41–50 of 103 posts
It's a userland trojan and it's "one of the most complex APTs in the world"? One wonders what these people would think if they found MosDef in the wild.
Earlier quoted context omitted.
I really like this idea. I'm trying to take it one step further in fact. My filtering is done at the gateway, and I'm hunting for ways of communicating which packets are associated with which users (on Linux and Mac). Probably done by tagging an unused part of the packet with some kind of ID.
Maybe with VLAN tagging?
It does assume that a user can't set the vlan themselves but my switches support this and I think it would be really cool to have segregated networks for different levels of user trust.
Is there a quick and dirty script/one liner I can run to check my VPS right now?
Earlier quoted context omitted.
That's been successful enough in the past that there's a strong selective pressure for malware to look more like legitimate traffic. How much time are you going to spend reviewing each HTTPS request made to an EC2 IP address? Similarly, if that works, there's zero chance that a large vendor won't use the same endpoint for software updates, advertising and activity tracking, etc. to make filtering impossible.
Definitely. And command and control centers can also be hosted at a hacked/badly managed site using something like spammimic [1] for messaging. [1] - http://www.spammimic.com/
I concede that it's not a panacea, but I really do feel like filtering outbound requests is going to be one of the best defences we have against stuff like this going forward. It protects you against: - viruses / trojans that try to call out - ad tracking (and ads in general, if you want) - intrusive analytics - suspect consumer devices (TVs that transmit live audio, network cameras that connect to the cloud even tho…
That's been successful enough in the past that there's a strong selective pressure for malware to look more like legitimate traffic. How much time are you going to spend reviewing each HTTPS request made to an EC2 IP address? Similarly, if that works, there's zero chance that a large vendor won't use the same endpoint for software updates, advertising and activity tracking, etc. to make filtering impossible.
I wanted to respond to your comment about vendors using one endpoint to inhibit filtering. They have as much freedom to do this as I do to deny them any internet access if they do. If the product does not operate as advertised in light of this, it will be promptly returned to the retailer.
Also, good filtering isn't based on an IP address alone but that's splitting hairs. Yes it is time consuming but I argue privacy isn't free, it must be protected and defended, we all have to find the medium we are happy with.
Huh, how do they do that?
> The underlying executable file is written in the C and C++ languages and contains code from previously written libraries, a property that gives the malicious file self-reliance.
Does that mean something? I don't get it.
I thought arstechnica usually was written for a technical audience.
> Even a regular user with limited privileges can launch it, allowing it to intercept traffic and run commands on infected machines. Huh, how do they do that? > The underlying executable file is written in the C and C++ languages and contains code from previously written libraries, a property that gives the malicious file self-reliance. Does that mean something? I don't get it. I thought arstechnica usually was writt…
I think they mean that the executable is statically linked.
Earlier quoted context omitted.
Assuming the trojan has a rootkit, it can patch the kernel so that netstat does not report it.
Is there any evidence that it patches the kernel? If it infiltrates the kernel, you'd think that'd be the most important detail Kaspersky could reveal; forget about whether the authors ran "strip" on the binary or not.
[0] https://securelist.com/blog/research/67962/the-penquin-turla...
Is there a quick and dirty script/one liner I can run to check my VPS right now?
This may take a while depending on the amount of data you have and the speed of your disk(s): grep -R -e 'TREX_PID=%u' -e 'Remote VS is empty !' / Alternatively you could create ClamAV signatures based on those strings.
I concede that it's not a panacea, but I really do feel like filtering outbound requests is going to be one of the best defences we have against stuff like this going forward. It protects you against: - viruses / trojans that try to call out - ad tracking (and ads in general, if you want) - intrusive analytics - suspect consumer devices (TVs that transmit live audio, network cameras that connect to the cloud even tho…