Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

arstechnica.com

Post reply on HN
Print view View original

91–100 of 101 posts

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#91

Post by Karellen »

323 wrote: post #57
Karellen wrote: post #50

Earlier quoted context omitted.

Because it only ruins the one person's life whose account got hacked. All the other users on the system are unaffected. Also, if it just ruins a user account, you can simply delete that user's $HOME and restore their account from backups. If it elevates to root, you have to reformat the system and reinstall the whole OS from scratch (and hope it didn't patch the BIOS and/or hard disk firmware), and then reinstall all…

What other users? Pretty much all today's systems, either personal or server, are single user.

Plenty of households have lots of people using their own phone for social media and other consumption, but a shared laptop for times when a phone just isn't enough.

Not everyone can afford a laptop per family member.

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#92

Post by avereveard »

prvit wrote: post #89
avereveard wrote: post #81

"It rather involved being on the other side of this airtight hatchway" https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

This is a downright stupid criticism, malware can be interesting in itself without discussing the delivery mechanisms.

it isn't. for symbionte to take hold, it has to social engineer it's way into a system, with a person executing it. there's nothing novel nor interesting in capturing a few system call to hide oneself, malware has been doing that since the nineties. unless it can get some privilege it shouldn't, this "malware" is mostly user error.

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#93

Post by prvit »

avereveard wrote: post #92
prvit wrote: post #89

Earlier quoted context omitted.

This is a downright stupid criticism, malware can be interesting in itself without discussing the delivery mechanisms.

it isn't. for symbionte to take hold, it has to social engineer it's way into a system, with a person executing it. there's nothing novel nor interesting in capturing a few system call to hide oneself, malware has been doing that since the nineties. unless it can get some privilege it shouldn't, this "malware" is mostly user error.

This is not being distributed by social engineering.

Yes, this particular malware is boring.

However, exploits are only tangentially related to malware. Malware by itself can be interesting and worth discussing.

> for symbionte to take hold, it has to social engineer it's way into a system, with a person executing it.

This is an utterly stupid criticism, as it could be applied to almost all actually novel malware.

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#94

Post by GekkePrutser »

lvass wrote: post #88
GekkePrutser wrote: post #87

Earlier quoted context omitted.

> Going by KeepassXC docs, the database is encrypted with an HMAC challenge response, changing only on DB save. But if you have the ability to copy the database file and the HMAC response in the same point of time as this malware does, the yubikey part is useless. What password manager are you using? I use a GPG-based password manager (pass) so this is not the case. Each password is encrypted individually using the G…

Interesting, your passwords are safe even if the machine is infected for as long as you don't use them, that's good. Root access makes absolutely no difference in that aspect though. The point is you can do very real harm without it.

No, but malware is much more capable of hiding from antimalware software if it obtains admin rights.

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#95

Post by yarg »

VoidWhisperer wrote: post #37
prvit wrote: post #15

LD_PRELOAD rootkits are by definition not "ultra-stealthy". Nothing here looks special, there are a plenty of these: https://github.com/chokepoint/Jynx2 https://github.com/chokepoint/jynxkit https://github.com/NexusBots/Umbreon-Rootkit https://github.com/chokepoint/azazel https://github.com/unix-thrust/beurk https://github.com/mempodippy/vlany https://github.com/nopn0p/rkorova And presumably tens more I've forgotten…

Side tangent: Why does github let these repos for Malware stay up? I understand some of them use the excuse 'this is for education, i'm not responsible for what you do with it', but some don't even bother with that, and atleast my concern would be that some person could easily pull the code, modify it slightly, and off they go if the IOC/detections for the attack method aren't good yet

This sort of thing can be useful for white-hats.

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#96

Post by prvit »

superjan wrote: post #67
bregma wrote: post #32

Earlier quoted context omitted.

It's very much a classic "if someone can get root access to your system and is given the ability to install software, they can install this rootkit and do very bad things" type of malware. That part is glossed over completely in the article(s) and the focus is on the "do very bad things" because it sells eyeballs and clicks. After a while, in security, the blog posts, adverts, and scanners are the malware that's taki…

But then it is total nonsense to call this a “Linux backdoor”. A linux backdoor should mean a planted vulnerability in Linux itself.

No, this is widely accepted terminology. What you're trying to argue here is total nonsense.

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#97

Post by surge »

VoidWhisperer wrote: post #37
prvit wrote: post #15

LD_PRELOAD rootkits are by definition not "ultra-stealthy". Nothing here looks special, there are a plenty of these: https://github.com/chokepoint/Jynx2 https://github.com/chokepoint/jynxkit https://github.com/NexusBots/Umbreon-Rootkit https://github.com/chokepoint/azazel https://github.com/unix-thrust/beurk https://github.com/mempodippy/vlany https://github.com/nopn0p/rkorova And presumably tens more I've forgotten…

Side tangent: Why does github let these repos for Malware stay up? I understand some of them use the excuse 'this is for education, i'm not responsible for what you do with it', but some don't even bother with that, and atleast my concern would be that some person could easily pull the code, modify it slightly, and off they go if the IOC/detections for the attack method aren't good yet

Exploit DB etc, already exist. They're used for penetration tests as well, to simulate a real attacker, better to have something that you can work off of as a model to detect then let the attacks be the secrets of criminal organizations and state actors.

You train like you fight, you can't do research and build detections if you don't have some examples.

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#98

Post by GekkePrutser »

GekkePrutser wrote: post #94
lvass wrote: post #88

Earlier quoted context omitted.

Interesting, your passwords are safe even if the machine is infected for as long as you don't use them, that's good. Root access makes absolutely no difference in that aspect though. The point is you can do very real harm without it.

No, but malware is much more capable of hiding from antimalware software if it obtains admin rights.

And yes, it also means that only the passwords I actually use are exposed if a machine is compromised. Because each password is encrypted individually.

Re: New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

#100

Post by dark-star »

elesiuta wrote: post #58
ninkendo wrote: post #8

Earlier quoted context omitted.

> So it still needs an unpatched privilege excalation to do any real harm https://xkcd.com/1200 All the important stuff you’d need to ruin someone’s life only needs their user account anyway, why is it such a relief if someone doesn’t get root access?

And it isn't too difficult for something to elevate itself to root anyways. It could just include a basic key-logger which would work on most systems and wait for your password. Unless you're on Wayland, you can see for yourself by typing `xinput list` and `xinput test ` using the id of your keyboard. edit: and another comment linked to a blog post which also explains how this specific malware gains root https://www.…

Yes, this is the part you mean, right?

> This process requires that the SO has the setuid permission flag set.

so you don't just have to download a binary file and somehow set LD_PRELOAD for that user, you also have to set the SUID bit on that binary file, which by itself only root can do...

Post reply on HN