Ac1db1tch3z

Last updated
Ac1db1tch3z
AbbreviationAB
FormationEarly 2000s
Purpose Hacking

Ac1db1tch3z (also known as AB for short) were a hacking group most well known for their 0day exploits in Linux, [1] [2] CVS [3] [4] and supply chain attacks on UnrealIRCd [5] and ProFTPD. [6]

UnrealIRCd

In November 2009 the source code copies for version 3.2.8.1 of UnrealIRCd were replaced with a version containing a backdoor. [5] This backdoor allowed an attacker to run any command on a server running the backdoored version of the software. The backdoor was discovered in June 2010.

Related Research Articles

<span class="mw-page-title-main">IRC</span> Protocol for real-time Internet chat and messaging

IRC is a text-based chat system for instant messaging. IRC is designed for group communication in discussion forums, called channels, but also allows one-on-one communication via private messages as well as chat and data transfer, including file sharing.

<span class="mw-page-title-main">Timeline of computer viruses and worms</span> Computer malware timeline

This timeline of computer viruses and worms presents a chronological timeline of noteworthy computer viruses, computer worms, Trojan horses, similar malware, related research and events.

CAcert.org is a community-driven certificate authority that issues free X.509 public key certificates. CAcert.org relies heavily on automation and therefore issues only Domain-validated certificates.

A backdoor is a typically covert method of bypassing normal authentication or encryption in a computer, product, embedded device, or its embodiment. Backdoors are most often used for securing remote access to a computer, or obtaining access to plaintext in cryptosystems. From there it may be used to gain access to privileged information like passwords, corrupt or delete data on hard drives, or transfer information within autoschediastic networks.

Linux malware includes viruses, Trojans, worms and other types of malware that affect the Linux family of operating systems. Linux, Unix and other Unix-like computer operating systems are generally regarded as very well-protected against, but not immune to, computer viruses.

<span class="mw-page-title-main">Webmin</span> Web-based control panel for Unix-like systems

Webmin is a web-based server management control panel for Unix-like systems. Webmin allows the user to configure operating system internals, such as users, disk quotas, services and configuration files, as well as modify and control open-source apps, such as BIND, Apache HTTP Server, PHP, and MySQL.

<span class="mw-page-title-main">LWN.net</span> Computing webzine with an emphasis on Unix-like operating systems

LWN.net is a computing webzine with an emphasis on free software and software for Linux and other Unix-like operating systems. It consists of a weekly issue, separate stories which are published most days, and threaded discussion attached to every story. Most news published daily are short summaries of articles published elsewhere, and are free to all viewers. Original articles are usually published weekly on Thursdays and are available only to subscribers for two weeks, after which they become free as well. LWN.net is part of Eklektix, Inc.

vsftpd is an FTP server for Unix-like systems, including Linux. It is the default FTP server in the Ubuntu, CentOS, Fedora, NimbleX, Slackware and RHEL Linux distributions. It is licensed under the GNU General Public License. It supports IPv6, TLS and FTPS.

<span class="mw-page-title-main">OpenBSD</span> Operating system

OpenBSD is a security-focused, free software, Unix-like operating system based on the Berkeley Software Distribution (BSD). Theo de Raadt created OpenBSD in 1995 by forking NetBSD 1.0. The OpenBSD project emphasizes portability, standardization, correctness, proactive security, and integrated cryptography.

Freenode, stylized as freenode and formerly known as Open Projects Network, is an IRC network which was previously used to discuss peer-directed projects. Their servers are accessible from the hostname chat.freenode.net, which load balances connections by using round-robin DNS.

A supply chain attack is a cyber-attack that seeks to damage an organization by targeting less secure elements in the supply chain. A supply chain attack can occur in any industry, from the financial sector, oil industry, to a government sector. A supply chain attack can happen in software or hardware. Cybercriminals typically tamper with the manufacturing or distribution of a product by installing malware or hardware-based spying components. Symantec's 2019 Internet Security Threat Report states that supply chain attacks increased by 78 percent in 2018.

<span class="mw-page-title-main">Linux kernel</span> Free Unix-like operating system kernel

The Linux kernel is a free and open source, UNIX-like kernel that is used in many computer systems worldwide. The kernel was created by Linus Torvalds in 1991 and was soon adopted as the kernel for the GNU operating system (OS) which was created to be a free replacement for Unix. Since the late 1990s, it has been included in many operating system distributions, many of which are called Linux. One such Linux kernel operating system is Android which is used in many mobile and embedded devices.

Dprobes is a Linux kernel analysis framework built off of Kprobes, which features the ability to insert breakpoints and software probes dynamically into running code. It is licensed under the GNU GPLv2 licence.

i-MSCP is a free and open-source software for shared hosting environments management on Linux servers. It comes with a large choice of modules for various services such as Apache2, ProFTPd, Dovecot, Courier, Bind9, and can be easily extended through plugins, or listener files using its events-based API.

UnrealIRCd is an open-source IRC daemon, originally based on DreamForge, and is available for Unix-like operating systems and Windows. Since the beginning of development on UnrealIRCd c. May 1999, many new features have been added and modified, including advanced security features and bug fixes, and it has become a popular server.

perf is a performance analyzing tool in Linux, available from Linux kernel version 2.6.31 in 2009. Userspace controlling utility, named perf, is accessed from the command line and provides a number of subcommands; it is capable of statistical profiling of the entire system.

<span class="mw-page-title-main">Intel Management Engine</span> Autonomous computer subsystem

The Intel Management Engine (ME), also known as the Intel Manageability Engine, is an autonomous subsystem that has been incorporated in virtually all of Intel's processor chipsets since 2008. It is located in the Platform Controller Hub of modern Intel motherboards.

OverlayFS is a union mount filesystem implementation for Linux. It combines multiple different underlying mount points into one, resulting in single directory structure that contains underlying files and sub-directories from all sources. Common applications overlay a read/write partition over a read-only partition, such as with LiveCDs and IoT devices with limited flash memory write cycles.

<span class="mw-page-title-main">MalwareMustDie</span> Whitehat security research workgroup

MalwareMustDie, NPO is a whitehat security research workgroup that was launched in August 2012. MalwareMustDie is a registered nonprofit organization as a medium for IT professionals and security researchers gathered to form a work flow to reduce malware infection in the internet. The group is known for their malware analysis blog. They have a list of Linux malware research and botnet analysis that they have completed. The team communicates information about malware in general and advocates for better detection for Linux malware.

<span class="mw-page-title-main">XZ Utils backdoor</span> Malicious software backdoor on Linux

In February 2024, a malicious backdoor was introduced to the Linux build of the xz utility within the liblzma library in versions 5.6.0 and 5.6.1 by an account using the name "Jia Tan". The backdoor gives an attacker who possesses a specific Ed448 private key remote code execution capabilities on the affected Linux system. The issue has been given the Common Vulnerabilities and Exposures number CVE-2024-3094 and has been assigned a CVSS score of 10.0, the highest possible score.

References

  1. Edge, Jake. "Distribution security response times". LWN. Retrieved 30 July 2024.
  2. B1tCh3z, Ac1d (16 September 2010). "Linux Kernel 2.6.27 < 2.6.36 (RedHat x86-64) - 'compat' Local Privilege Escalation". Exploit-DB. Retrieved 30 July 2024.{{cite web}}: CS1 maint: numeric names: authors list (link)
  3. "The art of exploitation: Autopsy of cvsxpl". Phrack. Retrieved 30 July 2024.
  4. B1tCh3z, Ac1d (25 June 2004). "CVS (Linux/FreeBSD) - Remote Entry Line Heap Overflow". Exploit-DB. Retrieved 30 July 2024.{{cite web}}: CS1 maint: numeric names: authors list (link)
  5. 1 2 Edge, jake. "A backdoor in UnrealIRCd". LWN. Retrieved 30 July 2024.
  6. "Official ProFTPD source code "backdoored" via a zero day flaw". Secplicity. 7 December 2010. Retrieved 30 July 2024.