virus Bulletin magazine Kfir Damari, Noam Rathaus and Gadi Evron of Beyond Security) wrote an article on cross platform web server malware and their massive use as botnets, spam bots and generally as attack platforms.

Web security papers deal mostly with secure coding and application security. In this paper they describe how these are taken to the next level with live attacks and operational problems service providers deal with daily.

They discuss how these attacks work using (mainly) file inclusion vulnerabilities (RFI) and (mainly) PHP shells.
Further, they discuss how ISPs and hosting farms suffer tremendously from this, and what can be done to combat the threat.

Malware is often built to operate within a certain OS environment. Web server malware is completely cross-platform (as long as a web daemon which supports scripting can be found such as IIS, Apache, etc.). These malware attack the web application first, and only then further compromise takes place platform by platform, using the web server’s privileges.

Most web servers are being compromised by these attacks as a result of an insecure web application written in PHP, although attacks for other scripting languages such as Perl and ASP are also in-the-wild.

The main reason for this is that many different PHP applications are available online, and often freely as open source, which makes them a popular selection for use on many web sites. Another reason for the popularity of attacks against PHP applications is that writing securely in PHP is very difficult, which makes most of these PHP applications vulnerable to multiple attacks, with hundreds of new vulnerabilities released publicly every month.

While in the past botnets used to be composed of mainly broadband end users running Windows, today we can see more and more server botnets we can refer to as ‘IIS botnets’ or ‘Linux botnets’ as a direct result of these attacks.

One of the conclusions they reached was that although the technologies used are not new (RFI, PHP shells, etc.) the sheer scale of the problem is what’s interesting.

In their research as detailed in the Virus Bulletin article they recognize that vulnerabilities such as file inclusion, as simple as they may be, are equivalent to remote code execution in effect.

Although escalation wars, which are reactive in nature, are a solution the industry hates and is stuck with on botnets, spam, fraud and many other fronts, this front of web server attacks stands completely unopposed and controlled by the bad guys. In their research they detail how over-time, when aggregated, most attacks come from the same IP addresses without these ever getting blocked.

ISPs and hosting farms selling low-cost hosting services can not cope with this threat, especially where an attack against one user running such an application can compromise a server running 3000 other sites.

Another issue discussed was the formation of the Web Honeynet Task Force (renamed from the Web Honeynet Project to avoid confusion with the honeynet project).

The paper can be found here:
Web Server Botnets and Server Farms as Attack Platforms (all rights reserved to Virus Bulletin)’

Categories: Reviews