Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RotaJakiro: A long live secret backdoor with 0 VT detection

blog.netlab.360.com

Post reply on HN
Print view View original

131–140 of 183 posts

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#131

Post by hdjfmtnrn »

chmod775 wrote: post #126
hdjfmtnrn wrote: post #105

Earlier quoted context omitted.

On Windows, using the equivalent of LD_PRELOAD makes all the antiviruses go crazy. One way around this if you insist is tricking another app into loading you, instead of you forcing your way in, this looks more legit. But the best way to stay undetected is to behave as a regular innocent program and not use any tricks at all. These days, when computers have hundreds of processes running, nobody is going to notice ano…

> On Windows, using the equivalent of LD_PRELOAD makes all the antiviruses go crazy. There is no such thing on modern-day Windows. There used to be AppInit DLLs, but that 'feature' was broken to a degree that no legitimate application would have used it anyways and it likely wasn't a malware author's first choice either. Further, by the time you place a backdoor such as this, you would have neutralized any antivirus…

> There is no such thing on modern-day Windows.

There are a number of ways. For example shell extensions. Even Chrome, which took great care to not load them missed a few, which I used to get my DLL running inside Chrome without the antivirus complaining. This was some years ago, don't know if they fixed this (and is not really a bug, is by design, sort of).

> you would have neutralized any antivirus software.

That is extremely difficult and fragile. Much better to just not trigger it in the first way by behaving like a "normal" app. The user is also much more likely to notice a non-updating antivirus than some random process.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#132

Post by adventureadmin »

cyberpunk wrote: post #16

This is pretty cool, but I keep waiting until someone finds a horribly malicious version of bash that hides processes, directories and so on unless you have a specific env var set.. It could even detect when you do a update and just copy itself back over the new version, since almost all updates are being applied under a shell somewhere (may need a malicious python also then..)

I don't think anyone bothers to backdoor a shell in that way. Why not just target libc via LD? That tricks bash, sh, python, etc; but you can use setuid to check for the existence of malware that is evading through LD_PRELOAD.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#133

Post by acdha »

tyingq wrote: post #103
acdha wrote: post #59

Earlier quoted context omitted.

This technique is really effective when the attacker does a little bit of homework on the system: if it’s a web server, a lot of people (even security analysts) will miss that the 147 httpd process are 146 /usr/sbin/httpd and one /usr/local/sbin/httpd — or they’ll assume that was where someone installed a custom build.

You could set argv[0] too: $ perl -e '$0="/usr/sbin/httpd";fork or sleep 1000';ps

Good point - I was thinking about persistence but I saw the argv trick in the wild in the early 2000s when someone hit a PHP script in one of our undergrad’s home directory and dropped something fun onto the system.

I think I used lsof back then but it’s been a while.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#134

Post by philsnow »

souprock wrote: post #109
cgh wrote: post #75

Earlier quoted context omitted.

Assuming you are talking about parent/child processes, use the --forest option in ps for an ascii art process tree.

I implemented the --forest option in ps. It can't fully work. The kernel forgets parent-child relationships when processes die. Every orphan is adopted by init, and the kernel doesn't bother to remember the original parent. I've always hated this. Anybody want to fix it? The simple fix, kind of bad, is to simply remember the number and report it. The trouble here is that the number might get recycled. Adding a boolea…

> The proper fix is to keep some PID values allocated. Do not free a PID value until all the children of it have died.

Any fork bomb at all will exhaust the pid graveyard, wouldn't it? You could change pid_t to 64 bits but then the pid graveyard would take a lot of memory in the kernel.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#135

Post by UI_at_80x24 »

dbrgn wrote: post #89
_joel wrote: post #42

Earlier quoted context omitted.

Reminds me of PAT Testing

This is called the "RAS Syndrome" (where "RAS" stands for "redundant acronym syndrome"): https://en.wikipedia.org/wiki/RAS_syndrome

As the President of the AAPoOAA[0] I'd like to point out that this is the #1 article in our charter.

[0] American Association of over Abused Acronyms

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#136

Post by staticassertion »

f1refly wrote: post #127
staticassertion wrote: post #119

Earlier quoted context omitted.

> I know I'm not at all the first to say this, but those "curl into sh" installers are just such terrible ideas in general, and typically inconvenient and brittle as well. They're fine for security and super convenient. I get why it's so popular - packaging and publishing debs is often going to be a lot more work, and now you're in the world of either maintaining a package repo or having to deal with an official one.

Actually it's not hard at all. All you need is a half-working build system and tar installed. You just create an additional build target and you're fine.

If you maintain the repository yourself now your setup instruction involves adding a custom apt repo, and then the installation. You also now have to handle multiple package managers, etc. A simple bootstrap script is pretty much as easy as it gets.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#137

Post by jozvolskyef »

dllthomas wrote: post #48
Cyph0n wrote: post #39

Earlier quoted context omitted.

The full name of the movie is “2001: A Space Odyssey”. It’s based on a novel by the great Arthur C. Clarke.

"Based on" is a little imprecise. IIRC, the two were developed simultaneously and cooperatively, until Kubrick deviated at the end in some ways that made Clarke mad.

That's a shame. The book's ending is one of the most memorable things I ever read.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#138

Post by souprock »

philsnow wrote: post #134
souprock wrote: post #109

Earlier quoted context omitted.

I implemented the --forest option in ps. It can't fully work. The kernel forgets parent-child relationships when processes die. Every orphan is adopted by init, and the kernel doesn't bother to remember the original parent. I've always hated this. Anybody want to fix it? The simple fix, kind of bad, is to simply remember the number and report it. The trouble here is that the number might get recycled. Adding a boolea…

> The proper fix is to keep some PID values allocated. Do not free a PID value until all the children of it have died. Any fork bomb at all will exhaust the pid graveyard, wouldn't it? You could change pid_t to 64 bits but then the pid graveyard would take a lot of memory in the kernel.

For an actual fork bomb, nothing ends up in the PID graveyard. No process ever dies. The fork bomb by itself is a problem, even without a PID graveyard. Process limits are required to stop a fork bomb.

For other situations, just keep the direct parents. Worst case, that doubles the PID usage.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#139

Post by afturkrull »

How does RotaJakiro deploy on a not already compromised system. Without the enduser downloading and running an execututable? will it run on non-systemd systems? Or non-gnome desktops?

"How did RotaJakiro spread, and what was its purpose?"

There's no evidence it has spread, apart from being uploaded to the VirusTotal anti-malware engine?

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#140

Post by cblconfederate »

jessaustin wrote: post #102
vaylian wrote: post #91

Earlier quoted context omitted.

Sure. Just use this one: http://totally-legit-website.com/downloads/linux-systemd-roo...

Should one use the "curl | sh" idiom to install this tool?

but only as root in a production machine
Post reply on HN