Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Powerful, highly stealthy Linux trojan may have infected victims for years

arstechnica.com

Post reply on HN
Print view View original

31–40 of 103 posts

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#31

Post by WorldWideWayne »

acdha wrote: post #13
click170 wrote: post #5

I concede that it's not a panacea, but I really do feel like filtering outbound requests is going to be one of the best defences we have against stuff like this going forward. It protects you against: - viruses / trojans that try to call out - ad tracking (and ads in general, if you want) - intrusive analytics - suspect consumer devices (TVs that transmit live audio, network cameras that connect to the cloud even tho…

That's been successful enough in the past that there's a strong selective pressure for malware to look more like legitimate traffic. How much time are you going to spend reviewing each HTTPS request made to an EC2 IP address? Similarly, if that works, there's zero chance that a large vendor won't use the same endpoint for software updates, advertising and activity tracking, etc. to make filtering impossible.

Definitely. And command and control centers can also be hosted at a hacked/badly managed site using something like spammimic [1] for messaging.

[1] - http://www.spammimic.com/

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#32

Post by jethro_tell »

click170 wrote: post #11
SEJeff wrote: post #8

Earlier quoted context omitted.

One kind of neat thing I do is filter outbound traffic based on the user. If you're using s newish distro like centos7/rhel7 or a newer ubuntu, you can filter packets with ip tables based on the user. I force the apps in various docker containers to run as different users (one per major app or major suite of apps), and use up tables to lock those bits down. My wordpress got owned and there was a little perl script at…

I really like this idea. I'm trying to take it one step further in fact. My filtering is done at the gateway, and I'm hunting for ways of communicating which packets are associated with which users (on Linux and Mac). Probably done by tagging an unused part of the packet with some kind of ID.

Uh set the evilbit as it leaves tue machine and get the gateway to filter it?

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#33

Post by tedunangst »

mahouse wrote: post #27
wjoe wrote: post #25

"It can't be detected using the common netstat command." How is this possible? I thought netstat would show any program which is listening for connections on a port, regardless of whether it's actively doing anything.

From what the article says (and it's not very concise as you can see) it's not listening for connections, or at least it's not listening for connections until it's "awoken" by something external.

> it's not very concise as you can see

The article is very concise. It's just not very correct. :)

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#34

Post by kh_hk »

wjoe wrote: post #25

"It can't be detected using the common netstat command." How is this possible? I thought netstat would show any program which is listening for connections on a port, regardless of whether it's actively doing anything.

http://www.phenoelit.org/stuff/cd00r.c

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#35

Post by munin »

foxylad wrote: post #24
etcet wrote: post #20

Earlier quoted context omitted.

This may take a while depending on the amount of data you have and the speed of your disk(s): grep -R -e 'TREX_PID=%u' -e 'Remote VS is empty !' / Alternatively you could create ClamAV signatures based on those strings.

Thanks. Being able to provide simple easily verified command on a public forum to detect the most stealthy malware is testament to the brilliant design of unix-style systems. If someone offered a Widows utility to do the same thing on a forum, only fools would run it.

they would just need to paste a command line to findstr: http://technet.microsoft.com/en-us/library/cc732459.aspx

but don't let facts get in the way of your platform wars...

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#36

Post by jethro_tell »

click170 wrote: post #5

I concede that it's not a panacea, but I really do feel like filtering outbound requests is going to be one of the best defences we have against stuff like this going forward. It protects you against: - viruses / trojans that try to call out - ad tracking (and ads in general, if you want) - intrusive analytics - suspect consumer devices (TVs that transmit live audio, network cameras that connect to the cloud even tho…

Outbound filtering is great but easily beaten with a mild level of sophistication. The addition of outbound monitoring and analysis is gold. What kind if dns requests am I making how many per hour? how many per page load? how many per domain? What do my flows look like? Do i have DNS flows that last an hour? http connections that serve twice the normal data as my normal page load? http connectionsreturned per domain. Is do i return addresses that are not listed on my servers?

Security layers say you should force all your traffic out your neccessary ports then scrutinize your traffic through those limited egressess.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#37

Post by mreiland »

gizmo686 wrote: post #28
wjoe wrote: post #25

"It can't be detected using the common netstat command." How is this possible? I thought netstat would show any program which is listening for connections on a port, regardless of whether it's actively doing anything.

Assuming the trojan has a rootkit, it can patch the kernel so that netstat does not report it.

honestly I was trying to figure out how this is something new. rootkits have been around for a long time now.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#39

Post by tptacek »

renaudg wrote: post #30
wjoe wrote: post #25

"It can't be detected using the common netstat command." How is this possible? I thought netstat would show any program which is listening for connections on a port, regardless of whether it's actively doing anything.

The program doesn't set up a listening socket (which would show up in netstat), it's doing what is normally the kernel's job (analyzing traffic on the interface and parsing IP packets) all by itself in userspace.

And it's using libpcap to do it, making it (in that regard) asymptotically as sophisticated as dsniff.

It appears to literally be using cd00r, which FX wrote almost 15 years ago. It's like they assembled it out of junkyard parts from PacketStorm.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#40

Post by tptacek »

gizmo686 wrote: post #28
wjoe wrote: post #25

"It can't be detected using the common netstat command." How is this possible? I thought netstat would show any program which is listening for connections on a port, regardless of whether it's actively doing anything.

Assuming the trojan has a rootkit, it can patch the kernel so that netstat does not report it.

Is there any evidence that it patches the kernel? If it infiltrates the kernel, you'd think that'd be the most important detail Kaspersky could reveal; forget about whether the authors ran "strip" on the binary or not.
Post reply on HN