Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RotaJakiro: A long live secret backdoor with 0 VT detection

blog.netlab.360.com

Post reply on HN
Print view View original

81–90 of 183 posts

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#81

Post by CrazyPyroLinux »

swiley wrote: post #77
_hyn3 wrote: post #7

It's systemd-daemon . The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.

Glad to know I'm unaffected since all my machines run openrc and herd.

I'm skeptical since you spelled it "herd" (or maybe auto-correct strikes again.) But yeah, keeping your system free from the systemd cancer has always been a good idea.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#82

Post by musingsole »

salawat wrote: post #80
habibur wrote: post #56

Earlier quoted context omitted.

Which doesn't sound worse than installing non-app-store applications on any other platform, my take.

You say that like doing so is a negative thing. How do you think executable code gets on a system in the first place? Either an Admin builds from source, an Admin installs a binary from a source they deem trustworthy, or you YOLO, download something sketchy to an older system and watch what your Network Analyzer/reverse engineering stack spits out. App stores changed none of that in terms of fundamental activity one…

> I've run into too many devs who salivated over the idea of embedding cryptominers in game clones to believe it isn't done on a semi-regular basis.

Reminds me of early days in my career when my mentor and I were discussing user issues with a library we maintained. I didn't realize it at the time, but he was messing with me by suggesting we add some hooks to report usage statistics back to us and use that to improve things.

I was young and naive so excuse that I got really excited at the genius of the idea. If not for his wry smile, I would have happily run off and implemented just that.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#83

Post by inetknght »

101001001001 wrote: post #65

Why can’t Linux keep track of parent-child relationships and visualize them when you look at running processes? You could instantly identify this virus. And why can’t Linux apps have a universal and straightforward install directory?

> Why can’t Linux keep track of parent-child relationships and visualize them when you look at running processes?

Linux does keep track of parent-child process relationships. Linux, however, is just a kernel. It's not your operating system and it's definitely not your GUI.

I suggest you look at something like `htop`.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#84

Post by squarefoot »

The malware contains some hardcoded domains:

news.thaprior.net blog.eduelects.com cdn.mirror-codes.net status.sublineover.net

Just out of curiosity I did a simple search and found no mention of any of those domains, except for status.sublineover.net which is being reported here:

https://raw.githubusercontent.com/shargon/Fwhibbit/master/To...

Which is stored on a 4 years old project by what seems to be a ethical hackers group:

https://github.com/shargon/Fwhibbit

(possibly related to: https://fwhibbit.es )

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#85

Post by PixelOfDeath »

jjgreen wrote: post #24
_hyn3 wrote: post #7

It's systemd-daemon . The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.

Also oddly redundant, most daemons end in a "d" to denote daemon, so that name is a bit like the toe-curling "RAID array".

That is just to highlight the redundancy!

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#86

Post by tomxor »

_hyn3 wrote: post #7

It's systemd-daemon . The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.

It's also piggybacking on dbus and gvfsd esque names for non root persistence.

They are common but small compared to systemd. there are lots of commonly installed deamons, most people can't keep track of all of their names through all revisions. Even if you did it's still going to be hard to spot with legitimate looking names like this.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#87

Post by tux3 »

cyberpunk wrote: post #63
spookthesunset wrote: post #51

Earlier quoted context omitted.

Back in my younger days... I’ve had boxes hacked through bugs in bind or sendmail. The hacker would cover their tracks with replacements of “ps”, “ls” and such that attempted to cover their tracks. Good times.

Back in my younger days I wrote a few such patches. Not a lot of people use tripwire anymore!

The old tripwire makes less sense in a world of cloudwalking cattle. Ephemeral containers and VMs everywhere. Machines go up, they go down.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#88

Post by dbrgn »

VWWHFSfQ wrote: post #78
_hyn3 wrote: post #7

It's systemd-daemon . The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.

This kind of thing is trivially detected with basic system integrity tools [0][1] but I think a lot of those kinds of sysadmin tools have gone out of vogue at this point. [0] https://access.redhat.com/documentation/en-us/red_hat_enterp... [1] https://www.redhat.com/sysadmin/security-monitoring-tripwire

rkhunter and samhain are two other similar tools. Both are available in the regular Debian repositories.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#89

Post by dbrgn »

_joel wrote: post #42
jjgreen wrote: post #24

Earlier quoted context omitted.

Also oddly redundant, most daemons end in a "d" to denote daemon, so that name is a bit like the toe-curling "RAID array".

Reminds me of PAT Testing

This is called the "RAS Syndrome" (where "RAS" stands for "redundant acronym syndrome"): https://en.wikipedia.org/wiki/RAS_syndrome

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#90

Post by lgats »

squarefoot wrote: post #84

The malware contains some hardcoded domains: news.thaprior.net blog.eduelects.com cdn.mirror-codes.net status.sublineover.net Just out of curiosity I did a simple search and found no mention of any of those domains, except for status.sublineover.net which is being reported here: https://raw.githubusercontent.com/shargon/Fwhibbit/master/To... Which is stored on a 4 years old project by what seems to be a ethical hacke…

https://domain.glass/status.sublineover.net -registered 2015-12-09 -cisco umbrella ranked intermittently since 2020-07

https://domain.glass/news.thaprior.net -registered 2015-12-09 -intermittent cisco umbrella ranking since 2021-01-31

https://domain.glass/cdn.mirror-codes.net -registered 2015-12-10

https://domain.glass/blog.eduelects.com -registered 2015-12-09

All domains registered with Web4Africa (Pty) Ltd, hosting provided by Deltahost PTR, Kiev, Ukraine

Post reply on HN