21–30 of 53 posts
are there any scripts or steps to 100% detect perfectl yet?
IMHO, a simplest one is to check $PATH. If there are suspicious entries, like /bin/.local/bin, it's a sign of infection.
You can also check for presence of the specific files as mentioned close to the end of article.
Earlier quoted context omitted.
See the mitigation section in the article: https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targ... UEFI won't help here. But keeping your system up to date and limiting the system to the necessary functionality will help you.
In the mitigation section there is written 'Deploy Runtime Protection: Use advanced anti-malware and behavioral detection tools that can detect rootkits, cryptominers, and fileless malware like perfctl.' -- which tools can we currently use to detect perfctl?
From the article: > "Aqua Nautilus researchers aim to shed light on a Linux malware that, over the past 3-4 years, has actively sought more than 20,000 types of misconfigurations in order to target and exploit Linux servers. If you have a Linux server connected to the internet, you could be at risk. In fact, given the scale, we strongly believe the attackers targeted millions worldwide with a potential number of vict…
The CVE has a typo; the actual is CVE-2021-4034. https://nvd.nist.gov/vuln/detail/CVE-2021-4034
>The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands.
Oh, for fucks sake.
I thought it was overly paranoid, but it seems that would have really helped in this case.
Earlier quoted context omitted.
In the mitigation section there is written 'Deploy Runtime Protection: Use advanced anti-malware and behavioral detection tools that can detect rootkits, cryptominers, and fileless malware like perfctl.' -- which tools can we currently use to detect perfctl?
I hear Crowdstrike is king (≖ ͜ ≖)
From the article: > "Aqua Nautilus researchers aim to shed light on a Linux malware that, over the past 3-4 years, has actively sought more than 20,000 types of misconfigurations in order to target and exploit Linux servers. If you have a Linux server connected to the internet, you could be at risk. In fact, given the scale, we strongly believe the attackers targeted millions worldwide with a potential number of vict…
The CVE has a typo; the actual is CVE-2021-4034. https://nvd.nist.gov/vuln/detail/CVE-2021-4034
From the article: > "Aqua Nautilus researchers aim to shed light on a Linux malware that, over the past 3-4 years, has actively sought more than 20,000 types of misconfigurations in order to target and exploit Linux servers. If you have a Linux server connected to the internet, you could be at risk. In fact, given the scale, we strongly believe the attackers targeted millions worldwide with a potential number of vict…
Heh, my work has a firewall policy: any activity towards TOR servers flags an alert and makes security contact you. If you don't confirm it was by design, they'll start full scale "computer compromised" procedure. (And if you do confirm it it was by design, then they'll ask you to change that design if possible :) ) I thought it was overly paranoid, but it seems that would have really helped in this case.
are there any scripts or steps to 100% detect perfectl yet?
> In all the attacks observed, the malware was used to run a cryptominer I assume it starts by detecting a continuous 100% utilization of the cpu’s.
From the article: > "Aqua Nautilus researchers aim to shed light on a Linux malware that, over the past 3-4 years, has actively sought more than 20,000 types of misconfigurations in order to target and exploit Linux servers. If you have a Linux server connected to the internet, you could be at risk. In fact, given the scale, we strongly believe the attackers targeted millions worldwide with a potential number of vict…
> - It opens a backdoor on the server and listens for TOR communications. So a `lsof -iTCP` should list it, right? Is it using TCP port 9050 or a custom port? EDIT: Ha, they are (not surprisingly) way ahead of me. From the article: "The malware continues to copy itself from memory to half a dozen other locations, with names that appear as conventional system files. It also drops a rootkit and a few popular Linux util…
And remember: echo * can be your "ls" in a pinch.