11–20 of 183 posts
It's systemd-daemon . The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.
Pardon me if it's a stupid question, but a backdoor to what? I don't really understand what it's about. In my mind a backdoor is hidden feature built into another _useful_ piece of software. Is this "just a backdoor"? Like, its sole purpose is to give remote access / exfiltrate information? If so, how does it end up on systems? What is the vector?
Pardon me if it's a stupid question, but a backdoor to what? I don't really understand what it's about. In my mind a backdoor is hidden feature built into another _useful_ piece of software. Is this "just a backdoor"? Like, its sole purpose is to give remote access / exfiltrate information? If so, how does it end up on systems? What is the vector?
This is what you drop on a system after it's compromised for use later, it's a RAT. It gets there via some kind of compromise, either an insecure application, some drive-by exploit for some missing patch, owning a sysadmin and pushing it out via ansible/salt/etc.
Pardon me if it's a stupid question, but a backdoor to what? I don't really understand what it's about. In my mind a backdoor is hidden feature built into another _useful_ piece of software. Is this "just a backdoor"? Like, its sole purpose is to give remote access / exfiltrate information? If so, how does it end up on systems? What is the vector?
it's a virus. lol. there are many ways to get them onto systems. file download site, typosquatted apt/pip package names, buying/hacking a download mirror website, 0-day browser exploits, etc.
It's systemd-daemon . The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.
Probably a good choice running as "systemd-whatever". People have lost track of all the systemd pieces as it's grown in scope, so it doesn't look immediately suspicious.
It's systemd-daemon . The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.
It's systemd-daemon . The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.
Other malware has hidden itself as init, mysqld, php-fpm, etc. This is really nothing new.
Earlier quoted context omitted.
Probably a good choice running as "systemd-whatever". People have lost track of all the systemd pieces as it's grown in scope, so it doesn't look immediately suspicious.
That's pretty much what I said.. ;)