Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RotaJakiro: A long live secret backdoor with 0 VT detection

blog.netlab.360.com

Post reply on HN
Print view View original

161–170 of 183 posts

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#161

Post by aidenn0 »

chmod775 wrote: post #126
hdjfmtnrn wrote: post #105

Earlier quoted context omitted.

On Windows, using the equivalent of LD_PRELOAD makes all the antiviruses go crazy. One way around this if you insist is tricking another app into loading you, instead of you forcing your way in, this looks more legit. But the best way to stay undetected is to behave as a regular innocent program and not use any tricks at all. These days, when computers have hundreds of processes running, nobody is going to notice ano…

> On Windows, using the equivalent of LD_PRELOAD makes all the antiviruses go crazy. There is no such thing on modern-day Windows. There used to be AppInit DLLs, but that 'feature' was broken to a degree that no legitimate application would have used it anyways and it likely wasn't a malware author's first choice either. Further, by the time you place a backdoor such as this, you would have neutralized any antivirus…

Does dropping a DLL in the same directory as the executable not work anymore?

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#162

Post by danuker »

fguerraz wrote: post #21
Phurist wrote: post #18

I did not really understand it from the article but... how can one verify the existence of this on their own system and if needed, purge it ?

They give some md5, so you could check if any of your binaries gives any of these hashes

Too bad MD5 is broken. To really confuse things, the attackers could generate an innocent but colliding binary.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#163

Post by jinnko »

dbrgn wrote: post #88
VWWHFSfQ wrote: post #78

Earlier quoted context omitted.

This kind of thing is trivially detected with basic system integrity tools [0][1] but I think a lot of those kinds of sysadmin tools have gone out of vogue at this point. [0] https://access.redhat.com/documentation/en-us/red_hat_enterp... [1] https://www.redhat.com/sysadmin/security-monitoring-tripwire

rkhunter and samhain are two other similar tools. Both are available in the regular Debian repositories.

rkhunter is nothing but a false sense of security. The detection mechanisms are crude and trivially bypassed. Have a read of the code for yourself.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#164

Post by meowface »

kbenson wrote: post #155
meowface wrote: post #74

Earlier quoted context omitted.

I think the computer term for the thing that most resembles how a meatspace virus behaves and propagates is "worm". Most worms can probably be classified as viruses, but most viruses nowadays (thankfully) aren't worms. (It can also generally refer to anything that's malicious and recursively self-propagating, like Samy's infamous Myspace XSS worm [1].) Meatspace viruses are like computer worms, though computer viruse…

> I think the computer term for the thing that most resembles how a meatspace virus behaves and propagates is "worm". A compuyter virus self propagates with human intervention. A worm self propagates without human intervention. I think the biological item that most closely resembles a work would be a parasite that is self-mobile. E.g. a botfly. Various computer virus' in the past propagated through floppy drives and…

That's true. Biological viruses are kind of in between computer viruses and computer worms.

I still think a worm is a decent analogy, though. For example, the first thing a worm will often do is scan the local network and try to infect each "living host" it finds in its vicinity. In some sense it can be seen as having some kind of willpower or intention, but it's a little more like a blind, unthinking process of trying to constantly fire itself in all directions, not unlike how a virus is unthinkingly regularly emitting itself into the air around it to infect those in its vicinity.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#165

Post by dbrgn »

jinnko wrote: post #163
dbrgn wrote: post #88

Earlier quoted context omitted.

rkhunter and samhain are two other similar tools. Both are available in the regular Debian repositories.

rkhunter is nothing but a false sense of security. The detection mechanisms are crude and trivially bypassed. Have a read of the code for yourself.

Yes, it's very simplistic. It does not claim otherwise.

However, it did manage to detect a rootkit on one of my system once (many years ago, when I used to phpMyAdmin, which had some kind of RCE). So it's better than nothing, and it would probably have detected the backdoor from the article (which does not even attempt to hide itself).

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#166

Post by zeusk »

tyingq wrote: post #11
_hyn3 wrote: post #7

It's systemd-daemon . The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.

Probably a good choice running as "systemd-whatever". People have lost track of all the systemd pieces as it's grown in scope, so it doesn't look immediately suspicious.

The svchost.exe of Linux

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#167

Post by zhte415 »

hiccuphippo wrote: post #36
duxup wrote: post #9

This isn't my area of expertise but ... where did they find this? >On March 25, 2021, 360 NETLAB's BotMon system flagged a suspiciousELF file (MD5=64f6cfe44ba08b0babdd3904233c4857) with 0 VT detection, the sample communicates with 4 domains on TCP 443 (HTTPS), but the traffic is not of TLS/SSL. A close look at the sample revealed it to be a backdoor targeting Linux X64 systems, a family that has been around for at le…

The website this was posted in seems to be a company offering network monitoring tools. So they probably saw it in one of their customer's systems.

360 is a huge, and I cannot emphasise how huge, antivirus company in China. It is also widely known for slowing down consumer Windows, hijacking IE (with the grace to add an identical logo but in green), and adding spyware to 'keep you safe'. They also pay well and employ some pretty competent people.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#168

Post by mvolfik »

danuker wrote: post #162
fguerraz wrote: post #21

Earlier quoted context omitted.

They give some md5, so you could check if any of your binaries gives any of these hashes

Too bad MD5 is broken. To really confuse things, the attackers could generate an innocent but colliding binary.

How does it help them? If you find file with this MD5 on your system, you have either the virus, or a colliding binary crafted by the attackers - bad in either case \o/

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#169

Post by asasaasasa »

passerby1 wrote: post #158
donmcronald wrote: post #156

Earlier quoted context omitted.

I don’t hate SystemD and even prefer writing unit files over init scripts, but it really has usurped the whole system. It’s even usurped fstab on Debian 10 / Ubuntu 20.04 and it’s awful . If you lose a disk on a modern system, SystemD will refuse to boot. Instead, it’ll try to drop to an emergency console, BUT there’s no root password on those systems because they use sudo. So it just runs in a loop and you’re SOL. L…

What options are available to avoid this from happening?

Two options available : 1) don't use systemD. 2) don't lose a data disk.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#170

Post by brendyn »

nitrogen wrote: post #94
CrazyPyroLinux wrote: post #81

Earlier quoted context omitted.

I'm skeptical since you spelled it "herd" (or maybe auto-correct strikes again.) But yeah, keeping your system free from the systemd cancer has always been a good idea.

Maybe "herd" is an actual tool, separate from Hurd? Or "and herd" here is equivalent to "et al?" Impossible to search for though.

What deelowe said. Shepherd's cli tool is herd. For example you can run sudo herd status. In practice it means they are running GNU Guix
Post reply on HN