Now a script would be great helping check if the backdoor is present on a system or not.
RotaJakiro: A long live secret backdoor with 0 VT detection
71–80 of 183 posts
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#72So, it doesn't makes use of any 0day or exploit to enter the system. Has to be deliberately run. Makes me think of https://www.gnu.org/fun/jokes/evilmalware.en.html
> So, it doesn't makes use of any 0day or exploit to enter the system.
Why do you believe that to be the case?
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#73Why can’t Linux keep track of parent-child relationships and visualize them when you look at running processes? You could instantly identify this virus. And why can’t Linux apps have a universal and straightforward install directory?
Do you mean pstree?
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#74Earlier quoted context omitted.
I'm loving the differences between the word "virus" in the computer and biology sense.
I think the comparison is quite apt actually - a software virus requires a host (system) to reproduce, just as a meat-space virus does.
I think the computer term for the thing that most resembles how a meatspace virus behaves and propagates is "worm". Most worms can probably be classified as viruses, but most viruses nowadays (thankfully) aren't worms. (It can also generally refer to anything that's malicious and recursively self-propagating, like Samy's infamous Myspace XSS worm [1].)
Meatspace viruses are like computer worms, though computer viruses and computer worms aren't like meatspace worms; for that and a laundry list of other reasons, "malware" has superseded a lot of those terms among the infosec community.
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#75Why can’t Linux keep track of parent-child relationships and visualize them when you look at running processes? You could instantly identify this virus. And why can’t Linux apps have a universal and straightforward install directory?
Assuming you are talking about parent/child processes, use the --forest option in ps for an ascii art process tree.
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#76The obvious question not answered (but asked) in the article is: "Who put it there and why?" Surely this should be easily knowable?
Well this might be answered by asking who got it, what is their business, etc.
In general good malwares either try to make money or have some kind of geopolitical goal (industrial spying etc).
Information is power, but generally, a good hacker would know how to obfuscate the reasons why he is putting malware.
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#77It's systemd-daemon . The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.
Glad to know I'm unaffected since all my machines run openrc and herd.
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#78It's systemd-daemon . The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.
This kind of thing is trivially detected with basic system integrity tools [0][1] but I think a lot of those kinds of sysadmin tools have gone out of vogue at this point.
[0] https://access.redhat.com/documentation/en-us/red_hat_enterp...
[1] https://www.redhat.com/sysadmin/security-monitoring-tripwire
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#79This is why Linux firewall is terrible at blocking systemd’s access to a network port.
Yeah, I had a corner case where I wanted to use ISC DHCP client (due to Juniper DHCP server at my ISP) where I wanted to block all network access to systemd.
Alas, no can do. So i’ve since moved over to Denuvan distro where SysV unit can still be used while having Debian APT repo.
This is a plus for OpenBSD which can firewall by-PID (PID 1, systemd).
Re: RotaJakiro: A long live secret backdoor with 0 VT detection
#80Earlier quoted context omitted.
Running something is as easy as hijacking one of those “copy and paste this line into your command prompt to install this package” things you see on many open source sites. The command always curls some bigger script down and executes it. Often times it even has you sudo to root. While it would be prudent to examine the script rather than just blindly execute it... I imagine most don’t (myself included).
Which doesn't sound worse than installing non-app-store applications on any other platform, my take.
You say that like doing so is a negative thing. How do you think executable code gets on a system in the first place?
Either an Admin builds from source, an Admin installs a binary from a source they deem trustworthy, or you YOLO, download something sketchy to an older system and watch what your Network Analyzer/reverse engineering stack spits out.
App stores changed none of that in terms of fundamental activity one needs to do. They just lull users into a false sense of security because "someone else did it". I've run into too many devs who salivated over the idea of embedding cryptominers in game clones to believe it isn't done on a semi-regular basis.