Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
TROJAN:EBURY-DNS-EXFILTRATION |
|---|---|
Severity |
Critical |
Recommended |
No |
Recommended Action |
Drop |
Category |
TROJAN |
Keywords |
Ebury Trojaned SSH Daemon DNS Data Exfiltration |
Release Date |
2011/11/18 |
Update Number |
2033 |
Supported Platforms |
di-5.3+, idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
TROJAN: Ebury Trojaned SSH Daemon DNS Data Exfiltration
This signature detects DNS packets used as a data exfiltration technique for the Trojan named "Ebury" discovered by security researcher Steinar Gunderson. An infected machine has its SSH daemon replaced with a malicious binary that collects usernames and passwords used to log in to the infected host, then sends those credentials to a listening post as DNS packets. The trojan also allows unlogged and unauthenticated remote login to the infected host. The source IP of this event in your logs may be a compromised SSH server that should be investigated.
References