Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Powerful, highly stealthy Linux trojan may have infected victims for years

arstechnica.com

Post reply on HN
Print view View original

11–20 of 103 posts

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#11

Post by click170 »

SEJeff wrote: post #8
click170 wrote: post #5

I concede that it's not a panacea, but I really do feel like filtering outbound requests is going to be one of the best defences we have against stuff like this going forward. It protects you against: - viruses / trojans that try to call out - ad tracking (and ads in general, if you want) - intrusive analytics - suspect consumer devices (TVs that transmit live audio, network cameras that connect to the cloud even tho…

One kind of neat thing I do is filter outbound traffic based on the user. If you're using s newish distro like centos7/rhel7 or a newer ubuntu, you can filter packets with ip tables based on the user. I force the apps in various docker containers to run as different users (one per major app or major suite of apps), and use up tables to lock those bits down. My wordpress got owned and there was a little perl script at…

I really like this idea. I'm trying to take it one step further in fact.

My filtering is done at the gateway, and I'm hunting for ways of communicating which packets are associated with which users (on Linux and Mac). Probably done by tagging an unused part of the packet with some kind of ID.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#12

Post by justincormack »

_RPM wrote: post #7
justincormack wrote: post #6

Earlier quoted context omitted.

Only if you filter outgoing requests from a different box. If the attacker owns your kernel they can bypass the filtering. A nice OpenBSD box as an outbound filter does make sense though, with a different control mechanism.

What about connecting the suspect device to a switch and filtering all of the outbound requests on that switch. If request is approved, forward it to the internet?

I think you will find you need a decent packet filter that understands state on that "switch" and most switches wont do that in hardware, so it may as well be an appliance.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#13

Post by acdha »

click170 wrote: post #5

I concede that it's not a panacea, but I really do feel like filtering outbound requests is going to be one of the best defences we have against stuff like this going forward. It protects you against: - viruses / trojans that try to call out - ad tracking (and ads in general, if you want) - intrusive analytics - suspect consumer devices (TVs that transmit live audio, network cameras that connect to the cloud even tho…

That's been successful enough in the past that there's a strong selective pressure for malware to look more like legitimate traffic. How much time are you going to spend reviewing each HTTPS request made to an EC2 IP address?

Similarly, if that works, there's zero chance that a large vendor won't use the same endpoint for software updates, advertising and activity tracking, etc. to make filtering impossible.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#15

Post by chronomex »

click170 wrote: post #11
SEJeff wrote: post #8

Earlier quoted context omitted.

One kind of neat thing I do is filter outbound traffic based on the user. If you're using s newish distro like centos7/rhel7 or a newer ubuntu, you can filter packets with ip tables based on the user. I force the apps in various docker containers to run as different users (one per major app or major suite of apps), and use up tables to lock those bits down. My wordpress got owned and there was a little perl script at…

I really like this idea. I'm trying to take it one step further in fact. My filtering is done at the gateway, and I'm hunting for ways of communicating which packets are associated with which users (on Linux and Mac). Probably done by tagging an unused part of the packet with some kind of ID.

Maybe with VLAN tagging?

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#16

Post by tedunangst »

0x0 wrote: post #9

How can it run packet dumping as a non-root user?

LD_PRELOAD? ptrace?

Updated: Actually, I have no idea. The securelist link says "It uses techniques that don't require root access" but then later says "The module statically links PCAP libraries, and uses this code to get a raw socket".

I have no idea how one gets a raw socket without root, but I'm not in the business of creating raw sockets on linux...

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#17

Post by jerf »

0x0 wrote: post #9

How can it run packet dumping as a non-root user?

In addition to tedunagnst, as we're talking malware, consider also "kernel exploits". Even if the malware doesn't ship with an exploit, a normal UNIX user has enough privs to examine the kernel version and download and execute code that may exploit the given kernel.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#18

Post by 0x0 »

tedunangst wrote: post #16
0x0 wrote: post #9

How can it run packet dumping as a non-root user?

LD_PRELOAD? ptrace? Updated: Actually, I have no idea. The securelist link says "It uses techniques that don't require root access" but then later says "The module statically links PCAP libraries, and uses this code to get a raw socket". I have no idea how one gets a raw socket without root, but I'm not in the business of creating raw sockets on linux...

Not sure I follow, can a non-root user observe raw packets (like SYN packets and sequence numbers) through these facilities?

Edit: well, a statically linked pcap is still just a bunch of user-mode assembly code. I didn't think linux kernel security hinged on keeping libraries secret :P

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#19

Post by 0x0 »

jerf wrote: post #17
0x0 wrote: post #9

How can it run packet dumping as a non-root user?

In addition to tedunagnst, as we're talking malware, consider also "kernel exploits". Even if the malware doesn't ship with an exploit, a normal UNIX user has enough privs to examine the kernel version and download and execute code that may exploit the given kernel.

That's slightly less interesting. If you gain root then there's not much to it for dumping packets or hiding processes and open files and sockets or anything, really. Why would the article highlight "intercept network packets as a non-root user" of all things (paraphrased)

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#20

Post by etcet »

codezero wrote: post #2

Is there a quick and dirty script/one liner I can run to check my VPS right now?

This may take a while depending on the amount of data you have and the speed of your disk(s):

  grep -R -e 'TREX_PID=%u' -e 'Remote VS is empty !' /
Alternatively you could create ClamAV signatures based on those strings.
Post reply on HN