HiddenWasp Malware Stings Targeted Linux Systems
1–10 of 42 posts
Re: HiddenWasp Malware Stings Targeted Linux Systems
#2Well that is scary. What anti virus / security tools do others on here run. On Linux I run nothing. I'm concerned that this might not be okay any more.
Re: HiddenWasp Malware Stings Targeted Linux Systems
#3Well that is scary. What anti virus / security tools do others on here run. On Linux I run nothing. I'm concerned that this might not be okay any more.
> The malware is still active and has a zero-detection rate in all major anti-virus systems.
Anti virus wouldn't really help in this case. I should also point out that it appears that HiddenWasp is targeting systems that are already compromised in some form.
The "achilles heel" of these sorts of CnC attacks tends to be, and is apparently so in this case, that they do need to phone home.
In this case, the IP addresses are known, and blackholing them with your firewall (try something like ufw [1], if you don't have one), or your hosts file, is enough. Using something like pi-hole you can also deploy these protections for every device on your network.
There are quite a few hosts lists maintained out in the wild [0], and tools like fail2ban to protect against brute-force attacks.
But, as usual, by far and away the safest way to protect your system is to not run untrusted code. You probably have a package manager, going outside it tends to be less safe.
[0] For example: https://github.com/mitchellkrogza/Ultimate.Hosts.Blacklist
[1] https://wiki.archlinux.org/index.php/Uncomplicated_Firewall#...
Re: HiddenWasp Malware Stings Targeted Linux Systems
#4Confused by:
VER=`echo $(uname -a)`
Versus just:
VER=$(uname -a)
or
VER=`uname -a`
Re: HiddenWasp Malware Stings Targeted Linux Systems
#5Confused by: VER=`echo $(uname -a)` Versus just: VER=$(uname -a) or VER=`uname -a`
People writing rootkits are not necessarily experts in shell scripting :)
Re: HiddenWasp Malware Stings Targeted Linux Systems
#6Well that is scary. What anti virus / security tools do others on here run. On Linux I run nothing. I'm concerned that this might not be okay any more.
> The malware is still active and has a zero-detection rate in all major anti-virus systems. Anti virus wouldn't really help in this case. I should also point out that it appears that HiddenWasp is targeting systems that are already compromised in some form. The "achilles heel" of these sorts of CnC attacks tends to be, and is apparently so in this case, that they do need to phone home. In this case, the IP addresses…
Even using the official repos doesn’t guarantee you to be safe. The project developer might have had their development machine hacked and/or their source repository hacked and malicious code inserted. So when Arch / Ubuntu / etc package maintainers pull the latest source, unless they’re doing very thorough diffs of each source file, they could easily miss the injected malicious code and subsequently repackage that for the distro. What has actually happened before.
Also if your Linux / UNIX machine has an addressable WAN IP then you have all the usual risks of involved with hosting services on the public internet. A few years ago there was a spate of compromised web servers with the malware running as Apache modules.
So there aren’t really any guarantees when running Linux.
Re: HiddenWasp Malware Stings Targeted Linux Systems
#7Why would you bother with four constant XORs in a row with no intervening operations.
Re: HiddenWasp Malware Stings Targeted Linux Systems
#8Confused by: VER=`echo $(uname -a)` Versus just: VER=$(uname -a) or VER=`uname -a`
1. They're mixing a Bourne-ism (backquotes) with a Bash-ism (dollar-parens). I don't know why.
2. This could be an attempt to normalize and reduce whitespace, including eliminating newlines (though you should prevent injection of arguments to `echo`):
bash$ Temp=$(echo " a b c ")
bash$ echo "[${Temp}]"
[ a b c ]
bash$ Temp=`echo $(echo " a b c ")`
bash$ echo "[${Temp}]"
[a b c]
bash$ Temp=$(echo $(echo " a b c "))
bash$ echo "[${Temp}]"
[a b c]Re: HiddenWasp Malware Stings Targeted Linux Systems
#9Can anyone summarize what the attack vector is? Fake repositories? Bad maintainers? Fake tutorials?
Re: HiddenWasp Malware Stings Targeted Linux Systems
#10The article says to examine 'ld.so' files, but I don't remember the interpreter being named 'ld.so' in remotely recent history.
Perhaps it's a Debianism, but it's been '/lib/ld-linux.so.$ver' for ages:
$ readelf -p .rodata /lib/ld-linux.so.2 | grep '/etc/ld\.so\.preload'
[ 2d9c] /etc/ld.so.preload