SambaCry is back Hackers can Access to Thousands of Linux PCs Remotely



Nordnet Baritof
Nordnet Baritof
  • Technical Writer
  • Entrepreneur
  • Founder and CEO
  • Developer
  • Blogger and IT Analyst
2017-07-21 21:40:44

| Share
| Share
| Share
SambaCry is back Hackers can Access to Thousands of Linux PCs Remotely

in these days hackers can be hacked from he's linux

A 7-year-old critical remote code execution vulnerability has been discovered in Samba networking software that could allow a remote attacker to take control of an affected Linux and Unix machines.

Samba is an open-source software (re-implementation of SMB networking protocol) that runs on the majority of operating systems available today, including Windows, Linux, UNIX, IBM System 390, and OpenVMS.

Samba allows non-Windows operating systems, like GNU/Linux or Mac OS X, to share network shared folders, files, and printers with Windows operating system.
 

The newly discovered remote code execution vulnerability (CVE-2017-7494) affects all versions newer than Samba 3.5.0 that was released on March 1, 2010.
"All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it," Samba wrote in an advisory published Wednesday.
 

Linux version of EternalBlue Exploit?

samba-remote-exploit-shodan
According to the Shodan computer search engine, more than 485,000 Samba-enabled computers exposed port 445 on the Internet, and according to researchers at Rapid7, more than 104,000 internet-exposed endpoints appeared to be running vulnerable versions of Samba, out of which 92,000 are running unsupported versions of Samba.

Since Samba is the SMB protocol implemented on Linux and UNIX systems, so some experts are saying it is "Linux version of EternalBlue," used by the WannaCry ransomware.

...or should I say SambaCry?

Keeping in mind the number of vulnerable systems and ease of exploiting this vulnerability, the Samba flaw could be exploited at large scale with wormable capabilities.
 

Home networks with network-attached storage (NAS) devices could also be vulnerable to this flaw.
 

Exploit Code Released! (Bonus: Metasploit Module)

metasploit-samba
The flaw actually resided in the way Samba handled shared libraries. A remote attacker could use this Samba arbitrary module loading vulnerability to upload a shared library to a writable share and then cause the server to load and execute malicious code.

The vulnerability is hell easy to exploit. Just one line of code is required to execute malicious code on the affected system.
simple.create_pipe("/path/to/target.so")
However, the Samba exploit has already been ported to Metasploit, a penetration testing framework, enabling researchers as well as hackers to exploit this flaw easily.
 

Patch and Mitigations


The maintainers of Samba has already patched the issue in their new versions Samba versions 4.6.4/4.5.10/4.4.14, and are urging those using a vulnerable version of Samba to install the patch as soon as possible.

But if you can not upgrade to the latest versions of Samba immediately, you can work around the vulnerability by adding the following line to your Samba configuration file smb.conf:
nt pipe support = no
Once added, restart the network's SMB daemon (smbd) and you are done. This change will prevent clients from fully accessing some network machines, as well as disable some expected functions for connected Windows systems.

While Linux distribution vendors, including Red Hat and Ubuntu, have already released patched versions for its users, the larger risk is that from NAS device consumers that might not be updated as quickly.

Craig Williams of Cisco said that given the fact that most NAS devices run Samba and have very valuable data, the vulnerability "has potential to be the first large-scale Linux ransomware worm."

Update: Samba maintainers have also provided patches for older and unsupported versions of Samba.

Meanwhile, Netgear released a security advisory for CVE-2017-7494, saying a large number of its routers and NAS product models are affected by the flaw because they use Samba version 3.5.0 or later.

However, the company currently released firmware fixes for only ReadyNAS products running OS 6.x.
click the next for more ...
Stephen Hawking Has A Message For Donald Trump
Stephen Hawking Has A Message For Donald Trump
Stephen Hawking Has A Message For Donald Trump

.
SCANDAL FaceBook FINED Cambridge for 500 000  £
SCANDAL FaceBook FINED Cambridge for 500 000 £

Facebook has finally been weaking up with its first fine of £500,000 for Cambridge Analytica to improperly gather and misapply data of 87 m


SCANDAL FaceBook FINED Cambridge for 500 000  £
Marvel Comics Giant Stan Lee Has Died At 95

Stan Lee, the colorful Marvel Comics patriarch who helped usher in a new era of superhero storytelling -- and saw his creations become a giant influen


SCANDAL FaceBook FINED Cambridge for 500 000  £
How Does Android s New In-app Updates API Work

Notice that the Android§apostrofe§s new In-app Updates API doesn§apostrofe§t force or lock out users from the app if they chose no


SCANDAL FaceBook FINED Cambridge for 500 000  £
Capitan has slept in the grave of his owner every night

For the past 6 years, a dog named Capitan has slept in the grave of his owner every night. His owner, Miguel Guzman died in 2006 and Capitan dissapear


SCANDAL FaceBook FINED Cambridge for 500 000  £
Kendall Jenner Has Been A Granted Permanent Restraining Order Against Her Alleged Stalker

Kendall Jenner§apostrofe§s supposed stalker was requested to avoid the supermodel for a long time on Friday subsequent to being gotten on her proper


SCANDAL FaceBook FINED Cambridge for 500 000  £
So Your Dog Has Canine Cancer Here s What to do Next

One in four dogs will be diagnosed with canine cancer in their lifetime, and cancer is the second leading cause of death in older animals. That’



© 2013-2018 best of geeks. All rights reserved.