Ebury Backdoor

Ebury is a Secure Shell (SSH) backdoor that has been used in a credential stealing campaign called Operation Windigo. Ebury targets Linux and FreeBSD servers running OpenSSH and has been under development since 2011.

Threat ID:: CC-3096
Category:: Backdoor
Threat Severity:: Low
Threat Vector:
Published:: 13 June 2019 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Affected platforms

The following platforms are known to be affected:

Linux

Linux and FreeBSD servers

Threat details

New versions of Ebury were detected on compromised servers in May 2019

Ebury is spread to new hosts using leaked credentials, which are acquired when a new user logs into an infected server and when an infected server is used to login to any other system.

When a server is compromised, certain dynamic libraries (e.g. libkeyutils.so) are replaced with malicious versions. When these are executed a secondary malicious dynamic library (e.g. libstz.so) is loaded to push malicious hooks and configuration settings within the running OpenSSH server process. An additional malicious process dedicated to credential extraction is forked and the two malicious processes communicate using an abstract socket.

The backdoor provides the threat actors with a remote root shell, which still works when credentials are changed on the infected server.

Remediation steps

Type	Step
	The following steps can help to prevent and detect an infection: Disable direct root login in OpenSSH daemons by setting PermitRootLogin no in /etc/ssh/sshd_config. Use SSH keys instead of password-based logins. Use SSH Agent Forwarding to SSH from servers to servers. Use two-factor authentication on servers. Ensure all operating systems, anti-virus and other security products are kept up-to-date. Log incoming SSH client versions using network monitoring tools. Installation of Ebury requires root access, so any operations could have been carried out by the threat actors. If an infection is discovered: Reimage any infected hosts from a verified source. Reset user and administrator credentials from clean devices, and ensure passwords cannot be reset to the original ones. Inform external users and organisations that have interacted with the infected server.

Type

Step

The following steps can help to prevent and detect an infection:

Disable direct root login in OpenSSH daemons by setting PermitRootLogin no in /etc/ssh/sshd_config.
Use SSH keys instead of password-based logins.
Use SSH Agent Forwarding to SSH from servers to servers.
Use two-factor authentication on servers.
Ensure all operating systems, anti-virus and other security products are kept up-to-date.
Log incoming SSH client versions using network monitoring tools.

Installation of Ebury requires root access, so any operations could have been carried out by the threat actors. If an infection is discovered:

Reimage any infected hosts from a verified source.
Reset user and administrator credentials from clean devices, and ensure passwords cannot be reset to the original ones.
Inform external users and organisations that have interacted with the infected server.

Last edited: 14 February 2020 2:43 pm