【資訊】lxadmin/kloxo安全漏洞致多家VPS公司被黑

黑客在05/21/2009向lxlabs.com向對方報告了多個lxadmin/kloxo安全漏洞，但是為引起對方關注，06/07/2009在milw0rm.com公佈了，我認為是部分的漏洞，地址是http://www.milw0rm.com/exploits/8880，因為我昨天就看到了相關的漏洞，需要取得本地權限之後才能獲得管理員權限，所以我相信黑客是公示的這些漏洞可能在如何獲得本地有所保留的，實際他可能可以輕鬆的獲得本地權限進而獲得管理員權限。今天多家VPS公司被黑，vaserv.com旗下的cheapvps、fsckvps等都受到嚴重影響，部分服務器數據甚至被刪除，目前所有的VPS都被斷開，網站都無法訪問。我在北京時間08/06/2009打開vaserv.com的網站看到
* b6 t# ~2 g( V+ j& J( A2 m; K
6 C$ t2 H8 q* B# IAt approx 7pm GMT VASERV HyperVM was hacked and it appears that all nodes have some level of damage. We are currently working on the situation and will be putting updates here.
/ h: I* X6 g: b& T! s% ^/ s
) G0 @7 E% R7 p* }1 U) D" D' bCurrently we have no ETA on this
' ^3 X/ t' ?: ^8 [1 q( Q6 f# S, q
0 \7 U% l/ ]0 l; L! a: ~23:18 GMT. We are going to bring the support desk back online shortly so we can start getting a track of where customers are.

Per DC
* o8 a( f# s: ?
LA FSCKVPS - People are onsite working on the system

! `# L: Z% E- U; _7 AWireSix Atlanta - People are working onsite
7 G+ O6 x4 z9 i- r& U9 g* D' D* _
% x0 s. ~% O2 ]TMS - Expecting someone onsite within 1 hour
" G, X) x& q7 @5 C
9 o/ X( s! Y/ DUK - We have 4 people onsite and gauging status

Overall it looks like /boot on the nodes has been removed. Some nodes are definitly missing /vz data and others have it intact. We will be going node by node to get things going ASAP.

Our HyperVM db's are intact so this means we can link everyone to their VPS

: [1 q" v! w  [! i- @8 _, Z
& ^+ a5 |6 h. q2 K! n  G( S7 h' f23:56 GMT: We now have a rolling action plain in place for all nodes and are starting checks/restores. Please note we are expecting at least 24-48 hours to get things even remotly stable
" ]7 v2 {4 {; z- H7 m
00:32 GMT: We have so far done some test rebuilds on 5 boxes and results look semi promsing for the root VPS data (/vz). /etc/ was removed meaning config files need rebuilding however this is easy enough to do from HyperVM database. As it stands we will NOT be giving public access to HyperVM for the forseable future. We may/may not still use it internally via some very strong firewall controls. For rebuilds etc we will be asking people to do support tickets etc
01:45 GMT: We are finding some empty nodes bu generally we would estimate 80-90% of data is intact. We have started to bring a few customers onine and will be bringing others online/informing about node status in the next few hours. Currently we are still working with onsite staff + providers to restore access to servers. We are still standing by our 24-48 hour window
3 \' \4 u( m5 s, t05:05 GMT: vz1uk.vaserv.com restore
5 H, _, D# O. j5 z$ Z: r, G6 Cserver3.fsckvps.com restored
( g# [, O0 m% ~- x+ Tvz5uk.vaserv.com - full data loss
8 K5 c5 Z4 z1 ^) Q  F5 Z! |- |vz7uk.vaserv.com - full data loss
05:22 GMT: We have approx 90% of the fsckvps nodes now online and are working on restroing VPS access. Currently we are putting everone on the same basic config just so things are up and will go round setting correct limits when things are calmer.
9 a! f* @* K0 G4 ^For LA vaserv ndoes all have been reloaded but need configs re-creating which we will do once our HyperVM VASERV is restored, through there won't be public access to start with, if at all. VAServ Texas are about all restored. UK we are about 50% of the way through and have 3 people working flat out on it
- J/ r- Q" B( B! v: [05:33 GMT server5.fsckvps.com restored
05:36 GMT server7.fsckvpscom restored
0 P  U4 L5 Z- a05:43 GMT servr9 appears to have full data loss
( s) N# ^8 @- @! u3 S- j( y05:48 GMT server8.fsckvps.com full data loss
8 j8 P/ h' r# N% E) l0 X% m+ m05:52 GMT server6.fsckvps.com restored

本文首發於誠信空間：http://www.9125.info/thread-394-1-1.html

恐怖~~~~~~~~~~~~~~~~~