Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Powerful, highly stealthy Linux trojan may have infected victims for years

arstechnica.com

Post reply on HN
Print view View original

21–30 of 103 posts

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#21

Post by tedunangst »

0x0 wrote: post #18
tedunangst wrote: post #16

Earlier quoted context omitted.

LD_PRELOAD? ptrace? Updated: Actually, I have no idea. The securelist link says "It uses techniques that don't require root access" but then later says "The module statically links PCAP libraries, and uses this code to get a raw socket". I have no idea how one gets a raw socket without root, but I'm not in the business of creating raw sockets on linux...

Not sure I follow, can a non-root user observe raw packets (like SYN packets and sequence numbers) through these facilities? Edit: well, a statically linked pcap is still just a bunch of user-mode assembly code. I didn't think linux kernel security hinged on keeping libraries secret :P

I tried interpreting the ars article (rookie mistake) and assumed it was stealing traffic from other programs running as the same user.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#22

Post by 0x0 »

tedunangst wrote: post #21
0x0 wrote: post #18

Earlier quoted context omitted.

Not sure I follow, can a non-root user observe raw packets (like SYN packets and sequence numbers) through these facilities? Edit: well, a statically linked pcap is still just a bunch of user-mode assembly code. I didn't think linux kernel security hinged on keeping libraries secret :P

I tried interpreting the ars article (rookie mistake) and assumed it was stealing traffic from other programs running as the same user.

Aha, now I see why you brought up ptrace.

But they were talking about magic syn packets etc (in the securelist post linked from another comment, I got the sources mixed up)

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#24

Post by foxylad »

etcet wrote: post #20
codezero wrote: post #2

Is there a quick and dirty script/one liner I can run to check my VPS right now?

This may take a while depending on the amount of data you have and the speed of your disk(s): grep -R -e 'TREX_PID=%u' -e 'Remote VS is empty !' / Alternatively you could create ClamAV signatures based on those strings.

Thanks.

Being able to provide simple easily verified command on a public forum to detect the most stealthy malware is testament to the brilliant design of unix-style systems. If someone offered a Widows utility to do the same thing on a forum, only fools would run it.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#26

Post by tedunangst »

foxylad wrote: post #24
etcet wrote: post #20

Earlier quoted context omitted.

This may take a while depending on the amount of data you have and the speed of your disk(s): grep -R -e 'TREX_PID=%u' -e 'Remote VS is empty !' / Alternatively you could create ClamAV signatures based on those strings.

Thanks. Being able to provide simple easily verified command on a public forum to detect the most stealthy malware is testament to the brilliant design of unix-style systems. If someone offered a Widows utility to do the same thing on a forum, only fools would run it.

Because you can't type a search string into the search box in explorer on windows?

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#27

Post by mahouse »

wjoe wrote: post #25

"It can't be detected using the common netstat command." How is this possible? I thought netstat would show any program which is listening for connections on a port, regardless of whether it's actively doing anything.

From what the article says (and it's not very concise as you can see) it's not listening for connections, or at least it's not listening for connections until it's "awoken" by something external.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#28

Post by gizmo686 »

wjoe wrote: post #25

"It can't be detected using the common netstat command." How is this possible? I thought netstat would show any program which is listening for connections on a port, regardless of whether it's actively doing anything.

Assuming the trojan has a rootkit, it can patch the kernel so that netstat does not report it.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#29

Post by renaudg »

click170 wrote: post #11
SEJeff wrote: post #8

Earlier quoted context omitted.

One kind of neat thing I do is filter outbound traffic based on the user. If you're using s newish distro like centos7/rhel7 or a newer ubuntu, you can filter packets with ip tables based on the user. I force the apps in various docker containers to run as different users (one per major app or major suite of apps), and use up tables to lock those bits down. My wordpress got owned and there was a little perl script at…

I really like this idea. I'm trying to take it one step further in fact. My filtering is done at the gateway, and I'm hunting for ways of communicating which packets are associated with which users (on Linux and Mac). Probably done by tagging an unused part of the packet with some kind of ID.

The DSCP field is a good candidate for that.

Re: Powerful, highly stealthy Linux trojan may have infected victims for years

#30

Post by renaudg »

wjoe wrote: post #25

"It can't be detected using the common netstat command." How is this possible? I thought netstat would show any program which is listening for connections on a port, regardless of whether it's actively doing anything.

The program doesn't set up a listening socket (which would show up in netstat), it's doing what is normally the kernel's job (analyzing traffic on the interface and parsing IP packets) all by itself in userspace.
Post reply on HN