Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild

decoded.avast.io

Post reply on HN
Print view View original

41–50 of 56 posts

Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild

#41

Post by bombcar »

capableweb wrote: post #30
KronisLV wrote: post #12

Earlier quoted context omitted.

> Dev team is not interested in migrating OLDPRODUCT to a modern platform, or even try to put it in a container. Surely this wouldn't take more than 2 weeks: just figure out the install instructions for the old piece of software, rewrite them as a part of a Dockerfile (or similar set of instructions to build an OCI image, there are other options out there, too), setup some basic CI/CD which will execute Docker/Podman…

> Surely this wouldn't take more than 2 weeks Which, based on what previous commentator said, is just about 2 more weeks than anyone want to spend on it. If no one wants to do it, it doesn't matter if it takes 2 days or 2 months, it won't get done.

And if you take it upon yourself to try, suddenly you become the sole point of contact for anything that ever goes wrong with it from then on, even if it would have failed before the change.

Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild

#42

Post by bombcar »

semi-extrinsic wrote: post #5
sheepdestroyer wrote: post #4

Earlier quoted context omitted.

Comparatively, RHEL 6 is still kind of fine, at least it is still officially supported as virtualized OS in oVirt... We run a lot of CentOS 5 virtual machines (and some physical ones! ; and some RHEL4! , and a few Fedora core 8 and 4 !!!), with no end in sight... :( It is a huge concern for the Infra team, a source of many headaches, and we need to go through oops to keep them running, but: - Clients don't want to mo…

OT, but: why don't you just compile up an old php version from source on a new OS? It's a bit of a hassle the first time you do it, sure, but less than the hassle of running multiple legacy OS?

The legacy OS is even less hassle, because it never gets any updates and just sits there.

If you compile old software on a new OS, every single update to that OS has a chance to blow up your compiled old version, so it takes more hand-holding.

Can be worth it at times, but other times it's just easier to firewall and hope for the best.

Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild

#43

Post by jcalvinowens »

rollcat wrote: post #18

OpenBSD has removed loadable kernel modules back in 2014; macOS is aggressively moving in the same direction. Meanwhile - is running a Linux system without module support even viable these days? $ du -sh /lib/modules/$(uname -r) 294M /lib/modules/5.10.0-15-amd64

It's not that hard to run Linux without modules, I've been doing it on my laptop for a decade.

Just build the kernel and set the right options, this is for a Dell XPS13: https://github.com/jcalvinowens/misc/blob/main/kbuild/config...

It takes a few hours to whittle it down for a particular piece of hardware, but I've never broken anything on Debian by running kernels built with CONFIG_MODULE=n.

* Edited for clarity

Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild

#44

Post by bombcar »

2b3a51 wrote: post #16
KronisLV wrote: post #14

Earlier quoted context omitted.

I think that as long as the person remains mostly anonymous (personally I've no interest in digging further, for this exact reason), things like this need to be talked about. Sure, lying about some of the details while getting the gist across might be a good idea (e.g. naming a different OS when you actually have Ubuntu), but there definitely needs to be discourse about the circumstances that people are dealing with…

https://lwn.net/Articles/863008/ About 1 million CentOS 6 boxes of some description hitting the update servers as of July 2021. Compared with roughly 2 million on v7 and half a million on v8. Would be interesting to know how those percentages have changed since then.

This is one of the reasons why if we ever touch a box (say to update whatever it is doing) we also bring it to the latest possible version of the OS we can find; luckily for us CentOS exploded just before the last one, so we moved to Ubuntu instead of CentOS 8 which was our original plan.

Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild

#45

Post by alar44 »

jcalvinowens wrote: post #43
rollcat wrote: post #18

OpenBSD has removed loadable kernel modules back in 2014; macOS is aggressively moving in the same direction. Meanwhile - is running a Linux system without module support even viable these days? $ du -sh /lib/modules/$(uname -r) 294M /lib/modules/5.10.0-15-amd64

It's not that hard to run Linux without modules, I've been doing it on my laptop for a decade. Just build the kernel and set the right options, this is for a Dell XPS13: https://github.com/jcalvinowens/misc/blob/main/kbuild/config... It takes a few hours to whittle it down for a particular piece of hardware, but I've never broken anything on Debian by running kernels built with CONFIG_MODULE=n. * Edited for clarity

What is that and how is it used?

Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild

#46

Post by jcalvinowens »

alar44 wrote: post #45
jcalvinowens wrote: post #43

Earlier quoted context omitted.

It's not that hard to run Linux without modules, I've been doing it on my laptop for a decade. Just build the kernel and set the right options, this is for a Dell XPS13: https://github.com/jcalvinowens/misc/blob/main/kbuild/config... It takes a few hours to whittle it down for a particular piece of hardware, but I've never broken anything on Debian by running kernels built with CONFIG_MODULE=n. * Edited for clarity

What is that and how is it used?

Sorry that was really unclear, I edited. It's the kernel build configuration for my laptop, with module loading disabled. All the drivers are statically linked.

Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild

#47

Post by bombcar »

carlmr wrote: post #7
sheepdestroyer wrote: post #4

Earlier quoted context omitted.

Comparatively, RHEL 6 is still kind of fine, at least it is still officially supported as virtualized OS in oVirt... We run a lot of CentOS 5 virtual machines (and some physical ones! ; and some RHEL4! , and a few Fedora core 8 and 4 !!!), with no end in sight... :( It is a huge concern for the Infra team, a source of many headaches, and we need to go through oops to keep them running, but: - Clients don't want to mo…

>NEWPRODUCT that is seemingly never fully coming to production >- New clients are still regularly signed on OLDPRODUCT. I mean what's the WHY behind that? Why don't even new customers sign on to the new product? Why is the new product not in production? Is that the same reason?

NEWPRODUCT is almost always designed by Sales and OLDPRODUCT is old enough to have enough actual users that it works and does what is needed.

The end result is usually to force everyone to move to NEWPRODUCT and deprecate OLDPRODUCT violently (Salesforce Lightning vs Classic, etc, etc). Hopefully enough fixes for NEWPRODUCT get done before all the customers leave.

Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild

#48

Post by bombcar »

yjftsjthsd-h wrote: post #35
rollcat wrote: post #18

OpenBSD has removed loadable kernel modules back in 2014; macOS is aggressively moving in the same direction. Meanwhile - is running a Linux system without module support even viable these days? $ du -sh /lib/modules/$(uname -r) 294M /lib/modules/5.10.0-15-amd64

My impression is that Darwin did it by moving more drivers directly into user space. But yes, you can absolutely run Linux with everything statically compiled into the kernel as long as you're not using some handful of things that resist it (below comment mentions nvidia, ZFS). You can even run without an initial ramdisk if you're not doing RAID or ZFS or encrypted disks or something like that. Edit: I should mention…

I wonder if you can force the code to compile ZFS in, since the license problem is one of distribution not of user/runtime.

Ubuntu might not be able to distribute said "no module" kernel, but it might run.

Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild

#49

Post by bombcar »

Thaxll wrote: post #33
rollcat wrote: post #18

OpenBSD has removed loadable kernel modules back in 2014; macOS is aggressively moving in the same direction. Meanwhile - is running a Linux system without module support even viable these days? $ du -sh /lib/modules/$(uname -r) 294M /lib/modules/5.10.0-15-amd64

I'm not sure I understand, how OpenBSD load drivers then?

IIRC the *BSDs are much more likely to recompile the kernel and reboot if needed for new hardware, whereas most Linux distributions have gone the "build every possible driver in the world as a module, load as needed" route.

Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild

#50

Post by yjftsjthsd-h »

bombcar wrote: post #48
yjftsjthsd-h wrote: post #35

Earlier quoted context omitted.

My impression is that Darwin did it by moving more drivers directly into user space. But yes, you can absolutely run Linux with everything statically compiled into the kernel as long as you're not using some handful of things that resist it (below comment mentions nvidia, ZFS). You can even run without an initial ramdisk if you're not doing RAID or ZFS or encrypted disks or something like that. Edit: I should mention…

I wonder if you can force the code to compile ZFS in, since the license problem is one of distribution not of user/runtime. Ubuntu might not be able to distribute said "no module" kernel, but it might run.

I believe ZFS at least used to have an option to insert itself directly into a Linux source tree, in which case it would look just like a normal driver. I don't know if that still exists and I never tried it, but it was a thing. Note that you probably still need an initial ramdisk to get the userspace tools to actually bring a pool online if you're using it for root.

Edit: I'm having trouble finding it in the official documentation, but here's a page that describes how to do it on an old version: https://slackwiki.com/ZFS_root_(builtin) and here's what looks like a script to do that on the current tip of master: https://github.com/openzfs/zfs/blob/master/copy-builtin

Post reply on HN