New ultra-stealthy Linux backdoor isn’t your everyday malware discovery
1–10 of 101 posts
Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery
#2Direct link to the blog post with all details https://www.intezer.com/blog/research/new-linux-threat-symbi...
Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery
#3This looks exactly like what one of my friends in college wrote.
Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery
#4LD_PRELOAD isn't a particularly new attack vector... and it is limited to the permissions of the user it is being run as. So it still needs an unpatched privilege excalation to do any real harm
Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery
#5But how does it spread?
Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery
#6Very clever hiding techniques. Makes me wonder which state level actor(s) are behind this one?
Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery
#7Direct link to the blog post with all details https://www.intezer.com/blog/research/new-linux-threat-symbi...
Symbiote Deep-Dive: Analysis of a New, Nearly-Impossible-to-Detect Linux Threat
And disclosed in a blog post, with Nearly-Impossible-to-Read text.
Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery
#8LD_PRELOAD isn't a particularly new attack vector... and it is limited to the permissions of the user it is being run as. So it still needs an unpatched privilege excalation to do any real harm
> So it still needs an unpatched privilege excalation to do any real harm
All the important stuff you’d need to ruin someone’s life only needs their user account anyway, why is it such a relief if someone doesn’t get root access?
Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery
#9But how does it spread?
That's my exact question. This requires getting a .so on a device, and setting an environment variable for all users. The malware itself isn't too interesting, however clever they managed to hide it, but how they actually got it on the computers is.
Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery
#10Direct link to the blog post with all details https://www.intezer.com/blog/research/new-linux-threat-symbi...
Symbiote Deep-Dive: Analysis of a New, Nearly-Impossible-to-Detect Linux Threat And disclosed in a blog post, with Nearly-Impossible-to-Read text.
Do you mean text font/colour or the content itself?