Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Powerful, highly stealthy Linux trojan may have infected victims for years

arstechnica.com

Post reply on HN
Print view View original

81–90 of 103 posts

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#81

Post by debacle »

annnnd wrote: post #66

I can't shake the feeling that current security measures are designed in the wrong way. Antiviruses are fundamentally flawed (blacklist instead of whitelist; mostly curing instead of preventing). Filtering traffic is difficult (it is relatively easy to hide information in heavy legitimate traffic). Maybe the way ahead is in ensuring that files (and images in memory, flash,...) don't get changed. Maybe we should have…

Microsoft has tried to do security in the way you have mentioned. It only pisses pleb users off, and power users don't really need it.

The real solution is not in prevention but in recovery. If the recovery option is easy and fast, then prevention doesn't really matter - detection and recovery will be key.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#82

Post by growupkids »

debacle wrote: post #81
annnnd wrote: post #66

I can't shake the feeling that current security measures are designed in the wrong way. Antiviruses are fundamentally flawed (blacklist instead of whitelist; mostly curing instead of preventing). Filtering traffic is difficult (it is relatively easy to hide information in heavy legitimate traffic). Maybe the way ahead is in ensuring that files (and images in memory, flash,...) don't get changed. Maybe we should have…

Microsoft has tried to do security in the way you have mentioned. It only pisses pleb users off, and power users don't really need it. The real solution is not in prevention but in recovery. If the recovery option is easy and fast, then prevention doesn't really matter - detection and recovery will be key.

How would you recover if the intent of the attack was to ex filtrate something, say payment information?

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#83

Post by orbifold »

dsl wrote: post #72
semenko wrote: post #4

Details via: https://securelist.com/blog/research/67962/the-penquin-turla... Notably, the C&C domain has been sinkholed by Kaspersky. This has been linked to the complex "Turla" industrial espionage malware, as it shares a C&C server. (Turla: http://securelist.com/analysis/publications/65545/the-epic-t... )

The Turla malware sends data back using PHP proxies running on hacked servers. The same PHP proxy script is used by MiniDuke. MiniDuke in turn screams Russia in its target selection and spear phishing related to the Ukrainian bid to join NATO.

The Ukraine is trying to join NATO? That seems like a recipe for disaster, why not let Russia have a buffer zone of countries it controls..

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#84

Post by debacle »

growupkids wrote: post #82
debacle wrote: post #81

Earlier quoted context omitted.

Microsoft has tried to do security in the way you have mentioned. It only pisses pleb users off, and power users don't really need it. The real solution is not in prevention but in recovery. If the recovery option is easy and fast, then prevention doesn't really matter - detection and recovery will be key.

How would you recover if the intent of the attack was to ex filtrate something, say payment information?

I only meant for my statement to apply to consumer devices. Servers are a completely different matter, and IMHO you should never store that kind of data on a laptop or desktop. That's what VPNs are for.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#85

Post by snowwrestler »

growupkids wrote: post #82
debacle wrote: post #81

Earlier quoted context omitted.

Microsoft has tried to do security in the way you have mentioned. It only pisses pleb users off, and power users don't really need it. The real solution is not in prevention but in recovery. If the recovery option is easy and fast, then prevention doesn't really matter - detection and recovery will be key.

How would you recover if the intent of the attack was to ex filtrate something, say payment information?

The financial system is great at recovering from that sort of thing.

1) Transactions have to reconcile somewhere--monitor at that point for unexpected activity.

2) Use insurance policies to pay back losses due to theft.

Payment info is among the data I worry about the least; I check my card statements every month, and flag any unknown activity. Under my card and bank agreements, I'm not liable for losses if I catch them within the defined window (30-60 days depending on card), even if I did something stupid like set a weak password or lose my own wallet.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#86

Post by jerf »

0x0 wrote: post #19
jerf wrote: post #17

Earlier quoted context omitted.

In addition to tedunagnst, as we're talking malware, consider also "kernel exploits". Even if the malware doesn't ship with an exploit, a normal UNIX user has enough privs to examine the kernel version and download and execute code that may exploit the given kernel.

That's slightly less interesting. If you gain root then there's not much to it for dumping packets or hiding processes and open files and sockets or anything, really. Why would the article highlight "intercept network packets as a non-root user" of all things (paraphrased)

My words "in addition to" were not extraneous.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#87

Post by jethro_tell »

acqq wrote: post #68
jethro_tell wrote: post #36

Earlier quoted context omitted.

Outbound filtering is great but easily beaten with a mild level of sophistication. The addition of outbound monitoring and analysis is gold. What kind if dns requests am I making how many per hour? how many per page load? how many per domain? What do my flows look like? Do i have DNS flows that last an hour? http connections that serve twice the normal data as my normal page load? http connectionsreturned per domain.…

"Normal" web page of today makes unbelievable number of connections to different CDN destinations. As soon as you browse the internet "normally" on the same machine, you'd spend maybe an order of magnitude more to analyze the traffic than to consume the content. The solution would be not to browse the internet at all from the computers which aren't in the DMZ, like the military (hopefully) does.

First, you'll do your filtering on a different box. If someone has root, it's really easy to change the firewall on the box. Also trivial to delete your logs before they are scanned. You also don't want to be doing IDS work on your end clients.

>"Normal" web page of today makes unbelievable number of connections to different CDN destinations. As soon as you browse the internet "normally" on the same machine, you'd spend maybe an order of magnitude more to analyze the traffic than to consume the content.

This is not really true. I'm not advocating Deep Packet Inspection here. I'm talking about taking a look at per flow stats and setting a baseline for your network. In this case, you wouldn't be processing each packet in real time, just looking at the metadata. To be honest I don't really want to know what's in each packet that comes out of my networks. I do want to have a baseline and look for anomalies.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#88

Post by keypusher »

billyhoffman wrote: post #79
Maakuth wrote: post #63

Earlier quoted context omitted.

>> Even a regular user with limited privileges can launch it, allowing it to intercept traffic and run commands on infected machines. >Huh, how do they do that? They must have some pretty powerful zero-day vulnerability they're exploiting. Expect patches.

Except a few paragraphs up they say: "The trojan is able to run arbitrary commands even though it requires no elevated system privileges" This is just a terribly written article. Few if any tech details, and any tech language just doesn't make sense/contradicts itself. Sadly The this is another example of a larger downward trend in the quality of articles on Ars. They should use some of that sweet Conde Nast money an…

I think they must be talking about privilege escalation via an undisclosed vulnerability. It "requires no elevated system privileges" to run, but if it is running arbitrary commands, it must have gotten those privileges somehow.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#89

Post by agumonkey »

annnnd wrote: post #66

I can't shake the feeling that current security measures are designed in the wrong way. Antiviruses are fundamentally flawed (blacklist instead of whitelist; mostly curing instead of preventing). Filtering traffic is difficult (it is relatively easy to hide information in heavy legitimate traffic). Maybe the way ahead is in ensuring that files (and images in memory, flash,...) don't get changed. Maybe we should have…

Well, just when we discussed that : https://news.ycombinator.com/item?id=8723693

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#90

Post by dsl »

orbifold wrote: post #83
dsl wrote: post #72

Earlier quoted context omitted.

The Turla malware sends data back using PHP proxies running on hacked servers. The same PHP proxy script is used by MiniDuke. MiniDuke in turn screams Russia in its target selection and spear phishing related to the Ukrainian bid to join NATO.

The Ukraine is trying to join NATO? That seems like a recipe for disaster, why not let Russia have a buffer zone of countries it controls..

http://en.wikipedia.org/wiki/Ukraine%E2%80%93NATO_relations
Post reply on HN