RotaJakiro: A long live secret backdoor with 0 VT detection

Post by m463 » Thu, Apr 29, 2021, 10:51 PM UTC

nitrogen wrote: post #94

CrazyPyroLinux wrote: post #81

Earlier quoted context omitted.

I'm skeptical since you spelled it "herd" (or maybe auto-correct strikes again.) But yeah, keeping your system free from the systemd cancer has always been a good idea.

Maybe "herd" is an actual tool, separate from Hurd? Or "and herd" here is equivalent to "et al?" Impossible to search for though.

Post by kbenson » Fri, Apr 30, 2021, 12:46 AM UTC

fiddlerwoaroof wrote: post #149

TacticalCoder wrote: post #147

Earlier quoted context omitted.

curl'ing is not the same at all as running, say, a Debian apt-get install. You apt-get signed packages coming from official mirrors (at least I do). Most of the Debian packages, by very far, are also fully deterministic and reproducible. If someone serves a backdoored package, that's probably incredibly noisy, leaving lots of traces everywhere and evidence can be gathered. When you curl, there's no way to know if you…

In this context we’re not talking about .debs from an official repository PPAs and debs downloaded from a GitHub release page have all the same problems as curl | sh

    # rpm -q --scripts bash
    postinstall scriptlet (using ):
    nl        = '\n'
    sh        = '/bin/sh'..nl
    bash      = '/bin/bash'..nl
    f = io.open('/etc/shells', 'a+')
    if f then
      local shells = nl..f:read('*all')..nl
      if not shells:find(nl..sh) then f:write(sh) end
      if not shells:find(nl..bash) then f:write(bash) end
      f:close()
    end
    postuninstall scriptlet (using ):
    -- Run it only if we are uninstalling
    if arg[2] == "0"
    then
      t={}
      for line in io.lines("/etc/shells")
      do
        if line ~= "/bin/bash" and line ~= "/bin/sh"
        then
          table.insert(t,line)
        end
      end

      f = io.open("/etc/shells", "w+")
      for n,line in pairs(t)
      do
        f:write(line.."\n")
      end
      f:close()
    end

Post by kbenson » Fri, Apr 30, 2021, 12:58 AM UTC

meowface wrote: post #74

danparsonson wrote: post #61

Earlier quoted context omitted.

I think the comparison is quite apt actually - a software virus requires a host (system) to reproduce, just as a meat-space virus does.

I think the computer term for the thing that most resembles how a meatspace virus behaves and propagates is "worm". Most worms can probably be classified as viruses, but most viruses nowadays (thankfully) aren't worms. (It can also generally refer to anything that's malicious and recursively self-propagating, like Samy's infamous Myspace XSS worm [1].) Meatspace viruses are like computer worms, though computer viruse…

Post by fiddlerwoaroof » Fri, Apr 30, 2021, 1:28 AM UTC

kbenson wrote: post #153

fiddlerwoaroof wrote: post #149

Earlier quoted context omitted.

In this context we’re not talking about .debs from an official repository PPAs and debs downloaded from a GitHub release page have all the same problems as curl | sh

Even if you aren't running official debs or RPMs, you're still quite a bit above running a build script off the web. A deb or RPM will include a manifest with checksums, which you can at a minimum use to confirm whether some post-isntall script or process changes an included file (such as removing or cleaning a malicious script that was included). In the case of RPM (at least, I'm not implying debs don't do this, jus…

    rpm -ip https://mojang.com/Minecraft-launcher.rpm

Post by kbenson » Fri, Apr 30, 2021, 2:44 AM UTC

fiddlerwoaroof wrote: post #157

kbenson wrote: post #153

Earlier quoted context omitted.

Even if you aren't running official debs or RPMs, you're still quite a bit above running a build script off the web. A deb or RPM will include a manifest with checksums, which you can at a minimum use to confirm whether some post-isntall script or process changes an included file (such as removing or cleaning a malicious script that was included). In the case of RPM (at least, I'm not implying debs don't do this, jus…

I can also pipe the script into a file and read it: it’s much easier to vet a simple shell script than an rpm or whatever anyways. But, my point just is that the vast majority are going to trust the package they downloaded to be safe: most people installing Minecraft on Linux from a .rpm they downloaded from Mojang aren’t going to audit the RPM, they’re just going to install it, maybe even with (it’s been a while sin…