Littlefish Support
Littlefish Support+
Managed NOC
Non-Contract Services
Our Culture
Testimonials
Carbon Friendly
Jobs
US-CERT has alerted Linux users of a foray against linux-based computing infrastructures using compromised SSH keys. The breach uses stolen SSH keys to obtain access to a system, and then uses local kernel exploits to gain root access. Once root access has been acquired, a rootkit known as "phalanx2" is installed. Phalanx2 is a derivative of an older rootkit "phalanx". It is configured to methodically steal SSH keys from the compromised system. The SSH keys are then sent to the attackers, who use them to attack other sites and systems.
US-CERT recommends using keys with passphrases and reviewing server logs to identify unknown accessed from remote machines to avoid such attack. Should you find your system already compromised, immediately contact your IT support for further assistance.
