Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RotaJakiro: A long live secret backdoor with 0 VT detection

blog.netlab.360.com

Post reply on HN
Print view View original

51–60 of 183 posts

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#51

Post by spookthesunset »

cyberpunk wrote: post #16

This is pretty cool, but I keep waiting until someone finds a horribly malicious version of bash that hides processes, directories and so on unless you have a specific env var set.. It could even detect when you do a update and just copy itself back over the new version, since almost all updates are being applied under a shell somewhere (may need a malicious python also then..)

Back in my younger days... I’ve had boxes hacked through bugs in bind or sendmail. The hacker would cover their tracks with replacements of “ps”, “ls” and such that attempted to cover their tracks. Good times.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#52

Post by dathinab »

chrisbrandow wrote: post #40

It’s not clear to a non-systems person, me specifically, whether this is something that was added to Linux code base itself, or as a virus-like file that was added and has spread.

The article didn't say anything of it being added to any code base, so no.

It's just another "backdoor" which had been installed by a hacker or malware. (Backdoor doesn't mean it's build into existing systems, it means it gives you access to a system through a unintended path. Most backdoors are installed by hackers or other malware to allow the attacker to again gain access at a later point. Most viruses bundle a backdoor, but it totally can be a separate thing).

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#53

Post by marcodiego »

spookthesunset wrote: post #47
marcodiego wrote: post #41

So, it doesn't makes use of any 0day or exploit to enter the system. Has to be deliberately run. Makes me think of https://www.gnu.org/fun/jokes/evilmalware.en.html

Running something is as easy as hijacking one of those “copy and paste this line into your command prompt to install this package” things you see on many open source sites. The command always curls some bigger script down and executes it. Often times it even has you sudo to root. While it would be prudent to examine the script rather than just blindly execute it... I imagine most don’t (myself included).

3 features browsers should not have:

  - access clipboard

  - mess with scrolling

  - overlapping controls.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#54

Post by acdha »

spookthesunset wrote: post #47
marcodiego wrote: post #41

So, it doesn't makes use of any 0day or exploit to enter the system. Has to be deliberately run. Makes me think of https://www.gnu.org/fun/jokes/evilmalware.en.html

Running something is as easy as hijacking one of those “copy and paste this line into your command prompt to install this package” things you see on many open source sites. The command always curls some bigger script down and executes it. Often times it even has you sudo to root. While it would be prudent to examine the script rather than just blindly execute it... I imagine most don’t (myself included).

Also you have to do that every time you run it (or pin hashes) — the codecov uploader was fine for a long time before that changed.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#56

Post by habibur »

spookthesunset wrote: post #47
marcodiego wrote: post #41

So, it doesn't makes use of any 0day or exploit to enter the system. Has to be deliberately run. Makes me think of https://www.gnu.org/fun/jokes/evilmalware.en.html

Running something is as easy as hijacking one of those “copy and paste this line into your command prompt to install this package” things you see on many open source sites. The command always curls some bigger script down and executes it. Often times it even has you sudo to root. While it would be prudent to examine the script rather than just blindly execute it... I imagine most don’t (myself included).

Which doesn't sound worse than installing non-app-store applications on any other platform, my take.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#58

Post by kingsuper20 »

Cyph0n wrote: post #39
lainga wrote: post #28

Earlier quoted context omitted.

2001:ASO's villain is named HAL execute the cipher on it and see :)

The full name of the movie is “2001: A Space Odyssey”. It’s based on a novel by the great Arthur C. Clarke.

Based on a short story.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#59

Post by acdha »

fullstop wrote: post #17
_hyn3 wrote: post #7

It's systemd-daemon . The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.

Other malware has hidden itself as init, mysqld, php-fpm, etc. This is really nothing new.

This technique is really effective when the attacker does a little bit of homework on the system: if it’s a web server, a lot of people (even security analysts) will miss that the 147 httpd process are 146 /usr/sbin/httpd and one /usr/local/sbin/httpd — or they’ll assume that was where someone installed a custom build.

Re: RotaJakiro: A long live secret backdoor with 0 VT detection

#60

Post by chmod775 »

This is pretty noisy as backdoors go. I wouldn't call this stealthy.

It places a whole bunch of files in various locations, is running as a separate process, and doesn't do https properly.

It's surprising really - when LD_PRELOAD'ing your malware into an existing process is way stealthier. Preferably one that nobody will bat an eyelash at for making TCP connections.

The best ones will probably hide in (places such as) your initial ramdisk, be invisible when the system is running, and copy themselves into the new ramdisk whenever you generate a new one.

Anyways. This isn't 'stealthy'. Not at all. It's hardly the bare minimum.

Post reply on HN