[CentOS] duqu

[Lamar Owen]

On Tuesday, December 06, 2011 04:45:04 PM Johnny Hughes wrote:
> If I had to guess, I would say that the attackers probably developed
> their code on CentOS, so they were looking for a CentOS machine to
> deploy their code on in the wild.  That would be why I would say CentOS
> was the OS used.

I read the Kaspersky article and the comments, and the use of 'up2date' in the transcript could possibly point to someone used to upstream EL.  But it does illustrate three major points:

1.) Keep up to date as much as possible (and a 24 hour window is quite short, honestly, compared to the timeframes this attack appears to have occupied);
2.) Keep up with your servers and have tripwires for modifications;
3.) Keep good passwords.  This can't be stressed enough: if your password was successfully brute-forced it is now in the brute-forcer's *dictionary* of passwords to try in the future and should never be used again, regardless of how secure it might seem.  I happen to have a copy of an older brute-forcer dictionary here (somewhere) and it's very large and has lots of very secure-seeming passwords in it.

Of course, this points to a fourth (and fifth) item: don't run services you don't need, and have multiple layers of security.