Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Powerful, highly stealthy Linux trojan may have infected victims for years

arstechnica.com

Post reply on HN
Print view View original

91–100 of 103 posts

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#91

Post by mobiplayer »

click170 wrote: post #42
chronomex wrote: post #15

Earlier quoted context omitted.

Maybe with VLAN tagging?

I like this idea. It does assume that a user can't set the vlan themselves but my switches support this and I think it would be really cool to have segregated networks for different levels of user trust.

Guys, calm down! This has been applied for ages and it's networking 101. Heck, it's the freaking 'hello world' :-)

And actually a user can tag his packets, but the security is applied at the switch level, where you can just strip it and add yours. Too bad that means it is not per user, but per switch port... although you may leverage 802.1x... ok, this is getting complex :-)

Easier: Block all outgoing traffic, except for an authenticated proxy where every user/app has to go through in order to reach the internet.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#92

Post by dmix »

acdha wrote: post #78
dmix wrote: post #52

Earlier quoted context omitted.

I believe they mentioned the fact it couldn't be detected by netstat as an example of it's sophistication. idk how this got 127 upvotes.

I share your snarky reaction but a more depressing way of looking at it is to remember that these are using ancient techniques and are still infecting large numbers of systems. It's not true that the last couple decades have made no progress but it's somewhat sobering that the bar for successful attacker is still set this low…

> last couple decades have made no progress

Who has made no progress?

Malware forensic experts are not using netcat to detect malware nor are sysadmins. There are plenty of more modern techniques.

The problem is no one has cared about security (especially gov, many big corps) until recently...not that the toolsets have been weak. Which is why all the news this year is coming out because they decided to finally check if they've been compromised for the first time.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#93

Post by acdha »

dmix wrote: post #92
acdha wrote: post #78

Earlier quoted context omitted.

I share your snarky reaction but a more depressing way of looking at it is to remember that these are using ancient techniques and are still infecting large numbers of systems. It's not true that the last couple decades have made no progress but it's somewhat sobering that the bar for successful attacker is still set this low…

> last couple decades have made no progress Who has made no progress? Malware forensic experts are not using netcat to detect malware nor are sysadmins. There are plenty of more modern techniques. The problem is no one has cared about security (especially gov, many big corps) until recently...not that the toolsets have been weak. Which is why all the news this year is coming out because they decided to finally check…

Note that I actually said it's not true that there's been no progress.

My point, rather, was that progress has been unevenly distributed so there's a disturbingly large range in practice: it's certainly true that actual experts are not using netstat to detect malware but it's also true that most system administration is not performed by security experts. The same places which waited until this spring to upgrade from Windows XP or where security updates are blocked behind long review processes also tend to be the places where someone learned how to use netstat 20 years ago and doesn't want to learn a new skill.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#94

Post by acdha »

jethro_tell wrote: post #87
acqq wrote: post #68

Earlier quoted context omitted.

"Normal" web page of today makes unbelievable number of connections to different CDN destinations. As soon as you browse the internet "normally" on the same machine, you'd spend maybe an order of magnitude more to analyze the traffic than to consume the content. The solution would be not to browse the internet at all from the computers which aren't in the DMZ, like the military (hopefully) does.

First, you'll do your filtering on a different box. If someone has root, it's really easy to change the firewall on the box. Also trivial to delete your logs before they are scanned. You also don't want to be doing IDS work on your end clients. >"Normal" web page of today makes unbelievable number of connections to different CDN destinations. As soon as you browse the internet "normally" on the same machine, you'd sp…

How would you distinguish between e.g. an HTTPS request to a CloudFlare IP for a legitimate blog comment and one for a throwaway blog being used for C&C?

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#95

Post by jethro_tell »

acdha wrote: post #94
jethro_tell wrote: post #87

Earlier quoted context omitted.

First, you'll do your filtering on a different box. If someone has root, it's really easy to change the firewall on the box. Also trivial to delete your logs before they are scanned. You also don't want to be doing IDS work on your end clients. >"Normal" web page of today makes unbelievable number of connections to different CDN destinations. As soon as you browse the internet "normally" on the same machine, you'd sp…

How would you distinguish between e.g. an HTTPS request to a CloudFlare IP for a legitimate blog comment and one for a throwaway blog being used for C&C?

One HTTPS packet? You won't know. But when you add context you can start to understand what traffic is legit. There's really no silver bullet for security, but with a combination of restrictions and data collection, you can raise the bar on the type of attack that can go undetected.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#96

Post by acqq »

jethro_tell wrote: post #95
acdha wrote: post #94

Earlier quoted context omitted.

How would you distinguish between e.g. an HTTPS request to a CloudFlare IP for a legitimate blog comment and one for a throwaway blog being used for C&C?

One HTTPS packet? You won't know. But when you add context you can start to understand what traffic is legit. There's really no silver bullet for security, but with a combination of restrictions and data collection, you can raise the bar on the type of attack that can go undetected.

Do try to do it and tell us how many different servers were connected in just one web surfing session where you visit all the sites you visit in one day.

I can give you an example of a single page: I've just opened www.yahoo.com and counted 23 https connections and 7 http to different IP adresses. I've removed the multiple connections to the same IP from this count which would otherwise be bigger. Two of those doesn't even have reverse DNS entry.

Then think about the fact that the malware regularly appears in the content of the otherwise "approved" adds. You just don't have the metadata to recognize those.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#97

Post by jethro_tell »

acqq wrote: post #96
jethro_tell wrote: post #95

Earlier quoted context omitted.

One HTTPS packet? You won't know. But when you add context you can start to understand what traffic is legit. There's really no silver bullet for security, but with a combination of restrictions and data collection, you can raise the bar on the type of attack that can go undetected.

Do try to do it and tell us how many different servers were connected in just one web surfing session where you visit all the sites you visit in one day. I can give you an example of a single page: I've just opened www.yahoo.com and counted 23 https connections and 7 http to different IP adresses. I've removed the multiple connections to the same IP from this count which would otherwise be bigger. Two of those doesn'…

Yeah I'm not sure I understand your point. I understand that web surfing generates a ton of connections and I don't think that you can pick a packet out of the pile and say that one is the bad one. I've made that fairly clear. I don't even think we disagree. So I'm confused about what you're trying to get at?

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#98

Post by Bill_Dimm »

etcet wrote: post #20
codezero wrote: post #2

Is there a quick and dirty script/one liner I can run to check my VPS right now?

This may take a while depending on the amount of data you have and the speed of your disk(s): grep -R -e 'TREX_PID=%u' -e 'Remote VS is empty !' / Alternatively you could create ClamAV signatures based on those strings.

This seems to get stuck for me after a few minutes (grep stops taking up CPU cycles). I thought maybe it was getting stuck trying to read something it shouldn't, but lsof gives no clues.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#99

Post by acdha »

jethro_tell wrote: post #95
acdha wrote: post #94

Earlier quoted context omitted.

How would you distinguish between e.g. an HTTPS request to a CloudFlare IP for a legitimate blog comment and one for a throwaway blog being used for C&C?

One HTTPS packet? You won't know. But when you add context you can start to understand what traffic is legit. There's really no silver bullet for security, but with a combination of restrictions and data collection, you can raise the bar on the type of attack that can go undetected.

The problem is that this rapidly becomes unworkable for all but the smallest of networks with a huge amount of available time. False positives make this contest incredibly asymmetrical – ever think about how many hours went into developing IDS rulesets looking for malware signatures which were obsolete once people switched from IRC to HTTP? That repeated for HTTP to HTTPS, detecting “unusual” networks rapidly became ineffective as throwaway accounts or compromised hosts became popular, etc.

That process will repeat for every single bit of context you add. The worst case scenario for this is full-on steganography – public blogs posting scraped content with commands hidden in images or text statistics, bots searching twitter or subscribing to RSS feeds, etc. and waiting for user-triggered network activity before transmitting so it looks like just one more request in the 100+ made by a modern webpage.

For anything other than preventing DDoS attacks this is a slow, futile grind. It's much more effective to focus on preventing an attacker from running code inside your network than trying to clean up the mess after they do so. That's a combination of things like changing the UI to avoid asking the user to make critical security decisions they can't meaningfully answer and, most likely, an app-store like model for most people because even that level of review greatly exceeds what a non-expert can do.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#100

Post by acqq »

jethro_tell wrote: post #97
acqq wrote: post #96

Earlier quoted context omitted.

Do try to do it and tell us how many different servers were connected in just one web surfing session where you visit all the sites you visit in one day. I can give you an example of a single page: I've just opened www.yahoo.com and counted 23 https connections and 7 http to different IP adresses. I've removed the multiple connections to the same IP from this count which would otherwise be bigger. Two of those doesn'…

Yeah I'm not sure I understand your point. I understand that web surfing generates a ton of connections and I don't think that you can pick a packet out of the pile and say that one is the bad one. I've made that fairly clear. I don't even think we disagree. So I'm confused about what you're trying to get at?

In my opinion the arguments you give, specifically "I'm not advocating Deep Packet Inspection here" and "one HTTPS packet? You won't know. But when you add context you can start to understand what traffic is legit" aren't based on your actual knowledge but just a plain guess. Therefore I give you a specific example of just one page.

Moreover, observing "the packet" independent of the connection of course doesn't have sense. But it's you who talk about the single packets, I've given you an example of 30 connections, where each has hundreds of packets. Even observing just the connections as the connections, you can't know which ones are potentially malign unless you analyze their content.

Post reply on HN