{"id":45249,"date":"2024-03-24T21:27:28","date_gmt":"2024-03-24T21:27:28","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=45249"},"modified":"2024-09-09T04:49:06","modified_gmt":"2024-09-09T04:49:06","slug":"devsecops-scanning-remote-hosts-on-the-internet-for-security-vulnerabilities","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/devsecops-scanning-remote-hosts-on-the-internet-for-security-vulnerabilities\/","title":{"rendered":"DevSecOps: Your AWS Abuse Report – scanning remote hosts on the internet for security vulnerabilities"},"content":{"rendered":"\n

Incidents<\/h2>\n\n\n\n

It has been implicated in activity which resembles scanning remote hosts on the internet for security vulnerabilities. Activity of this nature is forbidden in the AWS Acceptable Use Policy (https:\/\/aws.amazon.com\/aup\/<\/a>). We’ve included the original report below for your review.<\/p>\n\n\n\n

This is a notification of unauthorized uses of systems or networks.<\/p>\n\n\n\n

We have observed IP addresses from your network probing my servers for TCP open ports. Due to their dubious behavior, they are suspected to be compromised botnet computers.<\/p>\n\n\n\n

If you regularly collect IP traffic information of your network, you will see the IPs listed connected to various TCP ports of my server at the time logged, and I suspect that they also connected to TCP ports of many other IPs.<\/p>\n\n\n\n

If a Linux system was at the attacker’s IP, you might want to use the command “netstat -ntp” to list its active network connections. If there is still some suspicious connection, find out what PID\/program\/user ID they belong to as you might find something to help you solve this problem.<\/p>\n\n\n\n

In addition to the above, kindly notify the victims (owners of those botnet computers) as this will assist them in taking the appropriate action to clean their computers. Once this action is completed, not only will it prevent severe incidents such as data leakage and DDos but, it will also stand off botnets from taking up your network bandwidth.<\/p>\n\n\n\n

Solution<\/h2>\n\n\n\n

Step – 1 – Investigate the Process<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\n\n\n
$ netstat -ntp\n$ ps -p 207082 -o command=\n$ ls -l \/proc\/207082\/exe\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
\"\"<\/figure>\n\n\n\n
Step 2 – Check for Service Units or Cron Jobs<\/h2>\n\n\n\n
The process might be started by a systemd service or a cron job:<\/p>\n\n\n\n
    \n
  • Systemd service:<\/strong> Check for custom systemd service files in \/etc\/systemd\/system\/<\/code> or \/lib\/systemd\/system\/<\/code> and use systemctl<\/code> to list all services to see if any custom or suspicious service is running.<\/li>\n<\/ul>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    Step 3 – Stop and Disable the Process<\/h2>\n\n\n\n
    \n\n\n
    If the process is managed by a systemd service, disable and stop it:\n\n\n$ sudo systemctl stop servicename.service\n$ sudo systemctl disable servicename.service\n\nIf it's a cron job, remove or comment out the line in the crontab.<\/code><\/span><\/pre>\n\n\n
    Step 4 – Remove Executable and Clean Up<\/h2>\n\n\n\n
    \n\n\n
    After identifying the executable, consider carefully removing it if it's confirmed to be malicious or not needed:\n\n$ sudo rm \/path\/to\/executable\n\nBe cautious, as removing system files or legitimate processes can harm your system.<\/code><\/span><\/pre>\n\n\n
    5. Further Security Measures<\/h2>\n\n\n\n
      \n
    • Rootkit Check:<\/strong> Since this process appears suspicious, it’s a good idea to run a tool like rkhunter<\/code> or chkrootkit<\/code> to check for rootkits.<\/li>\n\n\n\n
    • Malware Scan:<\/strong> Use a Linux-based antivirus tool to scan your system for malware.<\/li>\n\n\n\n
    • Audit Logs:<\/strong> Check \/var\/log\/auth.log<\/code>, \/var\/log\/syslog<\/code>, or relevant system logs for any unusual activity, especially around the times the process was started.<\/li>\n\n\n\n
    • System Updates:<\/strong> Ensure your system and all applications are up-to-date with the latest security patches.<\/li>\n\n\n\n
    • Firewall Review:<\/strong> Verify your iptables<\/code> rules and ensure no unwanted rules are allowing traffic through.<\/li>\n\n\n\n
    • Network Monitoring:<\/strong> Monitor outbound and inbound connections for further suspicious activities.<\/li>\n<\/ul>\n\n\n\n
      CULPRIT#1 <\/h2>\n\n\n\n
      I see the process was getting created by daemon user and through crontab<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n
      file \/var<\/span>\/tmp\/bash18\nfile \/var<\/span>\/tmp\/sh18\nfile \/var<\/span>\/tmp\/init18\n\nfile \/var<\/span>\/bash18\nfile \/var<\/span>\/sh18\nfile \/var<\/span>\/init18\n\nfile \/var<\/span>\/lock\/bash18\nfile \/var<\/span>\/lock\/sh18\nfile \/var<\/span>\/lock\/init18<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      <\/p>\n\n\n\n
      Investigation Further -> How this code was added in Crontab?<\/h2>\n\n\n\n
      I am wondering how these executable such as bash18, sh18 and init18 is set in user daemon crontab using XAMPP. Any clue?<\/h3>\n\n\n\n
      To search through your JavaScript (.js<\/code>) and PHP (.php<\/code>) codebase for patterns that might indicate code responsible for adding cron jobs, you can use the grep<\/code> command in Linux.<\/p>\n\n\n\n
      \n\n\n
      Basic grep Search\nThis searches all PHP and<\/span> JS files for<\/span> the word \"crontab\"<\/span>:\n\n$ grep -r --include<\/span>=\\*.{php,js} \"crontab\"<\/span> .\n\nSearch for<\/span> Shell Execution Functions\n\nMany malicious scripts use<\/span> PHP<\/span>'s<\/span> shell<\/span> execution<\/span> capabilities<\/span> (exec<\/span>, shell_exec<\/span>, system<\/span>, passthru<\/span>, and<\/span> backticks<\/span>) to<\/span> run<\/span> system<\/span> commands<\/span>.\n\n\n$ grep<\/span> -r<\/span> --include<\/span>=\\*.php<\/span> \"\\(exec<\/span>\\|shell_exec<\/span>\\|system<\/span>\\|passthru<\/span>\\|`\\)\" .\n\nThis<\/span> command<\/span> will<\/span> search<\/span> for<\/span> any<\/span> of<\/span> the<\/span> mentioned<\/span> functions<\/span> in<\/span> PHP<\/span> files<\/span>. Note<\/span> the<\/span> use<\/span> of<\/span> backslashes<\/span> to<\/span> escape<\/span> certain<\/span> characters<\/span> and<\/span> the<\/span> use<\/span> of<\/span> \\| to<\/span> indicate<\/span> an<\/span> \"OR<\/span>\" condition<\/span>.\n\nSearching<\/span> for<\/span> Suspicious<\/span> Base64<\/span> Encodings<\/span>\n\nMalicious<\/span> code<\/span> is<\/span> often<\/span> encoded<\/span> in<\/span> Base64<\/span> to<\/span> obfuscate<\/span> its<\/span> presence<\/span>. Searching<\/span> for<\/span> Base64<\/span> encoded<\/span> strings<\/span> can<\/span> sometimes<\/span> uncover<\/span> hidden<\/span> malicious<\/span> code<\/span>.\n\n\n$ grep<\/span> -r<\/span> --include<\/span>=\\*.{php<\/span>,js<\/span>} \"base64_decode<\/span>\" .<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
      List Crontabs for All Users<\/strong><\/h2>\n\n\n\n
      To view the crontab entries for all users, you can check the crontab files stored in \/var\/spool\/cron\/crontabs\/<\/code> (for most Linux distributions). Use the following commands:<\/p>\n\n\n
      for<\/span> user in<\/span> $(cut -f1 -d: \/etc\/<\/span>passwd); do<\/span>\n  echo \"Crontab for user: $user\"<\/span>;\n  sudo crontab -l -u $user 2<\/span>>\/dev\/<\/span>null<\/span>;\ndone<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>","protected":false},"excerpt":{"rendered":"
      Incidents It has been implicated in activity which resembles scanning remote hosts on the internet for security vulnerabilities. Activity of this nature is forbidden in the AWS Acceptable Use Policy (https:\/\/aws.amazon.com\/aup\/). We’ve included the original report below for your review. This is a notification of unauthorized uses of systems or networks. We have observed IP…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-45249","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/45249","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=45249"}],"version-history":[{"count":10,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/45249\/revisions"}],"predecessor-version":[{"id":47082,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/45249\/revisions\/47082"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=45249"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=45249"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=45249"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}