Sophisticated OS X Backdoor Discovered • Hacker News Board

Re: Sophisticated OS X Backdoor Discovered

#121

Post by manarth » Fri, Sep 09, 2016, 12:07 AM UTC

darylteo wrote: post #112

manarth wrote: post #108

Not sure whether to be amused, vindicated, or concerned that the most prominent conversation here on HN is terminology: "Is 'backdoor' the correct term?" Malware, trojan, virus, rootkit, backdoor, squirglebunny (OK, I may have made that last one up). There's not a lot of talk about the threat vector though - does anyone know how this infects systems?

> After its first execution, the binary checks its own file path and ... From the article it seems to be via executable. That's why the terminology is important in this case. It's a executable rootkit that opens a backdoor, not a OS remote execution exploit. And this article relates to the OS X variant of a cross-platform package (so this affects Windows and Linux systems as well).

> "It's a executable rootkit"

I hate to join in the terminology argument, but is it really a rootkit? After all, it doesn't (according to the reports) disguise its presence, which discards "rootkit" as a classification.

It seems to be pretty much run-of-the-mill malware. It would be interesting to understand the delivery mechanism (email, or whatever).

And if people will install untrusted third-party software, delivered by an untrustworthy mechanism, then they inevitably accept a certain amount of exposure.

Re: Sophisticated OS X Backdoor Discovered

#122

Post by oso2k » Fri, Sep 09, 2016, 12:14 AM UTC

superuser2 wrote: post #92

throwaway76543 wrote: post #43

Earlier quoted context omitted.

No, Kaspersky Labs is using correct terminology. Some rootkits install a backdoor. Not all rootkits install a backdoor -- some merely conceal themselves and operate locally. The famous Sony Rootkit is one such example of a rootkit which did not add a backdoor. The defining characteristic of a rootkit is that it conceals its presence from the rest of the system. Backdoor.OSX.Mokes.a doesn't really do this -- it's only…

Backdoor is a politically loaded term at this point. Backdoors (in privacy-related discourse) are vulnerabilities inserted intentionally by the manufacturer or government with supply-chain cooperation. The claim "Backdoor found in X's product" is roughly equivalent to the claim "Evidence found that X is a collaborator with the surveillance state" to many people, so we might want to be careful about throwing it around…

At least for me, there is a distinction between a Phone Home capability and a Backdoor.

Re: Sophisticated OS X Backdoor Discovered

#123

Post by cmdrfred » Fri, Sep 09, 2016, 12:27 AM UTC

caf wrote: post #113

stcredzero wrote: post #83

Earlier quoted context omitted.

rootkit comes from unix, it was a tool helping to restore admin privileges even after the admin found that the host was hacked (that's where the name comes from root = admin on unix). Its goal was to be invisible. Are you sure? It also commonly referred to such kits being used by hostile parties. I've personally interrupted an attempt at installing the "Hungarian Rootkit" in the 90's. (I put unpatched Red Hat 6 onlin…

Right. a "rootkit" was a kit of tools you deploy once you have obtained root (on someone else's server).

I always thought of them as a way to gain root. As in privilege escalation.

Re: Sophisticated OS X Backdoor Discovered

#124

Post by mwfunk » Fri, Sep 09, 2016, 12:33 AM UTC

AWildDHHAppears wrote: post #70

chairmanwow wrote: post #69

Earlier quoted context omitted.

This reply is a piece of art.

I think he's paid by Apple.

I'm pretty sure AWildDHHAppears was being satirical, please don't downvote him/her.

Re: Sophisticated OS X Backdoor Discovered

#125

Post by detaro » Fri, Sep 09, 2016, 12:33 AM UTC

cmdrfred wrote: post #123

caf wrote: post #113

Earlier quoted context omitted.

Right. a "rootkit" was a kit of tools you deploy once you have obtained root (on someone else's server).

I always thought of them as a way to gain root. As in privilege escalation.

A rootkit might come with tools for that, but the actual rootkit generally requires you having root (or some other privileged role) to deploy it. E.g. a Linux rootkit commonly is a kernel module, which you can only load if you have already obtained root privileges.

Re: Sophisticated OS X Backdoor Discovered

#126

Post by mwfunk » Fri, Sep 09, 2016, 12:35 AM UTC

mxvzr wrote: post #106

mwfunk wrote: post #58

Earlier quoted context omitted.

Me saying this is downvote-worthy in itself and I'll gladly take my lumps because I'm only adding to the noise, but let's break this down: (1) You claim that because someone wrote malware that requires root access to install, but can't be used to get root access to a system in the first place, that the vendor who makes that system should no longer publicly state (in their marketing materials no less) that they care a…

To anyone, like me, who might be wondering what happened on September 1993: I assume it is in reference to this https://en.wikipedia.org/wiki/Eternal_September

Sorry, you are correct! That's exactly what I was referring to.

Re: Sophisticated OS X Backdoor Discovered

#127

Post by [deleted] » Fri, Sep 09, 2016, 1:40 AM UTC

mwfunk wrote: post #58

yuja_wang wrote: post #16

Earlier quoted context omitted.

They still say it! On a page on their website in 2016. And their paid AstroTurfers are here on hn, with the downvotes.

Me saying this is downvote-worthy in itself and I'll gladly take my lumps because I'm only adding to the noise, but let's break this down: (1) You claim that because someone wrote malware that requires root access to install, but can't be used to get root access to a system in the first place, that the vendor who makes that system should no longer publicly state (in their marketing materials no less) that they care a…

[deleted]

Re: Sophisticated OS X Backdoor Discovered

#128

Post by saurik » Fri, Sep 09, 2016, 2:08 AM UTC

superuser2 wrote: post #92

throwaway76543 wrote: post #43

Earlier quoted context omitted.

No, Kaspersky Labs is using correct terminology. Some rootkits install a backdoor. Not all rootkits install a backdoor -- some merely conceal themselves and operate locally. The famous Sony Rootkit is one such example of a rootkit which did not add a backdoor. The defining characteristic of a rootkit is that it conceals its presence from the rest of the system. Backdoor.OSX.Mokes.a doesn't really do this -- it's only…

Backdoor is a politically loaded term at this point. Backdoors (in privacy-related discourse) are vulnerabilities inserted intentionally by the manufacturer or government with supply-chain cooperation. The claim "Backdoor found in X's product" is roughly equivalent to the claim "Evidence found that X is a collaborator with the surveillance state" to many people, so we might want to be careful about throwing it around…

That is different wording. One can find an OS X backdoor in Microsoft Word, for example. Here the OS X backdoor was found not in OS X but in some other program.

Re: Sophisticated OS X Backdoor Discovered

#129

Post by jdmichal » Fri, Sep 09, 2016, 2:52 AM UTC

woodman wrote: post #120

jdmichal wrote: post #109

Earlier quoted context omitted.

Regardless, the point of a rootkit is to provide an execution context with escalated privileges. Whether that means root user, kernel space, System user is I would think depends on the specific rootkit. (Whose name, of course, points to "root" privileges.) Which was my original definition and is inline with the posted definition from Wikipedia.

Well I guess we won't come to an agreement, because it seems that whatever reason you prefer a very loose definition. For example, you just couldn't help yourself in confusing the privilege escalation point: "...context with escalated privileges." The rootkit isn't escalating anything, in the same way that LKMs, bootloaders, tracetools, or drivers don't escalate - it executes at or below its own privilege level.

I'm obviously not communicating my point well. Let's try this:

A backdoor executes in a remote machine. It allows attackers to access that machine.

A rootkit executes in a "remote" privileged context. It allows attackers to access that privileged context. It's in this context that I refer to escalation; it allows the attacker in a non-priviledged context access to a privileged context; aka escalation. And yes, the actual escalation already happened in the past, when the rootkit was installed. However, a non-priviledged user is still gaining illicit access to a privileged context at the moment that the rootkit is utilized.

Also, at this point I think we're splitting semantic hairs that don't really matter, aside from pedantry.

Re: Sophisticated OS X Backdoor Discovered

#130

Post by woodman » Fri, Sep 09, 2016, 4:35 AM UTC

jdmichal wrote: post #129

woodman wrote: post #120

Earlier quoted context omitted.

Well I guess we won't come to an agreement, because it seems that whatever reason you prefer a very loose definition. For example, you just couldn't help yourself in confusing the privilege escalation point: "...context with escalated privileges." The rootkit isn't escalating anything, in the same way that LKMs, bootloaders, tracetools, or drivers don't escalate - it executes at or below its own privilege level.

I'm obviously not communicating my point well. Let's try this: A backdoor executes in a remote machine. It allows attackers to access that machine. A rootkit executes in a "remote" privileged context. It allows attackers to access that privileged context. It's in this context that I refer to escalation; it allows the attacker in a non-priviledged context access to a privileged context; aka escalation. And yes, the ac…

Well I do appreciate you trying, but I disagree with you that it is pedantry that doesn't matter. This conversation is the best possible example of why we can't allow the corruption of previously well defined words - it causes confusion for no good reason.

A backdoor doesn't need to be remote and the user isn't necessarily an attacker. It is simply a secret method of access that the designer put in place, it isn't designed for end-user use. It is almost always security through obscurity, and it is always a bad idea. It can be activated in a variety of ways: port knocking, hardcoded passwords, preinstalled remote software, shorting ground to some magic pin, an undocumented serial terminal, etc.

A rootkit doesn't need to be remote and the user isn't necessarily an attacker. It doesn't need to have any functionality for user interaction - which means no "escalation" occurs (It could simply scan memory for passwords and log them to a file). It runs above user space, and can therefor be completely hidden (but it isn't always, see DTrace). It runs with the same privileges as the OS that it is part of. That is important to keep in mind, the rootkit becomes part of the running OS - that could mean any of the OSes running in your tower (CPU, HD firmware, BIOS, etc).

Your definitions work fine in a vacuum, but they quickly fall apart in real world usage. For example, by your definition: a remotely accessible privileged service is a rootkit, because an unprivileged internet user can interact with it - accessing data and executing code in the service's privileged context. 'sudo nginx' is not a rootkit.