The UnrealIRCd 3.2.8.1 Tarball Backdoor

What happened

Attackers broke into the official UnrealIRCd site and FTP mirrors and swapped the 3.2.8.1 tarball for a trojaned one. The project announcement, posted by Syzops on 12 June 2010, says the compromise started around November 2009. Rapid7 and LWN date the swap to about 10 November 2009, so the backdoor stayed in place for about seven months.

The backdoor was a disguised debug macro in include/struct.h. LWN explains that a command that starts with the letters AB went straight to system(). Commands ran with the rights of the user that ran the server. Access restrictions on the IRC server did not stop it. The project says that the code is in the core, so removing a module does not help. LWN reports that the code entered the Gentoo distribution.

A clean 3.2.8.1 tarball with a published MD5 sum existed. The bad tarball gained a macro that pipes attacker text into a shell call. A diff of include/struct.h between the two shows it at once.

Read the project announcement, LWN and the Rapid7 module page.

Affected versions

• Affected: Unreal3.2.8.1.tar.gz downloaded after 10 November 2009.
• Not affected: the Windows builds, CVS, and version 3.2.8 and earlier.

Indicators of compromise

• MD5 of the backdoored tarball: 752e46f2d873c1679fa99de3f52a274d
• MD5 of the official tarball: 7b741e94e867c0a7370553fd01506c66
• The string DEBUG3_DOLOG_SYSTEM in include/struct.h. A trojaned copy returns two lines. A clean copy returns none.
• Official Windows installers, for comparison: Unreal3.2.8.1.exe 5a6941385cd04f19d9f4241e5c912d18 and Unreal3.2.8.1-SSL.exe a54eafa6861b6219f4f28451450cdbd3

How to check

Hash the tarball and search the header file. The project gave both checks in its announcement.

md5sum Unreal3.2.8.1.tar.gz

grep DEBUG3_DOLOG_SYSTEM include/struct.h

Run the second command in the source folder. Two lines of output mean the source is trojaned. A hash of 752e46f2... also means the bad tarball.

What to do now

1. Stop any UnrealIRCd server built from a 3.2.8.1 tarball downloaded after 10 November 2009.
2. Download the source again from the official site and check the MD5 sum against 7b741e94e867c0a7370553fd01506c66.
3. Recompile and restart. Removing a module is not enough.
4. Treat the host as compromised, because attackers could run any command. Check it for changes and rotate credentials stored on it.
5. Verify signatures. The project started to sign releases with GPG after this incident.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 85

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    configure
           It now runs other programs. It did not before.

Sources

1. seclists.org/fulldisclosure/2010/Jun/277
2. lwn.net/Articles/392201/
3. rapid7.com/db/modules/exploit/unix/irc/unreal_ircd_3281_backdoor/