Over the past few weeks, several websites hosted on our Linux Servers and windows threw up virus alerts. Further investigation revealed that these alerts were triggered by an injection attack on packages hosted on our servers, commonly known as Gumblar Attacks. FTP logs of these infected packages indicated that machines of the customers who own those domains were compromised and had been used to upload malicious content to their respective Hosting Packages. A few pointers for your benefit:
What is a Gumblar Attack?
Gumblar appears to be a combination of exploit scripts and malware. The scripts are embedded in .html, .js and .php files using obfuscated Javascript. They load malware content from Third Party sites without the user’s knowledge, while also stealing FTP credentials from the victim’s computer, which then allows it to spread and infect additional sites. Therefore, when someone visits such an infected site they get infected; if they have FTP credentials for a website on their machine then those sites get infected too. This explains the exponential growth of the exploit in such a short space of time.
What makes it different from other Malware exploits?
There are a number of aspects to this exploit that not just help it spread, but also make it difficult to remove. Firstly, it infects users browsing legitimate websites; if these users are webmasters then it infects their websites by using their FTP credentials to inject the script into their site. The obfuscated malicious code being dynamically generated, makes it difficult to detect and difficult to automatically remove. Not only does the script vary from site to site, it can also vary from page to page on that the one site.
For a more detailed read, you can check out the following news article.
- As a precautionary measure, we have blocked FTP services on our Linux Hosting Servers. This will prevent infection of any other Hosting Package. We are in the process of removing malicious content from all those packages that was infected as a result of this. However if we re-establish FTP connections, your clients will re-infect their respective Hosting Packages since their machines are likely to be compromised.
- We will be shifting to a Secure FTP connection and resetting everyone’s FTP passwords across all Linux Hosting packages. You can modify these passwords from your respective Control Panel at a later date. We strongly urge you warn your Customers about this worm and ask them to scan their machines given its exponential spread so far.
- We have also installed Antivirus in our server which will delete any infected files which is uploaded by user.
Over the past few days, we have been investigating these attacks, and working on methods to mitigate the damage caused by them; our findings and recommendations are as follows:
- Through our investigations, it was confirmed that the infection was not due to any server vulnerability. We enforce stringent security measures to safeguard your data.
- The attack is perpetrated through stolen FTP login credentials. It transmits FTP information to an IP address from an infected machine.
- This FTP information is then used to log on to the web server and infect the hosted website.
- The attack is not limited to NetSpaceIndia’s hosting services – so far, thousands of websites across a large number of hosting providers have been infected through this attack.
Given the nature and scope of this attack, it is important that proper security measures to be taken at all levels to prevent it. We would like to suggest a few steps that would reduce the vulnerability of your computer and remove existing threats.
Recommendations:
- Install an antivirus program with the latest updates and ensure removal of any malware, trojans or key loggers on any machine that you use to manage your website’s content via FTP. Several free antivirus software like AVG, AntiVir, Malwarebytes are available for this purpose. Regular virus scans will minimize such threats to a great extent.
- Once you are confident of a clean machine, you should change all FTP passwords.
- Avoid storing the new FTP passwords directly on the FTP clients. Variants of this virus have the potential to grab stored passwords from there.
What you need to do at your end to stay in tandem with the steps that we’ve taken:
All websites that were determined to be infected have now been cleared. If you find any discrepancy with the content of your website, please inform our support team immediately.
We have reset the passwords for all FTP users across all Linux and windows Hosting Packages.
- You need to login to your Control Panel and set new passwords for all FTP users.
- It is advisable that you set complex, alphanumeric passwords and frequently change them for additional security.
- NetSpaceIndia Hosting support FTP access via Secure FTP (SFTP) also. SFTP will encrypt both commands and data, preventing passwords and sensitive information to be sniffed over the network.
- You may also use the File Manager within your control panel to manage your content.
For any doubts/further issues that you may face, please feel free to contact us.
NetSpaceIndia – Support
.gif)
