RotaJakiro: A long live secret backdoor with 0 VT detection • Hacker News Board

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#101

Post by modshatereality » Thu, Apr 29, 2021, 5:38 PM UTC

fullstop wrote: post #17

_hyn3 wrote: post #7

It's systemd-daemon . The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.

Other malware has hidden itself as init, mysqld, php-fpm, etc. This is really nothing new.

True, though systemd-* naming scheme provides a substantial amount of brush for mal-binaries/configs to use as persistent cover. Every system could be different, but distros are lazy it seems.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#102

Post by jessaustin » Thu, Apr 29, 2021, 5:40 PM UTC

vaylian wrote: post #91

de6u99er wrote: post #71

Now a script would be great helping check if the backdoor is present on a system or not.

Sure. Just use this one: http://totally-legit-website.com/downloads/linux-systemd-roo...

Should one use the "curl | sh" idiom to install this tool?

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#103

Post by tyingq » Thu, Apr 29, 2021, 5:40 PM UTC

acdha wrote: post #59

fullstop wrote: post #17

Earlier quoted context omitted.

Other malware has hidden itself as init, mysqld, php-fpm, etc. This is really nothing new.

This technique is really effective when the attacker does a little bit of homework on the system: if it’s a web server, a lot of people (even security analysts) will miss that the 147 httpd process are 146 /usr/sbin/httpd and one /usr/local/sbin/httpd — or they’ll assume that was where someone installed a custom build.

You could set argv[0] too:

  $ perl -e '$0="/usr/sbin/httpd";fork or sleep 1000';ps

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#104

Post by TheMagicHorsey » Thu, Apr 29, 2021, 5:41 PM UTC

It's not quite clear to me, but is this Malware part of any of the popular Linux distributions, or was it part of an infection on that particular machine through some installation after the fact?

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#105

Post by hdjfmtnrn » Thu, Apr 29, 2021, 5:50 PM UTC

chmod775 wrote: post #60

This is pretty noisy as backdoors go. I wouldn't call this stealthy. It places a whole bunch of files in various locations, is running as a separate process, and doesn't do https properly. It's surprising really - when LD_PRELOAD'ing your malware into an existing process is way stealthier. Preferably one that nobody will bat an eyelash at for making TCP connections. The best ones will probably hide in (places such as…

On Windows, using the equivalent of LD_PRELOAD makes all the antiviruses go crazy.

One way around this if you insist is tricking another app into loading you, instead of you forcing your way in, this looks more legit.

But the best way to stay undetected is to behave as a regular innocent program and not use any tricks at all. These days, when computers have hundreds of processes running, nobody is going to notice another one.

For network communications there are ways of delegating this to other apps, so that you don't trigger the firewall. For example you can write something in the Chrome user profile directory which will make Chrome fetch data for you on the next start.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#106

Post by amenod » Thu, Apr 29, 2021, 5:53 PM UTC

spookthesunset wrote: post #47

marcodiego wrote: post #41

So, it doesn't makes use of any 0day or exploit to enter the system. Has to be deliberately run. Makes me think of https://www.gnu.org/fun/jokes/evilmalware.en.html

Running something is as easy as hijacking one of those “copy and paste this line into your command prompt to install this package” things you see on many open source sites. The command always curls some bigger script down and executes it. Often times it even has you sudo to root. While it would be prudent to examine the script rather than just blindly execute it... I imagine most don’t (myself included).

Or just copying a command with a hidden `` in the middle, then pasting it into a terminal which allows multiline pastes (which most terminals do).

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#107

Post by Cyph0n » Thu, Apr 29, 2021, 5:53 PM UTC

dllthomas wrote: post #48

Cyph0n wrote: post #39

Earlier quoted context omitted.

The full name of the movie is “2001: A Space Odyssey”. It’s based on a novel by the great Arthur C. Clarke.

"Based on" is a little imprecise. IIRC, the two were developed simultaneously and cooperatively, until Kubrick deviated at the end in some ways that made Clarke mad.

Huh, didn't know that! Thanks for sharing.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#108

Post by dijit » Thu, Apr 29, 2021, 6:00 PM UTC

salawat wrote: post #80

habibur wrote: post #56

Earlier quoted context omitted.

Which doesn't sound worse than installing non-app-store applications on any other platform, my take.

You say that like doing so is a negative thing. How do you think executable code gets on a system in the first place? Either an Admin builds from source, an Admin installs a binary from a source they deem trustworthy, or you YOLO, download something sketchy to an older system and watch what your Network Analyzer/reverse engineering stack spits out. App stores changed none of that in terms of fundamental activity one…

“Trust” is something you can give, though, as long as it’s not to the whole world.

Do you trust the Debian project? I mean, there’s reasons to trust them but if you don’t, then don’t run Debian.

If you do: the package repositories carry their chain of trust, since they’re signed by Debian maintainers- not the application developers themselves.

That’s a large distinction.

App stores didn’t give us trust; they have developers direct access to users and, crucially, the ability to charge for software- which was not a consideration for package managers before.

And Apple for the most part has been trying to carry the “burden” of ensuring trust, at a high cost.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#109

Post by souprock » Thu, Apr 29, 2021, 6:01 PM UTC

cgh wrote: post #75

101001001001 wrote: post #65

Why can’t Linux keep track of parent-child relationships and visualize them when you look at running processes? You could instantly identify this virus. And why can’t Linux apps have a universal and straightforward install directory?

Assuming you are talking about parent/child processes, use the --forest option in ps for an ascii art process tree.

I implemented the --forest option in ps.

It can't fully work. The kernel forgets parent-child relationships when processes die. Every orphan is adopted by init, and the kernel doesn't bother to remember the original parent. I've always hated this.

Anybody want to fix it?

The simple fix, kind of bad, is to simply remember the number and report it. The trouble here is that the number might get recycled. Adding a boolean to indicate "my original parent died" would help.

The proper fix is to keep some PID values allocated. Do not free a PID value until all the children of it have died. This would mean that every living process without a living original parent would have a ghost parent that gets reported to ps.

Sadly, for compatibility reasons, the getppid() call would need to report the adoptive parent. The fix for this is to add a new system call that reports both the original parent PID and a flag to indicate adoption.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#110

Post by salawat » Thu, Apr 29, 2021, 6:03 PM UTC

musingsole wrote: post #82

salawat wrote: post #80

Earlier quoted context omitted.

You say that like doing so is a negative thing. How do you think executable code gets on a system in the first place? Either an Admin builds from source, an Admin installs a binary from a source they deem trustworthy, or you YOLO, download something sketchy to an older system and watch what your Network Analyzer/reverse engineering stack spits out. App stores changed none of that in terms of fundamental activity one…

> I've run into too many devs who salivated over the idea of embedding cryptominers in game clones to believe it isn't done on a semi-regular basis. Reminds me of early days in my career when my mentor and I were discussing user issues with a library we maintained. I didn't realize it at the time, but he was messing with me by suggesting we add some hooks to report usage statistics back to us and use that to improve…

It's telling that you got grayed out that fast for what I don't think is an uncommon programming life lesson to try to instill.

What people run on their machine is no one's business but theirs. Undisclosed/non-consensual information leakage is unethical, and immoral. Period. I'm also not entirely on the status-quo of "accept the EULA or F off" form of disclosure or consent facilitation either. If someone reaches out, by all means, get the detailed info you need, but don't pull it. Let them push it. Other folk's machines don't become yours by virtue of executing some version of a computation you wrote once, no matter how badly Microsoft, IBM, Intel, and the FAANG's wish that were the case.

Note, this would be considered anti-thetical to most corporate or for-profit interests in the computing space; so don't be surprised if you get blowback or static for it.