Plan ahead High Awareness
Attackers use GSocket to keep access after patching
Microsoft Security blogMicrosoft
What happened. Microsoft saw attackers install GSocket, an open source remote-access tool, on compromised Linux servers. Access continued after the original web application flaws were fixed. GSocket relays traffic through a shared public network, so there is no attacker address to block.
Who is affected. Organisations running Linux servers, mainly web applications and hosting environments. The source names no industrial sector.
What to do. Investigate affected Linux hosts for GSocket deployment, persistence, privilege escalation and outbound connections. Do not treat patching the web application as complete clean-up.
When to act. Plan ahead: review your exposure to the same entry point
Editor's reading
Fordetection engineerIT security
- Purdue level
- L4
- L3.5
Why: The activity targets web-facing Linux servers and hosting environments, which are usually enterprise IT (L4) or industrial DMZ (L3.5) systems.
- Are you exposed?
Check web-facing Linux servers that were ever exploited or patched after compromise for GSocket files, persistence entries and unexpected outbound connections.
- If you cannot fix it yet
- Restrict outbound internet connections from Linux servers to approved destinations only.
- Rebuild or thoroughly investigate any Linux web server that was exploited, even after the original flaw is patched.
- Watch for
- Outbound connections from Linux servers to GSocket's shared public relay network, since there is no fixed address to block.
- Signs of GSocket installation and persistence on web-facing Linux hosts after a web application compromise.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Microsoft Security blog (opens microsoft.com)
More on Microsoft