Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HiddenWasp Malware Stings Targeted Linux Systems

intezer.com

Post reply on HN
Print view View original

31–40 of 42 posts

Re: HiddenWasp Malware Stings Targeted Linux Systems

#31

Post by _urga »

skrebbel wrote: post #30
_urga wrote: post #28

Earlier quoted context omitted.

Yes, but then again warning dialogs don't have much track record in preventing malware outbreaks. For example, recent versions of Word won't run VBA macros by default without the user clicking through a warning dialog, and yet people fall for it all the time. Malware authors don't mind either way.

I didn't say anything about that. I'm only refuting the claim that Windows email clients will run an executable just by clicking on them.

Well, then I would disagree with you there. There are plenty of ways to get Windows to run executable code just by clicking an attachment, and this even without warning dialogs:

- PDFs with JS code. It's not a joke, someone actually titled a paper on PDF exploits alone, "PDF, Let Me Count the Ways".

- Hostile RTFs (with or without OLEs) disguised as Word documents (which Office will gladly open).

- Hostile HTML disguised as Excel spreadsheets (likewise).

- New unknown variants of the old Windows metafile exploit (just by viewing, as xorcist suggested).

- Image "stegosploits" (likewise).

The list goes on...

Re: HiddenWasp Malware Stings Targeted Linux Systems

#32

Post by kryptiskt »

xorcist wrote: post #22
_urga wrote: post #13

I work on an email startup in private beta. While developing our antivirus system, I was surprised to find that most email providers do not block ZIP attachments containing SH shell script files, nor ZIP attachments containing extension-less files with the executable bit set, nor ZIP attachments containing symlink traversal paths, nor any attachments which start with the shebang "#!" shell script signature, nor any w…

Is it really that strange? Windows email clients tend to run code in attachments just by clicking them (or, in some cases, just viewing them). So the risk factor in letting these emails in is quite large. That's not as common with other platforms. Even the common GUI platforms on Linux would require the user to manually save the file and explicitly marking the file as executable. Nobody would conflate user friendline…

I wouldn't be so complacent, I'm reminded of this vulnerability: https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit...

Re: HiddenWasp Malware Stings Targeted Linux Systems

#33

Post by zaarn »

xupybd wrote: post #2

Well that is scary. What anti virus / security tools do others on here run. On Linux I run nothing. I'm concerned that this might not be okay any more.

The AntiVirus industry is a snakeoil industry. Their products barely work and if they do, they do while sucking a lot of performance out of your device. If you absolutely want one, install ClamAV. Then use uBlock Origin + HTTPS Everywhere on your browser and PiHole on the network. Install all updates on devices, devices with no updates are isolated into a separate network. Use a password manager and SSH keys, disable password auth on all SSH servers you connect to. Close all ports to the outside that are not necessary and could be accessed with a VPN instead (keep one SSH port open to repair said VPN). Do not download email attachments you did not prompt for. If you need to open email attachments (ie you're HR and you received a Resume), make sure it's a real file and not a fake (a .pdf.exe) or ask for a share link from a popular storage provider (Nextcloud, Google Drive, Dropbox, etc.).

The above notes should get you protected better than 99.9% of people on the internet.

Re: HiddenWasp Malware Stings Targeted Linux Systems

#34

Post by IronBacon »

xorcist wrote: post #22
_urga wrote: post #13

I work on an email startup in private beta. While developing our antivirus system, I was surprised to find that most email providers do not block ZIP attachments containing SH shell script files, nor ZIP attachments containing extension-less files with the executable bit set, nor ZIP attachments containing symlink traversal paths, nor any attachments which start with the shebang "#!" shell script signature, nor any w…

Is it really that strange? Windows email clients tend to run code in attachments just by clicking them (or, in some cases, just viewing them). So the risk factor in letting these emails in is quite large. That's not as common with other platforms. Even the common GUI platforms on Linux would require the user to manually save the file and explicitly marking the file as executable. Nobody would conflate user friendline…

> Even the common GUI platforms on Linux would require the user to manually save the file and explicitly marking the file as executable.

If someone can find a way to drop a text file in my "~/.config/autostart" dir, next time I log in my Gnome desktop will happily execute the command present in the "Exec" line and it doesn't require the execute bit.

I think something similar could be done using "~/.local/share/applications", overriding an installed application next time that application is launched, but it probably would show two icons; the autostart at the moment is more stealth.

Re: HiddenWasp Malware Stings Targeted Linux Systems

#35

Post by kevingadd »

littlestymaar wrote: post #25
skrebbel wrote: post #23

Earlier quoted context omitted.

> Windows email clients tend to run code in attachments just by clicking them Citation please? This is not my experience.

On windows, when you (double)click on an executable file it runs, because that's the default action for executables. On Unixes you need to mark the file as executable (with `chmod`) for this to happen.

I've literally never used a mail client that behaves this way. If the EXE even makes it past attachment scanners, I get a 'save'/'run' prompt and then if it's not signed and trusted, SmartScreen usually prompts me again to confirm that I really want to run it.

The app is usually in an installer package or ZIP which adds a couple more execute barriers.

The real threat is malware hidden in document formats like docx or pdf, which usually have fewer clicks before open + get exploited.

Re: HiddenWasp Malware Stings Targeted Linux Systems

#36

Post by LoveKebabble »

xupybd wrote: post #2

Well that is scary. What anti virus / security tools do others on here run. On Linux I run nothing. I'm concerned that this might not be okay any more.

I work as a detection engineer for a Security vendor and I'm going to go against the grain and say that there ARE tools you should run to monitor your linux infrastructure that are similar to AV but are NOT AV. I write detection's for these tools all day long for Linux systems and there's a BUNCH you can detect and alert on that's abnormal activity that should be investigated and having tools in place such as an EDR tool can make those investigations easier.

Looking at the original post - some of those would be monitoring the the bash history environment variables. This is commonly modified by threat actors as a defense evasion technique. (I see it a bunch with insider threats to)

There's a bunch of others - but having just that one alert trigger would have likely been enough to start an investigation and catch this malware should the protective controls others have recommended fail.

That said the tools to do the more necessary modern monitoring do typically require more maintenance and configuration and it's not typically a set and forget type of solution.

Options I'd recommend:

LimaCharlie - https://limacharlie.io - Cloud based EDR tool, it has a cost, but is not expensive ($1 per endpoint monitored, supports all Linux flavors). It's a lot easier to deploy and manage, but you'll have to write your own rules. This though will also allow you to remotely look at all processes/pull files off of a machine remotely/isolate hosts on the network etc

There are a bunch of other EDR tools out there like Carbon Black or CrowdStrikes/FireEye's tooling, but they run a high premium ($20-40 per end point, and typically only support Ubuntu or Redhat or both)

Wazuh - https://wazuh.com/ - It's a better maintained fork of OSSEC that makes mass deployments easier/has more default rules etc. It'll give you FIM/Notify you of insecure configurations etc - This one will require the most work to setup

Security Onion - https://securityonion.net/ - this one is probably a little overkill, but modern versions include Wazuh (as seen above) as well as OSQuery/Network IDS's (which are it's core feature)

Re: HiddenWasp Malware Stings Targeted Linux Systems

#37

Post by mbrumlow »

IronBacon wrote: post #34
xorcist wrote: post #22

Earlier quoted context omitted.

Is it really that strange? Windows email clients tend to run code in attachments just by clicking them (or, in some cases, just viewing them). So the risk factor in letting these emails in is quite large. That's not as common with other platforms. Even the common GUI platforms on Linux would require the user to manually save the file and explicitly marking the file as executable. Nobody would conflate user friendline…

> Even the common GUI platforms on Linux would require the user to manually save the file and explicitly marking the file as executable. If someone can find a way to drop a text file in my "~/.config/autostart" dir, next time I log in my Gnome desktop will happily execute the command present in the "Exec" line and it doesn't require the execute bit. I think something similar could be done using "~/.local/share/applic…

I think the point is -- do to that you would have to have the email client do it.

While once it is out side the control of the email client -- as the quote suggest, it's up to the user -- not the email client to do the dirty work.

The notion is that on windows, even a all knowing user who knew the email contained a virus after viewing it would be helpless as the email client already did the steps required to make the virus active. Where as on Linux, the user would still need to be the facilitator -- not the email client blindly destroying your system.

As a example. You can email me virus all day long, and it is not likely I will get infected because of how my email client handles files and attachments. If I were to switch to a windows based system using a windows client then all bets are off.

tl;dr your exception would mean the bad thing we are talking about already happened. If they could get your email client to write to that file they probably already had enough control to do whatever you are suggesting they put in autostart.

Re: HiddenWasp Malware Stings Targeted Linux Systems

#38

Post by LoveKebabble »

shakna wrote: post #3
xupybd wrote: post #2

Well that is scary. What anti virus / security tools do others on here run. On Linux I run nothing. I'm concerned that this might not be okay any more.

> The malware is still active and has a zero-detection rate in all major anti-virus systems. Anti virus wouldn't really help in this case. I should also point out that it appears that HiddenWasp is targeting systems that are already compromised in some form. The "achilles heel" of these sorts of CnC attacks tends to be, and is apparently so in this case, that they do need to phone home. In this case, the IP addresses…

The problem with this strategy is that IP Address/Domains/Hashes that are publicly available for free are typically dated and are rarely useful for catching anything other than mass scanning / ssh brute forcing or for doing retroactive searching and analysis.

You're also assuming that the linux server is the initial attack vector.

It is not uncommon for an org to be breached, and for the adversary to pivot to an admin box, and for the adversary to then gain control of a server using the admins legitimate credentials. All the while dropping persistence mechanisms along the way. Secure configurations and setups are always recommended and the above information is great advice. BUT it is also dated advice.

If you're not actively monitoring these servers and the activity on these servers they will eventually be popped. Logging all process/CLI activity is an awesome way to get started on monitoring, but if you're going that route, deploying Wazuh or an EDR tool can only add extra value by allowing you to create alerts off of specific values.

Re: HiddenWasp Malware Stings Targeted Linux Systems

#39

Post by FullyFunctional »

saagarjha wrote: post #5
tyingq wrote: post #4

Confused by: VER=`echo $(uname -a)` Versus just: VER=$(uname -a) or VER=`uname -a`

People writing rootkits are not necessarily experts in shell scripting :)

Look no further than the chain of xors that amount to ... ^ 0x22. These people really don't know much.

ISTM, the only interesting thing is the "user-mode rootkit" mentioned in the beginning. Anything installed after that is moot and completely irrelevant. If anyone gets root on your machine, it's already game over.

However, if your attack vector is getting me to execute a random .sh from you, then I'll roll my eyes and get on with life.

Re: HiddenWasp Malware Stings Targeted Linux Systems

#40

Post by _urga »

FullyFunctional wrote: post #39
saagarjha wrote: post #5

Earlier quoted context omitted.

People writing rootkits are not necessarily experts in shell scripting :)

Look no further than the chain of xors that amount to ... ^ 0x22. These people really don't know much. ISTM, the only interesting thing is the "user-mode rootkit" mentioned in the beginning. Anything installed after that is moot and completely irrelevant. If anyone gets root on your machine, it's already game over. However, if your attack vector is getting me to execute a random .sh from you, then I'll roll my eyes a…

If your email firewall allows random .sh attachments, then you are vulnerable to at least two attacks:

1. Someone targets you specifically, knowing you are a software developer, by impersonating a trusted third-party contact and sending you a ZIP attachment with the contents of an open source project you are known to work on. ZIP attachments preserve the executable bit, and you wouldn't see any .sh extension because it would be an extension-less shell script. It would probably just look like a binary you are used to clicking.

2. Someone impersonates a trusted third-party contact, sending you a ZIP attachment with a symlink traversal to overwrite your .bashrc as soon as you unzip the attachment with a double-click, or as soon as unpatched middleware unzips it for you.

Post reply on HN