View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0001096Kali LinuxKali Package Bugpublic2014-03-18 18:362025-07-14 09:36
Reportertottikm Assigned Todookie  
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionno change required 
Platformx64OSKaliOS Version1.0
Product Version1.0.6 
Summary0001096: openssh package infected with backdoor
Description

Hi Guys,

I was reading this news on the internet, http://thehackernews.com/2014/03/operation-windigo-linux-malware.html, this a backdoor using the openssh package. I made the verification suggested in the article and in the report http://www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.pdf, and I was infected. To be sure that I wasn't infected through other vectors I made a fresh install and the results are the same, please check and confirm. I will disable ssh services for now until have an answer.

Steps To Reproduce

Execute this little command in terminal,
ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected"

Activities

kamtec1

kamtec1

2014-03-18 20:46

reporter   ~0001628

major thing ...

Need to be FIXED ...
dookie

dookie

2014-03-18 21:28

reporter   ~0001629

Sorry to hear you're infected but it's not from Kali:

root@kali:~# uname -a
Linux kali 3.12-kali1-686-pae 0000001 SMP Debian 3.12.6-2kali1 (2014-01-06) i686 GNU/Linux
root@kali:~# ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected"
System clean

root@kali:~# uname -a
Linux kali 3.12-kali1-amd64 0000001 SMP Debian 3.12.6-2kali1 (2014-01-06) x86_64 GNU/Linux
root@kali:~# ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected"
System clean

Make sure you only download Kali Linux from us and always check the SHA sums provided.

Issue History

Date Modified Username Field Change
2014-03-18 18:36 tottikm New Issue
2014-03-18 20:46 kamtec1 Note Added: 0001628
2014-03-18 21:28 dookie Note Added: 0001629
2014-03-18 21:28 dookie Status new => closed
2014-03-18 21:28 dookie Assigned To => dookie
2014-03-18 21:28 dookie Resolution open => no change required
2025-07-14 09:36 g0tmi1k Priority high => normal