The CWPdoor attack swapped one binary and cleaned up after itself. Here’s how I’d check my own servers for that kind of thing.
1. Verify packaged files against the package database
- Omarchy/Arch:
sudo pacman -Qkk 2>&1 | grep -v ', 0 altered files' - Fedora/RHEL/Alma:
sudo rpm -Va. Config files changing is normal. A5(digest) flag on something in /usr/bin or /usr/sbin isn’t - Debian/Ubuntu:
sudo dpkg --verify
Run it through Ansible with the shell module so you get every host at once.
2. Hash what packages don’t cover
Panels and vendor tools often live in /usr/local or /opt, outside any package. Keep a known-good hash and let Ansible compare:
- ansible.builtin.stat:
path: /opt/vendor/bin/server
checksum_algorithm: sha256
register: bin
- ansible.builtin.assert:
that: bin.stat.checksum == known_good_sha256Record the hash when you install or upgrade, and keep it off the server.
3. Check what’s actually running
sudo ls -l /proc/*/exe 2>/dev/null | grep deleted shows processes running from a deleted or replaced file. ss -xlp lists Unix sockets, so you can spot one you don’t recognize.
4. Don’t trust timestamps
CWPdoor reset file times. Hashes don’t lie, mtimes do.
Review before you install: read the release notes yourself, back up your config, and try new versions somewhere you can afford to break first.
God Bless, and Use the Source!
