Stealth Attack Targets Apache Web Server

The attack uses Apache's built-in filter capabilities to include links to malicious websites.

By Kara Reeder | Posted May 5, 2011
Page of   |  Back to Page 1
Print ArticleEmail Article
  • Share on Facebook
  • Share on Twitter
  • Share on LinkedIn
Symantec has discovered a new attack that targets the popular Apache Web Server, reports InformationWeek. The attack is unique in that the Web server itself is the infection target, says Cathal Mullaney, a security response engineer at Symantec.

The attack uses Apache's built-in filter capabilities to include links to malicious websites. Mullaney explains:

All of the actions performed by the rogue module are done using legitimate code provided by the Apache API ... This is not an exploit or a hack of Apache's code base; the module uses Apache's inherent functionality to infect users and attempts to redirect them to a malicious Web page.

However, the module doesn't infect every Web page it serves, which would draw the attention of system administrators. Mullaney calls this "a complex and potentially difficult threat to detect accurately" because the module contains a number of evasion techniques. On the bright side, for an attacker to install this module, they would need administrator-level access.

Comment and Contribute
(Maximum characters: 1200). You have
characters left.
Get the Latest Scoop with Enterprise Networking Planet Newsletter