Ruby on Rails vulnerability exploited in the wild

Posted by   Virus Bulletin on   May 29, 2013

Code executed on web servers to cause them to join IRC botnet.

A critical vulnerability in Ruby on Rails is currently being exploited to make web servers join an IRC botnet, Ars Technica reports.

The vulnerability was discovered and subsequently patched at the beginning of this year, but many website owners haven't applied the patch yet. In failing to do so, they are allowing for remote commands to be executated on their servers - and attackers are taking advantage of this to modify the crontab. This is turn makes the web server download a number of files, as well as a piece of C code, which is compiled on the server; a pre-compiled version of the same code is also downloaded, in case compilation fails.

The web server then joins a number of IRC channels from which the attackers can control it. Interestingly, the communication with these channels is unauthenticated, which would allow competing botherders to take control of the compromised servers.

The use of IRC is reminiscent of early Windows-based botnets, and with a fix that has been available for months, this may not seem a big threat. Still, to quote security researcher Jeff Jarmoc, who discovered the botnet, "that isn't to say it won't make a bad day for some people".

Those running Ruby on Rails should make sure they run an up-to-date version (Ars Technica lists versions 3.2.11, 3.1.10, 3.0.19, or 2.3.15 and later as being immume to the attack), while some experts have been critical of the use of Ruby on production websites in general.

But the botnet is part of a bigger trend.

We have recently written about how web server binaries are being replaced by malicious ones, and about WordPress blogs being used in a DDoS attack. There have also been reports of the growing volume of spam sent from compromised web hosts, rather than compromised PCs.

Given their fast Internet connections, it is not hard to see why attackers have taken an interest in web servers. And because such servers (after the initial set-up) typically run themselves, security tends not to be a priority, if it is considered at all. Is it perhaps time for a wake-up call among webmasters?

Posted on 29 May 2013 by Martijn Grooten

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Throwback Thursday: Giving the EICAR test file some teeth

The 68-byte EICAR test file plays as important a role today as it did 19 years ago. In this week's Throwback Thursday we look back at a VB99 conference paper in which Randy Abrams described how this 'miracle tool' worked and how it could be used.

XMRig used in new macOS cryptominer

A new piece of cryptocurrency-mining malware on macOS has been found to use the popular XMRig miner.

Tendency for DDoS attacks to become less volumetric fits in a wider trend

CDN provider Cloudflare reports an increase in DDoS attacks targeting layer 7 and focusing on exhausting server resources rather than sending large volumes of data. This fits in a wider trend.

Turkish Twitter users targeted with mobile FinFisher spyware

Through fake social media accounts, users were tricked into installing an Android application that was actually a mobile version of the FinFisher spyware.

Hide'n'Seek IoT botnet adds persistence

The Hide'n'Seek IoT botnet has received an update to make its infection persist on infected devices beyond a restart.