A free hosting control panel, Control Web Panel, has a hidden backdoor that runs attacker commands and leaves no trace in access logs, XLab researchers say.
A backdoor has been found hiding inside the web server that runs Control Web Panel (CWP), a free tool for managing Linux hosting servers. Researchers at QiAnXin's XLab say it lets attackers run commands through web requests, and those requests never appear in the server's access logs. Anyone whose website sits on such a server could be affected without knowing it.
The researchers named the backdoor cwpdoor. They captured its installer, a script posing as a version update, on June 29. The backdoor is the panel's own web server program, called cwpsrv, rebuilt with extra code. It behaves normally until a request arrives with a valid timestamp and signature in special headers. Then it runs the command the request carries.
It is built to avoid notice. The installer sets the file's dates back to their original values, so common checks show it as unchanged. The backdoor file had zero detections out of 63 on VirusTotal, a site that scans files with many security tools.
Installing the backdoor takes root access, meaning full control of the server, so attackers must already be in. How they get that access is not yet known. The installer handles only two versions of cwpsrv, 1.15.10 and 1.24.0.
Real victims likely exist. On September 30, an archive holding a copy of the backdoor was uploaded to VirusTotal from Brazil. The researchers give no count of infected servers. If your site runs on a server with this panel, the steps in the alert box above are the place to start.
That same archive also held Ebury, an OpenSSH backdoor and credential stealer active since at least 2009. The researchers do not know whether the two are related. Different attackers may have planted them on the same server.
If your website runs on a server with Control Web Panel, ask your host or IT person to check it, because the backdoor hides from logs and file dates.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
