171–180 of 183 posts
Earlier quoted context omitted.
You could set argv[0] too: $ perl -e '$0="/usr/sbin/httpd";fork or sleep 1000';ps
What does it do?
It's not completely reliable but most people wouldn't look that deep anyway.
Earlier quoted context omitted.
I know I'm not at all the first to say this, but those "curl into sh" installers are just such terrible ideas in general, and typically inconvenient and brittle as well. I hate the idea of any arbitrary, unknown side-effects happening to my system. Providing an archive `.deb`, `.rpm`, etc is at least more convenient and predictable so it can be installed like a normal package by your package manager (although it does…
> I know I'm not at all the first to say this, but those "curl into sh" installers are just such terrible ideas in general, and typically inconvenient and brittle as well. They're fine for security and super convenient. I get why it's so popular - packaging and publishing debs is often going to be a lot more work, and now you're in the world of either maintaining a package repo or having to deal with an official one.
Creating a baseline .deb file takes at most 10 minutes if you know what you're doing. To know what you're doing, you need to spend ~2 hours once.
It's not rocket science (finding the documentation is tbh). :)
This isn't my area of expertise but ... where did they find this? >On March 25, 2021, 360 NETLAB's BotMon system flagged a suspiciousELF file (MD5=64f6cfe44ba08b0babdd3904233c4857) with 0 VT detection, the sample communicates with 4 domains on TCP 443 (HTTPS), but the traffic is not of TLS/SSL. A close look at the sample revealed it to be a backdoor targeting Linux X64 systems, a family that has been around for at le…
BotMon is a "DDoS botnet C2 command tracking system". So I guess they're doing some kind of traffic analysis. https://ddosmon.net/faq doesn't say much. "0 VT detection" means that no virus scan on VirusTotal detected it. The ZDNet article is a little more informative with regard to the terms: https://www.zdnet.com/article/rotajakiro-a-linux-backdoor-th...
Earlier quoted context omitted.
> unless you’re the sort of person who reads configure scripts and makefiles I always read these files before building from source. Is this really so rare? Why wouldn't people read the scripts they're about to run? > the various scripts inside Debian packages and RPMs It's reasonable to assume package repository maintainers have ensured their packages are not malicious.
But, we’re talking about installing software from non-distribution sources. E.g. the Minecraft Launcher ships as a .deb that you install: there’s no benefit security-wise for that over curl … | sh And, I doubt most people have the time or ability to read all the scripts that come with large software packages and ensure that they’re safe. For better or worse, executing code downloaded from the internet without verifyi…
Earlier quoted context omitted.
curl'ing is not the same at all as running, say, a Debian apt-get install. You apt-get signed packages coming from official mirrors (at least I do). Most of the Debian packages, by very far, are also fully deterministic and reproducible. If someone serves a backdoored package, that's probably incredibly noisy, leaving lots of traces everywhere and evidence can be gathered. When you curl, there's no way to know if you…
In this context we’re not talking about .debs from an official repository PPAs and debs downloaded from a GitHub release page have all the same problems as curl | sh
Earlier quoted context omitted.
I'm skeptical since you spelled it "herd" (or maybe auto-correct strikes again.) But yeah, keeping your system free from the systemd cancer has always been a good idea.
Pretty sure they are referring to herd and shepherd: https://www.gnu.org/software/shepherd/manual/html_node/herd-...
I know you are not supposed to blanket block foreign IP's, but I often do that and it seems to knock down a fair bit of crap. Also saves you from inadvertently messing up GPDR. Where does this stuff C2 back to / come from?
176.107.176.16 DeltaHost - VPS, VDS, dedicated servers in Ukraine & Netherlands
Earlier quoted context omitted.
> I know I'm not at all the first to say this, but those "curl into sh" installers are just such terrible ideas in general, and typically inconvenient and brittle as well. They're fine for security and super convenient. I get why it's so popular - packaging and publishing debs is often going to be a lot more work, and now you're in the world of either maintaining a package repo or having to deal with an official one.
> packaging and publishing debs is often going to be a lot more work Creating a baseline .deb file takes at most 10 minutes if you know what you're doing. To know what you're doing, you need to spend ~2 hours once. It's not rocket science (finding the documentation is tbh). :)
Earlier quoted context omitted.
> On Windows, using the equivalent of LD_PRELOAD makes all the antiviruses go crazy. There is no such thing on modern-day Windows. There used to be AppInit DLLs, but that 'feature' was broken to a degree that no legitimate application would have used it anyways and it likely wasn't a malware author's first choice either. Further, by the time you place a backdoor such as this, you would have neutralized any antivirus…
Does dropping a DLL in the same directory as the executable not work anymore?