Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Perfctl: Stealthy malware targeting Linux servers

aquasec.com

Post reply on HN
Print view View original

41–50 of 53 posts

Re: Perfctl: Stealthy malware targeting Linux servers

#41

Post by pphysch »

indrora wrote: post #31
waihtis wrote: post #28

Earlier quoted context omitted.

Unless youre doing security research, there close to zero legitimate uses of Tor for the average citizen.

There are plenty of reasons to use Tor. Not only to obfuscate location but to defend against mass surveillance, including that of the state [1]. Remember that Tor was developed originally and funded by the US State Department. Tor makes communications of LBTQ/Anti-authoritarian/journalist individuals safer in a world where the State Department has to put out advisories [2] about traveling while queer, a pride flag st…

> Tor is an essential tool for all citizens -- Especially those in the US who would be targeted by those who seek infinite, unrestrained power.

This is quite euphemistic. Tor exists to provide telecommunications support to US govt-backed political operations in foreign countries.

The individual welfare of people does not factor in. Take for instance the recent murder of an American citizen by $GOODGUYS vs. when another American citizen died under $BADGUYS captivity. Totally different treatment and rhetoric. People don't matter, politics does.

We should not falsely romanticize State Department programs at the expense of human rights.

Re: Perfctl: Stealthy malware targeting Linux servers

#42

Post by Pesthuf »

crackez wrote: post #30
guenthert wrote: post #12

Earlier quoted context omitted.

> - It opens a backdoor on the server and listens for TOR communications. So a `lsof -iTCP` should list it, right? Is it using TCP port 9050 or a custom port? EDIT: Ha, they are (not surprisingly) way ahead of me. From the article: "The malware continues to copy itself from memory to half a dozen other locations, with names that appear as conventional system files. It also drops a rootkit and a few popular Linux util…

There's always - cat /proc/net/tcp* And remember: echo * can be your "ls" in a pinch.

But let’s be honest, there’s no reason to use these unless you already know your server is compromised. In which case the server would be taken down rather than ssh‘d into.

And even then the attacker could patch cat, bash, provide sneaky aliases or just compromise Libc altogether.

Re: Perfctl: Stealthy malware targeting Linux servers

#43

Post by setopt »

tptacek wrote: post #37
waihtis wrote: post #28

Earlier quoted context omitted.

Unless youre doing security research, there close to zero legitimate uses of Tor for the average citizen.

You could make the same point without kicking up all the drama by saying there are close to zero legitimate reasons for a work computer on a work network to be reaching out to Tor.

I’d 100% understand if they want to block it… but for a while I ran my home server as a Tor hidden service just to get free dynamic DNS and NAT traversal, and could SSH into it from my office by accessing Tor from there. That’s arguably a legitimate use case.

Re: Perfctl: Stealthy malware targeting Linux servers

#44

Post by tptacek »

setopt wrote: post #43
tptacek wrote: post #37

Earlier quoted context omitted.

You could make the same point without kicking up all the drama by saying there are close to zero legitimate reasons for a work computer on a work network to be reaching out to Tor.

I’d 100% understand if they want to block it… but for a while I ran my home server as a Tor hidden service just to get free dynamic DNS and NAT traversal, and could SSH into it from my office by accessing Tor from there. That’s arguably a legitimate use case.

Literally one of the specific, enumerated use cases corporate networks have for blocking this stuff.

Re: Perfctl: Stealthy malware targeting Linux servers

#46

Post by rurban »

crackez wrote: post #30
guenthert wrote: post #12

Earlier quoted context omitted.

> - It opens a backdoor on the server and listens for TOR communications. So a `lsof -iTCP` should list it, right? Is it using TCP port 9050 or a custom port? EDIT: Ha, they are (not surprisingly) way ahead of me. From the article: "The malware continues to copy itself from memory to half a dozen other locations, with names that appear as conventional system files. It also drops a rootkit and a few popular Linux util…

There's always - cat /proc/net/tcp* And remember: echo * can be your "ls" in a pinch.

Not with a kernel module. Then this is also compromised

Re: Perfctl: Stealthy malware targeting Linux servers

#47

Post by setopt »

tptacek wrote: post #44
setopt wrote: post #43

Earlier quoted context omitted.

I’d 100% understand if they want to block it… but for a while I ran my home server as a Tor hidden service just to get free dynamic DNS and NAT traversal, and could SSH into it from my office by accessing Tor from there. That’s arguably a legitimate use case.

Literally one of the specific, enumerated use cases corporate networks have for blocking this stuff.

I should perhaps have added this wasn’t a “corporate” network but a university network. As a PhD candidate that was my “work network”.

Re: Perfctl: Stealthy malware targeting Linux servers

#48

Post by jcalvinowens »

jeroenhd wrote: post #17
pm2222 wrote: post #3

Does uefi secureboot help or not at all?

The article describes a hooking library as a rootkit but I can't see any indication of this rootkit inserting itself into the boot process. Instead, it seems to LD_PRELOAD itself into processes at a later stage. Secure boot won't help here. In theory one could configure a system to only trust executables and DLLs signed by a trusted, external signatory (like a locally hosted package repository) but I don't know of an…

I use a read-only squashfs rootfs on top of dm-verity to get a trusted userspace. The initramfs is a 50 line shell script which calls veritysetup with the known root hash, and is itself part of the signed boot image. Only /var is writable.

Re: Perfctl: Stealthy malware targeting Linux servers

#49

Post by waihtis »

tptacek wrote: post #37
waihtis wrote: post #28

Earlier quoted context omitted.

Unless youre doing security research, there close to zero legitimate uses of Tor for the average citizen.

You could make the same point without kicking up all the drama by saying there are close to zero legitimate reasons for a work computer on a work network to be reaching out to Tor.

[flagged]

Re: Perfctl: Stealthy malware targeting Linux servers

#50

Post by fungah »

I've been dealing with something similar - maybe actually this for 2 months.

There were so.e great insights from this researcher but they're missing some very fucked up elements of this malware.

1. I'm pretty sure it has. "fuck with it" scale. It leaves you alone if you don't fuck with it. In fact, I'd bet money that this malware did all the cryptocurrency shit for a reason like a bait and switch.

2. It effects android too. Doesn't seem to matter what device or how updated it is.

3. And windows.

4. It isn't persistent through rootkits. I mean, it is. But it's also deeper. My current thinking is that is persistent on my machines using the RAM training alorithms to spin itself up. From..

5. Your display. I have four displays that have had their firmware fucked with. Just discovered it's on a brand new mobo that I set up ensuring there was not a single peripheral I'd used before, no leds. Hadn't even installed an os before running a ram only mode Linux session from a hardware write protected usb THROUGH a write protected usb bridge. The only thing it was connected to that wasn't new was my monitor, and the UBS key (created from a secure pc and immediately write protected).

I think that this thing is EVERYWHERE. I've seen references in bash files from the initramfs that allude to escalating is action based on variables I. Ould t pin down

Post reply on HN