Apache Cdorked. A Backdoor
This is a pretty recent attack, using Cpanel to change the Apache httpd binary by a compromised one that embeds a backdoor.
It seems there are a few ways to detect if your server was compromised:
requests with “GET_BACK;” encoded in the query string may arrive
an unexpected Cookie (SECID in that case) may be sent to the server
the server may answer some unexpected Location headers
Configuration
The HAProxy configuration below provides a few hints on how you can detect if you’ve been infected by the backdoor and how you can try to protect users using your services
I consider the website hostname is “www.domain.tld” and static content is delivered by “static.domain.tld”.
The configuration below can be added in the Frontend section:
# We want to capture and log the cookies sent by the client
capture request header Cookie Len 128
# We want to capture and log the Location header sent by the server
capture response header Location Len 128
# block any request with GET_BACK; string encoded
http-request deny if { url_sub 4745545f4241434b3b }
# block any request with a weird cookie
http-request deny if { cook_cnt(SECID) ge 1 }
# block a response with a Location header for a unknown domain
rspdeny ^Location: http://(www|static).domain.tld.*Note that with such backdoor, you may have to monitor your logs (detection phase) first to know if you’ve been affected. Then you can update your configuration to block the attack (protection phase) and of course, you should remove the bad apache binary.
Links:
Subscribe to our blog. Get the latest release updates, tutorials, and deep-dives from HAProxy experts.
