Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

arstechnica.com

Post reply on HN
Print view View original

51–60 of 101 posts

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#51

Post by GabrielTFS »

alex_duf wrote: post #45
shaded-enmity wrote: post #35

Earlier quoted context omitted.

1. Can't the process just scrub LD_PRELOAD from its environment? Linker already done it's job at that point. 2. I'd suggest against using `strings` (let alone with sudo) on attacker controlled inputs

I'm curious about 2, why?

Some versions of `strings` might try to parse the file as an executable, which could expose one to any vulnerabilities that may be present in the library used to do so.

However, on my Fedora 36 machine at least, it doesn't do so by default and I'd have to specify the `-d` flag for it to do this.

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#52

Post by trelane »

prvit wrote: post #17
janandonly wrote: post #6

Very clever hiding techniques. Makes me wonder which state level actor(s) are behind this one?

These are not very clever hiding techniques, for the most part these are the most basic techniques known to every 15 year old malware dev reading decades old literature. Ars fell for marketing speech from an AV company that has every reason to hype their discovery.

Any resources (books, articles) you'd recommend for those with a very technical background interested in getting up to speed on the side?

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#53

Post by DeWilde »

VoidWhisperer wrote: post #37
prvit wrote: post #15

LD_PRELOAD rootkits are by definition not "ultra-stealthy". Nothing here looks special, there are a plenty of these: https://github.com/chokepoint/Jynx2 https://github.com/chokepoint/jynxkit https://github.com/NexusBots/Umbreon-Rootkit https://github.com/chokepoint/azazel https://github.com/unix-thrust/beurk https://github.com/mempodippy/vlany https://github.com/nopn0p/rkorova And presumably tens more I've forgotten…

Side tangent: Why does github let these repos for Malware stay up? I understand some of them use the excuse 'this is for education, i'm not responsible for what you do with it', but some don't even bother with that, and atleast my concern would be that some person could easily pull the code, modify it slightly, and off they go if the IOC/detections for the attack method aren't good yet

Do you think it would make it harder to find for people specialize in making malware like this?

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#54

Post by westmeal »

survirtual wrote: post #42
iso1631 wrote: post #25

> IPv4 (TCP or SCTP) and dst port (43253 or 43753 or 63424 or 26424) So this is hiding network traffic from certain ports, which means that it should be easy enough to spot on spanports or netflow data Are there any good tools which detect malware from analysing network traffic, either things like machines doing wide range attempts to connect on 137/139/445, or burte forcing on 22 etc, but also for more advanced sear…

I wouldn’t mind having a hardware / software network analyzing combo. Could probably do something as a plugin for OpenWRT — check consistency, packet sizes, ports in use, outbound hosts, etc. Could auto flag suspicious endpoints for further analysis, and if found to be malware for anyone, gets shoved in a db and shared. Malware could always bounce traffic off of a known host but that would move the needle in any case…

I'd also like to know if there are any applications that can run off of the router. I'm not network savvy but the only thing I've done in the past is capture packets off of the LAN or WAN interfaces and read em later but thats hardly a good way to check your network...

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#55

Post by 323 »

prvit wrote: post #15

LD_PRELOAD rootkits are by definition not "ultra-stealthy". Nothing here looks special, there are a plenty of these: https://github.com/chokepoint/Jynx2 https://github.com/chokepoint/jynxkit https://github.com/NexusBots/Umbreon-Rootkit https://github.com/chokepoint/azazel https://github.com/unix-thrust/beurk https://github.com/mempodippy/vlany https://github.com/nopn0p/rkorova And presumably tens more I've forgotten…

LD_PRELOAD equivalent was used in Windows malware circa 2006.

It seems all the old Windows techniques are now recycled on Linux.

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#57

Post by 323 »

Karellen wrote: post #50
ninkendo wrote: post #8

Earlier quoted context omitted.

> So it still needs an unpatched privilege excalation to do any real harm https://xkcd.com/1200 All the important stuff you’d need to ruin someone’s life only needs their user account anyway, why is it such a relief if someone doesn’t get root access?

Because it only ruins the one person's life whose account got hacked. All the other users on the system are unaffected. Also, if it just ruins a user account, you can simply delete that user's $HOME and restore their account from backups. If it elevates to root, you have to reformat the system and reinstall the whole OS from scratch (and hope it didn't patch the BIOS and/or hard disk firmware), and then reinstall all…

What other users?

Pretty much all today's systems, either personal or server, are single user.

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#58

Post by elesiuta »

ninkendo wrote: post #8
dark-star wrote: post #4

LD_PRELOAD isn't a particularly new attack vector... and it is limited to the permissions of the user it is being run as. So it still needs an unpatched privilege excalation to do any real harm

> So it still needs an unpatched privilege excalation to do any real harm https://xkcd.com/1200 All the important stuff you’d need to ruin someone’s life only needs their user account anyway, why is it such a relief if someone doesn’t get root access?

And it isn't too difficult for something to elevate itself to root anyways. It could just include a basic key-logger which would work on most systems and wait for your password. Unless you're on Wayland, you can see for yourself by typing `xinput list` and `xinput test ` using the id of your keyboard.

edit: and another comment linked to a blog post which also explains how this specific malware gains root https://www.intezer.com/blog/research/new-linux-threat-symbi...

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#59

Post by prvit »

323 wrote: post #55
prvit wrote: post #15

LD_PRELOAD rootkits are by definition not "ultra-stealthy". Nothing here looks special, there are a plenty of these: https://github.com/chokepoint/Jynx2 https://github.com/chokepoint/jynxkit https://github.com/NexusBots/Umbreon-Rootkit https://github.com/chokepoint/azazel https://github.com/unix-thrust/beurk https://github.com/mempodippy/vlany https://github.com/nopn0p/rkorova And presumably tens more I've forgotten…

LD_PRELOAD equivalent was used in Windows malware circa 2006. It seems all the old Windows techniques are now recycled on Linux.

Oh no, first LD_PRELOAD kits for Linux date back to the 90s.

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#60

Post by sophacles »

323 wrote: post #55
prvit wrote: post #15

LD_PRELOAD rootkits are by definition not "ultra-stealthy". Nothing here looks special, there are a plenty of these: https://github.com/chokepoint/Jynx2 https://github.com/chokepoint/jynxkit https://github.com/NexusBots/Umbreon-Rootkit https://github.com/chokepoint/azazel https://github.com/unix-thrust/beurk https://github.com/mempodippy/vlany https://github.com/nopn0p/rkorova And presumably tens more I've forgotten…

LD_PRELOAD equivalent was used in Windows malware circa 2006. It seems all the old Windows techniques are now recycled on Linux.

LD_PRELOAD (ish) attacks are older than the web.
Post reply on HN