RotaJakiro: A long live secret backdoor with 0 VT detection
blog.netlab.360.com
RotaJakiro: A long live secret backdoor with 0 VT detection
1–10 of 183 posts
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#2Dumb question but how does an ELF file end up in the Kernel? I thought everything was source-only?
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#3The obvious question not answered (but asked) in the article is: "Who put it there and why?"
Surely this should be easily knowable?
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#4Dumb question but how does an ELF file end up in the Kernel? I thought everything was source-only?
This wasn't in the kernel, this was just a piece of malware targeting Linux systems
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#5For those wondering why "RotaJakiro" the name, Jakiro is a reference to a Dota2 character, that is a dragon with 2 heads, thus why the double-behaviour got the name "Jakiro"
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#6Pardon me if it's a stupid question, but a backdoor to what? I don't really understand what it's about. In my mind a backdoor is hidden feature built into another _useful_ piece of software.
Is this "just a backdoor"? Like, its sole purpose is to give remote access / exfiltrate information? If so, how does it end up on systems? What is the vector?
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#7It's systemd-daemon. The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file.
It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#8Dumb question but how does an ELF file end up in the Kernel? I thought everything was source-only?
The user (perhaps running as root) was tricked into installed it. It has nothing to do with the kernel installation.
The file name is chosen by the attackers to look like a legit executable - systemd-daemon if installed as root, $HOME/.gvfsd/.profile/gvfsd-helper if installed without root privileges. That way victims who are looking at file names won't be alarmed because they look like an expected file e.g. hiding in the forest of legit "systemd-*" files.
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#9This isn't my area of expertise but ... where did they find this?
>On March 25, 2021, 360 NETLAB's BotMon system flagged a suspiciousELF file (MD5=64f6cfe44ba08b0babdd3904233c4857) with 0 VT detection, the sample communicates with 4 domains on TCP 443 (HTTPS), but the traffic is not of TLS/SSL. A close look at the sample revealed it to be a backdoor targeting Linux X64 systems, a family that has been around for at least 3 years.
They saw it communicating over the network? But ... where was it? On their linux system? Someone else's? Any idea how it got there?
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#10Pardon me if it's a stupid question, but a backdoor to what? I don't really understand what it's about. In my mind a backdoor is hidden feature built into another _useful_ piece of software. Is this "just a backdoor"? Like, its sole purpose is to give remote access / exfiltrate information? If so, how does it end up on systems? What is the vector?
This is what you drop on a system after it's compromised for use later, it's a RAT.
It gets there via some kind of compromise, either an insecure application, some drive-by exploit for some missing patch, owning a sysadmin and pushing it out via ansible/salt/etc.