Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Powerful, highly stealthy Linux trojan may have infected victims for years

arstechnica.com

Post reply on HN
Print view View original

51–60 of 103 posts

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#51

Post by finid »

foxylad wrote: post #24
etcet wrote: post #20

Earlier quoted context omitted.

This may take a while depending on the amount of data you have and the speed of your disk(s): grep -R -e 'TREX_PID=%u' -e 'Remote VS is empty !' / Alternatively you could create ClamAV signatures based on those strings.

Thanks. Being able to provide simple easily verified command on a public forum to detect the most stealthy malware is testament to the brilliant design of unix-style systems. If someone offered a Widows utility to do the same thing on a forum, only fools would run it.

That's why I won't use any OS that's not Unix-like.

grep for this and that in this directory. Brilliant!

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#52

Post by dmix »

tptacek wrote: post #38

It's a userland trojan and it's "one of the most complex APTs in the world"? One wonders what these people would think if they found MosDef in the wild.

I believe they mentioned the fact it couldn't be detected by netstat as an example of it's sophistication.

idk how this got 127 upvotes.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#53

Post by gaadd33 »

tedunangst wrote: post #26
foxylad wrote: post #24

Earlier quoted context omitted.

Thanks. Being able to provide simple easily verified command on a public forum to detect the most stealthy malware is testament to the brilliant design of unix-style systems. If someone offered a Widows utility to do the same thing on a forum, only fools would run it.

Because you can't type a search string into the search box in explorer on windows?

The search box in explorer searches binaries these days? Honest question, I haven't used it in years.

That seems like it would be pretty counterintuitive for users though. Someone tries to search for the string 'program' and it returns all binaries that have 'This program cannot be run in DOS mode' in them. (Which I think is pretty much all PE binaries)

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#54

Post by etcet »

danieltillett wrote: post #49
etcet wrote: post #20

Earlier quoted context omitted.

This may take a while depending on the amount of data you have and the speed of your disk(s): grep -R -e 'TREX_PID=%u' -e 'Remote VS is empty !' / Alternatively you could create ClamAV signatures based on those strings.

Where does this come from?

I can't confirm that it works but I was going off this:

> Administrators who want to check for Turla-infected Linux systems can check outgoing traffic for connections to news-bbc.podzone[.]org or 80.248.65.183, which are the addresses of known command and control channels hardcoded into the Linux trojan. Admins can also build a signature using a tool called YARA that detects the strings "TREX_PID=%u" and "Remote VS is empty !"

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#55

Post by tedunangst »

gaadd33 wrote: post #53
tedunangst wrote: post #26

Earlier quoted context omitted.

Because you can't type a search string into the search box in explorer on windows?

The search box in explorer searches binaries these days? Honest question, I haven't used it in years. That seems like it would be pretty counterintuitive for users though. Someone tries to search for the string 'program' and it returns all binaries that have 'This program cannot be run in DOS mode' in them. (Which I think is pretty much all PE binaries)

I recall "search all files" looking inside pretty much everything, including exe and unknown file types. (it's been a while for me, too.)

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#56

Post by danieltillett »

etcet wrote: post #54
danieltillett wrote: post #49

Earlier quoted context omitted.

Where does this come from?

I can't confirm that it works but I was going off this: > Administrators who want to check for Turla-infected Linux systems can check outgoing traffic for connections to news-bbc.podzone[.]org or 80.248.65.183, which are the addresses of known command and control channels hardcoded into the Linux trojan. Admins can also build a signature using a tool called YARA that detects the strings "TREX_PID=%u" and "Remote VS i…

Thanks for this. Before I set off a search like this on my server I like to know why :)

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#57

Post by tptacek »

dmix wrote: post #52
tptacek wrote: post #38

It's a userland trojan and it's "one of the most complex APTs in the world"? One wonders what these people would think if they found MosDef in the wild.

I believe they mentioned the fact it couldn't be detected by netstat as an example of it's sophistication. idk how this got 127 upvotes.

The irony for me is that if you wrote a trojan that could only be detected by netstat I'd be boned, because I find netstat incomprehensible and tend to use tcpdump to solve those kinds of problems.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#58

Post by [deleted] »

jrochkind1 wrote: post #46

> Even a regular user with limited privileges can launch it, allowing it to intercept traffic and run commands on infected machines. Huh, how do they do that? > The underlying executable file is written in the C and C++ languages and contains code from previously written libraries, a property that gives the malicious file self-reliance. Does that mean something? I don't get it. I thought arstechnica usually was writt…

[deleted]

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#59

Post by usefulcat »

gizmo686 wrote: post #47
jrochkind1 wrote: post #46

> Even a regular user with limited privileges can launch it, allowing it to intercept traffic and run commands on infected machines. Huh, how do they do that? > The underlying executable file is written in the C and C++ languages and contains code from previously written libraries, a property that gives the malicious file self-reliance. Does that mean something? I don't get it. I thought arstechnica usually was writt…

> The underlying executable file is written in the C and C++ languages and contains code from previously written libraries, a property that gives the malicious file self-reliance. I think they mean that the executable is statically linked.

If they're going to use a description that probably sounds cryptic to average readers, they should at least use a description that's meaningful for the more technically knowledgeable.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#60

Post by gizmo686 »

tedunangst wrote: post #55
gaadd33 wrote: post #53

Earlier quoted context omitted.

The search box in explorer searches binaries these days? Honest question, I haven't used it in years. That seems like it would be pretty counterintuitive for users though. Someone tries to search for the string 'program' and it returns all binaries that have 'This program cannot be run in DOS mode' in them. (Which I think is pretty much all PE binaries)

I recall "search all files" looking inside pretty much everything, including exe and unknown file types. (it's been a while for me, too.)

I recall "search all files" only searching indexed folders, which by default leaves a lot of room for the virus to install itself somewhere that is not being search without even trying.
Post reply on HN