|
|
|
|
º¸¾È´º½º
|
|
|
|
|
±Û¾´ÀÌ |
Á¤±¤Ãµ |
Á¶È¸¼ö |
4095 |
|
À̸ÞÀÏ |
|
ÀÛ¼ºÀÏ |
2009-10-12 12:11:02 |
|
Á¦¸ñ |
ȨÆäÀÌÁö º¯Á¶ |
|
¾È³çÇϼ¼¿ä. (ÁÖ)½º¸¶Àϼºê °í°´±â¼úÁö¿øÆÀ ÀÔ´Ï´Ù.
ÃÖ±Ùµé¾î iframeÀ» ÀÌ¿ë, ¾Ç¼ºÄÚµå »ðÀÔ¿¡ ÀÇÇÑ È¨ÆäÀÌÁö º¯Á¶»ç°í°¡ ºó¹øÈ÷ ¹ß»ýÇÏ°í ÀÖ½À´Ï´Ù.
ÀÌ´Â °¨¿°µÈ ¹ÙÀÌ·¯½º¿¡ ÀÇÇØ Å¬¶óÀ̾ðÆ® PC ¿¡ ÀúÀåµÇ¾î ÀÖ´ø FTP Á¤º¸°¡ ¿ÜºÎ·Î À¯ÃâµÇ¾î ¹ß»ýÇÏ´Â °ÍÀ¸·Î, ÀÌ¿¡ µû¸¥ ÇÇÇØ°¡ ¹ß»ýÇÏ°í ÀÖÀ¸´Ï ´ëºñÇϽñ⠹ٶø´Ï´Ù.
°Ëºí·¯(Gumblar) ¶Ç´Â GENO ¶ó°í ºÒ¸®´Â ¾Ç¼ºÄÚµå´Â ¾îµµºê(Adobe)»çÀÇ Acrobat À̳ª Flash PlayerÀÇ º¸¾ÈÆÐÄ¡°¡ µÇÁö ¾ÊÀº PC°¡ ƯÁ¤ Web Site ¸¦ ¹æ¹®ÇÏ¿© °¨¿°µÇ´Â 'Drive by Download' ¹æ½ÄÀ¸·Î ÀüÆĵǰíÀÖ¾î ±× °¨¿°¼Óµµ°¡ ¸Å¿ì ºü¸¨´Ï´Ù.
¶ÇÇÑ °¨¿°µÈ PC ÀÌ¿ëÀÚ°¡ Web Site ÀÇ ÆÄÀÏÀ» °ü¸®ÇÏ´Â FTP Ŭ¶óÀ̾ðÆ® ÇÁ·Î±×·¥À» °¡Áö°í ÀÖÀ» °æ¿ì ID ¿Í Password ¸¦ »©³»¾î ÇØ´ç Web Site ÀÇ index, main µîÀÇ À̸§À» °¡Áø html, php ÆÄÀϵéÀ» º¯Á¶Çؼ ¾Ç¼ºÄڵ带 ´Ù¿î¹Þµµ·Ï Äڵ带 ½É¾î³õ°Ô µË´Ï´Ù.
¡ã Áõ»ó
1) index, main µî html, php ·Î Â¥¿©Áø ÆäÀÌÁö¿¡ iframe ÄÚµå »ðÀÔ µË´Ï´Ù.
----------------------------------------------------------------------------------------- [iframe ÄÚµå »ðÀÔ ¿¹] ----------------------------------------------------------------------------------------- À§¿Í °°ÀÌ ¿©·¯ ÆÄÀÏ¿¡ °ÉÃÄ iframe Äڵ尡 »ðÀԵǾî ÀÖ´Â »çÇ×À» °Ë»öÇÑ ³»¿ë (ÆÐÅÏ : iframe src = "http://xxxxxxxx.ru:8080/index.php" width="xxx" height="xxx" ~~ /iframe ) ru ´Â ·¯½Ã¾ÆÀ̸ç, ÁÖ¼ÒÁö°¡ cn (Áß±¹)À¸·Î µÇ¾î ÀÖ´Â °æ¿ìµµ ÀÖ½À´Ï´Ù.
2) °¨¿°µÈ ÆäÀÌÁö Á¢±Ù½Ã »ó´çºÎºÐ ¿©¹é Ç¥½ÃµË´Ï´Ù.
3) /var/log/xferlog ¿¡ ´ÙÀ½°ú °°Àº ÆÐÅÏÀÇ log Á¤º¸°¡ ±×·ÁÁý´Ï´Ù. ----------------------------------------------------------------------------------------- Thu Sep 17 10:45:20 2009 3 89.191.xxx.56 61116 /home/xxxxxxxx/bbs/index.php a _ o r xxxxxxxx ftp 0 * c Thu Sep 17 10:45:30 2009 3 213.114.xxx.27 61146 /home/xxxxxxxx/bbs/index.php a _ i r xxxxxxxx ftp 0 * c Thu Sep 17 22:28:20 2009 1 95.26.xxx.85 1175 /home/xxxxxxxx/index.html a _ o r xxxxxxxx ftp 0 * c Thu Sep 17 22:28:27 2009 2 83.165.xxx.24 1210 /home/xxxxxxxx/index.html a _ i r xxxxxxxx ftp 0 * c Thu Sep 17 22:28:36 2009 1 200.8.xxx.59 164 /home/xxxxxxxx/bbs/index.html a _ o r xxxxxxxx ftp 0 * c Thu Sep 17 22:28:45 2009 1 87.250.xxx.4 199 /home/xxxxxxxx/bbs/index.html a _ i r xxxxxxxx ftp 0 * c Thu Sep 17 22:28:54 2009 2 85.226.xxx.15 61146 /home/xxxxxxxx/bbs/index.php a _ o r xxxxxxxx ftp 0 * c Thu Sep 17 22:29:00 2009 2 63.232.xxx.166 61177 /home/xxxxxxxx/bbs/index.php a _ i r xxxxxxxx ftp 0 * c -----------------------------------------------------------------------------------------
4) ½ÇÁ¦ À§ ·Î±×¸¦ ±Ù°Å·Î ÇØ´ç °èÁ¤À» Á¡°ËÇغ¸¸é iframe ¾Ç¼ºÄڵ带 »ðÀÔ½ÃÄÑ ³õ¾Æ ÆÄÀÏÀ» º¯Á¶½Ãŵ´Ï´Ù. 'o' ´Â ´Ù¿î·Îµå, 'i ´Â ¾÷·Îµå½Ã, Á¢±ÙÁö ¾ÆÀÌÇÇ´Â º¯Á¶µÈ ¾ÆÀÌÇÇ·Î Á¢±Ù½Ã¸¶´Ù ´Þ¶óÁý´Ï´Ù.
¡ã ´ëÀÀÃ¥
1) ¹é½Å ÇÁ·Î±×·¥À» ÀÌ¿ë PC ¿¡ °¨¿°µÈ ÆÄÀÏÀÌ ¾ø´ÂÁö °Ë»çÇÕ´Ï´Ù.
2) xferlog µî FTP log ¸¦ ±Ù°Å·Î °¨¿°µÈ ÆÄÀÏ¸í ¸ðµÎ üũÇÏ¿© ¾Ç¼ºÄڵ带 Á¦°ÅÇÕ´Ï´Ù. ¾Ç¼ºÄڵ尡 Á¦°ÅµÇÁö ¾ÊÀº »óÅ¿¡¼ ´Ü¼øÈ÷ ºñ¹Ð¹øÈ£¸¦ ¹Ù²Ù¾î FTP Á¢¼ÓÀ» ÇÏ°Ô µÇ¸é Áö¼ÓÀûÀ¸·Î ID, Password°¡ À¯ÃâµÇ¾î¼ »çÀÌÆ® º¯Á¶°¡ Áö¼ÓµË´Ï´Ù.
3) GENO ¹ÙÀÌ·¯½º¿¡ °¨¿°ÀÌ µÈ °æ¿ì (Gumblar, Daenol, Gadjo, Kates µî)
Adobe »çÀÌÆ®¿¡ ¹æ¹®ÇÏ¿© Flash Player ¸¦ 10.0.22.87 ¹öÀü ÀÌ»óÀ¸·Î ¾÷µ¥ÀÌÆ® ÇÕ´Ï´Ù. ¢Ñhttp://get.adobe.com/kr/flashplayer/?promoid=DRHWS
Acrobat Reader ¸¦ 9.1.1 ¹öÀü ÀÌ»óÀ¸·Î ¾÷µ¥ÀÌÆ® ÇÕ´Ï´Ù. ¢Ñhttp://get.adobe.com/kr/reader
4) ¹é½Å ÇÁ·Î±×·¥À» ÅëÇØ ½Ç½Ã°£À¸·Î °¨¿° ¿©ºÎ¸¦ üũÇÕ´Ï´Ù.
5) ƯÈ÷, ¿©·¯ °èÁ¤À¸·Î Á¢±ÙÇÏ´Â À¥ ¿¡ÀÌÀü½Ã ¾÷ü¿¡¼´Â °èÁ¤ ID, Password °ü¸®¿¡ °¢º°È÷ ÁÖÀǸ¦ ±â¿ïÀÔ´Ï´Ù.
¡ã Á¦³ë(Geno) ¹ÙÀÌ·¯½º
http://www.dt.co.kr/contents.html?article_no=2009062402012269739001
¡ã °ü·Ãº¸µµ/¸®Æ÷Æ® ¸µÅ©
http://www.boannews.com/media/view.asp?idx=16569&kind=1
http://www.idg.co.kr/newscenter/common/newCommonView.do?newsId=55938
http://www.fnnews.com/view?ra=Sent0901m_View&corp=fnnews&arcid=090522164152&cDateYear=2009&cDateMonth=05&cDateDay=22
http://garwarner.blogspot.com/2009/06/gumblars-48000-compromised-domains.html
==================================================================== ¼¹ö¸¦ ¾ÈÀüÇÏ°Ô º¸È£ÇÏ´Â ÀÏÀº Áö¼ÓÀûÀÎ °ü½É°ú °ü¸®ÀÔ´Ï´Ù. ====================================================================
|
IP Address : 58.87.61.95 |
|
|
|
|
|
|
|
|