I did not really understand it from the article but... how can one verify the existence of this on their own system and if needed, purge it ?
They give some md5, so you could check if any of your binaries gives any of these hashes
RotaJakiro: A long live secret backdoor with 0 VT detection
21–30 of 183 posts
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#22Dumb question but how does an ELF file end up in the Kernel? I thought everything was source-only?
The user (perhaps running as root) was tricked into installed it. It has nothing to do with the kernel installation. The file name is chosen by the attackers to look like a legit executable - systemd-daemon if installed as root, $HOME/.gvfsd/.profile/gvfsd-helper if installed without root privileges. That way victims who are looking at file names won't be alarmed because they look like an expected file e.g. hiding in…
This is completely off topic but I love the Caesar cipher implementation in your bio. What does HAL stand for?
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#23The obvious question not answered (but asked) in the article is: "Who put it there and why?" Surely this should be easily knowable?
How would that be easy? If I put a random file on your computer X years ago while trying to cover my tracks, how would you tell when and how I did it?
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#24It's systemd-daemon . The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.
Also oddly redundant, most daemons end in a "d" to denote daemon, so that name is a bit like the toe-curling "RAID array".
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#25I did not really understand it from the article but... how can one verify the existence of this on their own system and if needed, purge it ?
ls -l $HOME/.gvfsd/.profile/gvfsd-helper /bin/systemd/systemd-daemon /usr/lib/systemd/systemd-daemon
If one or more of those files is found, you likely are infected - they probably are not "real" system files.
If you find one, do a system audit
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#26Cat : So my guess is the point where the virus author slipped is not making the traffic to port 443 look like genuine HTTPS. The moment a firewall notices 443 and NOT HTTPS it is tell-telle sign of something.
Mouse: OK. see you next time.
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#27What's "VT" and "C2" ?
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#28Earlier quoted context omitted.
The user (perhaps running as root) was tricked into installed it. It has nothing to do with the kernel installation. The file name is chosen by the attackers to look like a legit executable - systemd-daemon if installed as root, $HOME/.gvfsd/.profile/gvfsd-helper if installed without root privileges. That way victims who are looking at file names won't be alarmed because they look like an expected file e.g. hiding in…
This is completely off topic but I love the Caesar cipher implementation in your bio. What does HAL stand for?
2001:ASO's villain is named HAL
execute the cipher on it and see :)
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#29Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#30Earlier quoted context omitted.
The user (perhaps running as root) was tricked into installed it. It has nothing to do with the kernel installation. The file name is chosen by the attackers to look like a legit executable - systemd-daemon if installed as root, $HOME/.gvfsd/.profile/gvfsd-helper if installed without root privileges. That way victims who are looking at file names won't be alarmed because they look like an expected file e.g. hiding in…
This is completely off topic but I love the Caesar cipher implementation in your bio. What does HAL stand for?
IBM