Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RotaJakiro: A long live secret backdoor with 0 VT detection

blog.netlab.360.com

Post reply on HN
Print view View original

91–100 of 183 posts

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#92

Post by overtomanu »

jozvolskyef wrote: post #22
gvb wrote: post #8

Earlier quoted context omitted.

The user (perhaps running as root) was tricked into installed it. It has nothing to do with the kernel installation. The file name is chosen by the attackers to look like a legit executable - systemd-daemon if installed as root, $HOME/.gvfsd/.profile/gvfsd-helper if installed without root privileges. That way victims who are looking at file names won't be alarmed because they look like an expected file e.g. hiding in…

This is completely off topic but I love the Caesar cipher implementation in your bio. What does HAL stand for?

this caesar cipher implementation doesnt replace z with a. incomplete??

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#93

Post by tuukkah »

jjgreen wrote: post #24
_hyn3 wrote: post #7

It's systemd-daemon . The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.

Also oddly redundant, most daemons end in a "d" to denote daemon, so that name is a bit like the toe-curling "RAID array".

This. If I saw a *d-daemon in the process list, I would feel I must research the origin of the name.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#94

Post by nitrogen »

CrazyPyroLinux wrote: post #81
swiley wrote: post #77

Earlier quoted context omitted.

Glad to know I'm unaffected since all my machines run openrc and herd.

I'm skeptical since you spelled it "herd" (or maybe auto-correct strikes again.) But yeah, keeping your system free from the systemd cancer has always been a good idea.

Maybe "herd" is an actual tool, separate from Hurd? Or "and herd" here is equivalent to "et al?" Impossible to search for though.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#97

Post by acdha »

salawat wrote: post #80
habibur wrote: post #56

Earlier quoted context omitted.

Which doesn't sound worse than installing non-app-store applications on any other platform, my take.

You say that like doing so is a negative thing. How do you think executable code gets on a system in the first place? Either an Admin builds from source, an Admin installs a binary from a source they deem trustworthy, or you YOLO, download something sketchy to an older system and watch what your Network Analyzer/reverse engineering stack spits out. App stores changed none of that in terms of fundamental activity one…

> App stores changed none of that in terms of fundamental activity one needs to do.

This just isn’t true: app stores vary but they added some key changes — developers have a reputation to worry about, stores restrict what APIs you can call, and it provides a single place to force updates or pull malware. That’s not perfect, of course, but it’s better than just installing whatever you find online — Facebook et al. wouldn’t be upset with Apple if it wasn’t working.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#98

Post by deelowe »

CrazyPyroLinux wrote: post #81
swiley wrote: post #77

Earlier quoted context omitted.

Glad to know I'm unaffected since all my machines run openrc and herd.

I'm skeptical since you spelled it "herd" (or maybe auto-correct strikes again.) But yeah, keeping your system free from the systemd cancer has always been a good idea.

Pretty sure they are referring to herd and shepherd: https://www.gnu.org/software/shepherd/manual/html_node/herd-...

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#99

Post by twarge »

jjgreen wrote: post #24
_hyn3 wrote: post #7

It's systemd-daemon . The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.

Also oddly redundant, most daemons end in a "d" to denote daemon, so that name is a bit like the toe-curling "RAID array".

also, "web blog"
Post reply on HN