Ac1db1tch3z

Last updated
Ac1db1tch3z
AbbreviationAB
FormationEarly 2000s
Purpose Hacking

Ac1db1tch3z (also known as AB for short) were a hacking group most well known for their 0day exploits in Linux [1] [2] , CVS [3] [4] and supply chain attacks on UnrealIRCd [5] and ProFTPD [6] .

UnrealIRCd

In November 2009 the source code copies for version 3.2.8.1 of UnrealIRCd were replaced with a version containing a backdoor. [5] This backdoor allowed an attacker to run any command on a server running the backdoored version of the software. The backdoor was discovered in June 2010.

Related Research Articles

<span class="mw-page-title-main">Slackware</span> Linux distribution (operating system)

Slackware is a Linux distribution created by Patrick Volkerding in 1993. Originally based on Softlanding Linux System (SLS), Slackware has been the basis for many other Linux distributions, most notably the first versions of SUSE Linux distributions, and is the oldest distribution that is still maintained.

<span class="mw-page-title-main">Timeline of computer viruses and worms</span> Computer malware timeline

This timeline of computer viruses and worms presents a chronological timeline of noteworthy computer viruses, computer worms, Trojan horses, similar malware, related research and events.

CAcert.org is a community-driven certificate authority that issues free X.509 public key certificates. CAcert.org relies heavily on automation and therefore issues only Domain-validated certificates.

A backdoor is a typically covert method of bypassing normal authentication or encryption in a computer, product, embedded device, or its embodiment. Backdoors are most often used for securing remote access to a computer, or obtaining access to plaintext in cryptosystems. From there it may be used to gain access to privileged information like passwords, corrupt or delete data on hard drives, or transfer information within autoschediastic networks.

Linux malware includes viruses, Trojans, worms and other types of malware that affect the Linux family of operating systems. Linux, Unix and other Unix-like computer operating systems are generally regarded as very well-protected against, but not immune to, computer viruses.

<span class="mw-page-title-main">Webmin</span> Web-based control panel for Unix-like systems

Webmin is a web-based server management control panel for Unix-like systems. Webmin allows the user to configure operating system internals, such as users, disk quotas, services and configuration files, as well as modify and control open-source apps, such as BIND, Apache HTTP Server, PHP, and MySQL.

<span class="mw-page-title-main">LWN.net</span> Computing webzine with an emphasis on Unix-like operating systems

LWN.net is a computing webzine with an emphasis on free software and software for Linux and other Unix-like operating systems. It consists of a weekly issue, separate stories which are published most days, and threaded discussion attached to every story. Most news published daily are short summaries of articles published elsewhere, and are free to all viewers. Original articles are usually published weekly on Thursdays and are available only to subscribers for two weeks, after which they become free as well. LWN.net is part of Eklektix, Inc.

vsftpd is an FTP server for Unix-like systems, including Linux. It is the default FTP server in the Ubuntu, CentOS, Fedora, NimbleX, Slackware and RHEL Linux distributions. It is licensed under the GNU General Public License. It supports IPv6, TLS and FTPS.

Freenode, stylized as freenode and formerly known as Open Projects Network, is an IRC network which was previously used to discuss peer-directed projects. Their servers are accessible from the hostname chat.freenode.net, which load balances connections by using round-robin DNS.

A supply chain attack is a cyber-attack that seeks to damage an organization by targeting less secure elements in the supply chain. A supply chain attack can occur in any industry, from the financial sector, oil industry, to a government sector. A supply chain attack can happen in software or hardware. Cybercriminals typically tamper with the manufacturing or distribution of a product by installing malware or hardware-based spying components. Symantec's 2019 Internet Security Threat Report states that supply chain attacks increased by 78 percent in 2018.

<span class="mw-page-title-main">Linux kernel</span> Free Unix-like operating system kernel

The Linux kernel is a free and open source, UNIX-like kernel that is used in many computer systems worldwide. The kernel was created by Linus Torvalds in 1991 and was soon adopted as the kernel for the GNU operating system (OS) which was created to be a free replacement for Unix. Since the late 1990s, it has been included in many operating system distributions, many of which are called Linux. One such Linux kernel operating system is Android which is used in many mobile and embedded devices.

<span class="mw-page-title-main">Antisec Movement</span> Hacking (computer security)

The Anti Security Movement is a movement opposed to the computer security industry. Antisec is against full disclosure of information relating to software vulnerabilities, exploits, exploitation techniques, hacking tools, attacking public outlets and distribution points of that information. The general thought behind this is that the computer security industry uses full disclosure to profit and develop scare-tactics to convince people into buying their firewalls, anti-virus software and auditing services.

i-MSCP is a free and open-source software for shared hosting environments management on Linux servers. It comes with a large choice of modules for various services such as Apache2, ProFTPd, Dovecot, Courier, Bind9, and can be easily extended through plugins, or listener files using its events-based API.

UnrealIRCd is an open-source IRC daemon, originally based on DreamForge, and is available for Unix-like operating systems and Windows. Since the beginning of development on UnrealIRCd c. May 1999, many new features have been added and modified, including advanced security features and bug fixes, and it has become a popular server.

perf is a performance analyzing tool in Linux, available from Linux kernel version 2.6.31 in 2009. Userspace controlling utility, named perf, is accessed from the command line and provides a number of subcommands; it is capable of statistical profiling of the entire system.

<span class="mw-page-title-main">Intel Management Engine</span> Autonomous computer subsystem

The Intel Management Engine (ME), also known as the Intel Manageability Engine, is an autonomous subsystem that has been incorporated in virtually all of Intel's processor chipsets since 2008. It is located in the Platform Controller Hub of modern Intel motherboards.

OverlayFS is a union mount filesystem implementation for Linux. It combines multiple different underlying mount points into one, resulting in single directory structure that contains underlying files and sub-directories from all sources. Common applications overlay a read/write partition over a read-only partition, such as with LiveCDs and IoT devices with limited flash memory write cycles.

<span class="mw-page-title-main">DNF (software)</span> RPM package manager

DNF or Dandified YUM is the next-generation version of the Yellowdog Updater, Modified (yum), a package manager for .rpm-based Linux distributions. DNF was introduced in Fedora 18 in 2013; it has been the default package manager since Fedora 22 in 2015, Red Hat Enterprise Linux 8, and OpenMandriva, and is also an alternative package manager for Mageia.

<span class="mw-page-title-main">MalwareMustDie</span> Whitehat security research workgroup

MalwareMustDie, NPO is a whitehat security research workgroup that was launched in August 2012. MalwareMustDie is a registered nonprofit organization as a medium for IT professionals and security researchers gathered to form a work flow to reduce malware infection in the internet. The group is known for their malware analysis blog. They have a list of Linux malware research and botnet analysis that they have completed. The team communicates information about malware in general and advocates for better detection for Linux malware.

<span class="mw-page-title-main">XZ Utils backdoor</span> Malicious software backdoor on Linux

On 29 March 2024, software developer Andres Freund reported that he had found a maliciously introduced backdoor in the Linux utility xz within the liblzma library in versions 5.6.0 and 5.6.1 released by an account using the name "Jia Tan" in February 2024.

References

  1. Edge, Jake. "Distribution security response times". LWN. LWN. Retrieved 30 July 2024.
  2. B1tCh3z, Ac1d. "Linux Kernel 2.6.27 < 2.6.36 (RedHat x86-64) - 'compat' Local Privilege Escalation". Exploit-DB. Retrieved 30 July 2024.{{cite web}}: CS1 maint: numeric names: authors list (link)
  3. "The art of exploitation: Autopsy of cvsxpl". Phrack. Phrack. Retrieved 30 July 2024.
  4. B1tCh3z, Ac1d. "CVS (Linux/FreeBSD) - Remote Entry Line Heap Overflow". Exploit-DB. Retrieved 30 July 2024.{{cite web}}: CS1 maint: numeric names: authors list (link)
  5. 1 2 Edge, jake. "A backdoor in UnrealIRCd". LWN. LWN. Retrieved 30 July 2024.
  6. "Official ProFTPD source code "backdoored" via a zero day flaw". Secplicity. Retrieved 30 July 2024.