11–20 of 101 posts
Also sniffing for suspicious packets on the potentially compromised machine?
"Let's see if this robot is telling the truth. Hey robot, are you telling the truth?"
It won't work on static binaries, it depends on the user not clearing the environment and there are also many programs that use the syscall directly, bypassing the hooks. From playing with file system hooks I remember programs written in Go and sqlite used to do this.
LD_PRELOAD isn't a particularly new attack vector... and it is limited to the permissions of the user it is being run as. So it still needs an unpatched privilege excalation to do any real harm
> So it still needs an unpatched privilege excalation to do any real harm https://xkcd.com/1200 All the important stuff you’d need to ruin someone’s life only needs their user account anyway, why is it such a relief if someone doesn’t get root access?
> Instead of being a standalone executable file that is run to infect a machine, it is a shared object (SO) library that is loaded into all running processes using LD_PRELOAD (T1574.006), and parasitically infects the machine. Once it has infected all the running processes, it provides the threat actor with rootkit functionality, the ability to harvest credentials, and remote access capability.
This looks exactly like what one of my friends in college wrote.
Nothing here looks special, there are a plenty of these:
https://github.com/chokepoint/Jynx2
https://github.com/chokepoint/jynxkit
https://github.com/NexusBots/Umbreon-Rootkit
https://github.com/chokepoint/azazel
https://github.com/unix-thrust/beurk
https://github.com/mempodippy/vlany
https://github.com/nopn0p/rkorova
And presumably tens more I've forgotten about. Highschoolers write stuff like this.
Earlier quoted context omitted.
Symbiote Deep-Dive: Analysis of a New, Nearly-Impossible-to-Detect Linux Threat And disclosed in a blog post, with Nearly-Impossible-to-Read text.
Do you mean text font/colour or the content itself?
Very clever hiding techniques. Makes me wonder which state level actor(s) are behind this one?
Ars fell for marketing speech from an AV company that has every reason to hype their discovery.
This looks exactly like what one of my friends in college wrote.
Curious why this gets downvoted. Despite all the marketing talk parroted by Ars, this looks like a bog standard LD_preload rootkit.
Direct link to the blog post with all details https://www.intezer.com/blog/research/new-linux-threat-symbi...
Yeah, that's a straight up lie. LD_PRELOAD kits are by definition very easy to detect.