Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild
1–10 of 56 posts
Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild
#2Seems to only relate to RHEL 6, or derivatives of, such as CentOS 6. Yes: 6. Which is as EOL as enterprise software gets: https://access.redhat.com/support/policy/updates/errata#Life...
Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild
#3Seems to only relate to RHEL 6, or derivatives of, such as CentOS 6. Yes: 6. Which is as EOL as enterprise software gets: https://access.redhat.com/support/policy/updates/errata#Life...
RHEL 6 is in Extended Lifecycle Support until June 2024 (that is: customers with suitable subscriptions still get critical patches). It’s a zombie, but it’s not quite dead yet. I’d bet that there are still enough (+) people out there running it.
(+) or rather too many.
Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild
#4Seems to only relate to RHEL 6, or derivatives of, such as CentOS 6. Yes: 6. Which is as EOL as enterprise software gets: https://access.redhat.com/support/policy/updates/errata#Life...
Comparatively, RHEL 6 is still kind of fine, at least it is still officially supported as virtualized OS in oVirt...
We run a lot of CentOS 5 virtual machines (and some physical ones! ; and some RHEL4! , and a few Fedora core 8 and 4 !!!), with no end in sight... :(
It is a huge concern for the Infra team, a source of many headaches, and we need to go through oops to keep them running, but:
- Clients don't want to move from OLDPRODUCT that requires extremely old php.
- Dev team is not interested in migrating OLDPRODUCT to a modern platform, or even try to put it in a container. Their eyes are turned to the shiny NEWPRODUCT that is seemingly never fully coming to production (only one client has signed for it).
- New clients are still regularly signed on OLDPRODUCT.
- No one in the org wants to pay for for a migration anyway.
- Since some clients have complained about poor apparent security, what was visible was just hidden behind newer haproxy.
Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild
#5Seems to only relate to RHEL 6, or derivatives of, such as CentOS 6. Yes: 6. Which is as EOL as enterprise software gets: https://access.redhat.com/support/policy/updates/errata#Life...
Comparatively, RHEL 6 is still kind of fine, at least it is still officially supported as virtualized OS in oVirt... We run a lot of CentOS 5 virtual machines (and some physical ones! ; and some RHEL4! , and a few Fedora core 8 and 4 !!!), with no end in sight... :( It is a huge concern for the Infra team, a source of many headaches, and we need to go through oops to keep them running, but: - Clients don't want to mo…
OT, but: why don't you just compile up an old php version from source on a new OS? It's a bit of a hassle the first time you do it, sure, but less than the hassle of running multiple legacy OS?
Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild
#6> To load the rootkit into kernel space, it is necessary to approximately match the kernel version used for compiling; it does not have to be strictly the same.
>> vermagic=2.6.32-696.23.1.el6.x86_64 SMP mod_unload modversions
do you know why they say "approximately match"? I thought it had to match exactly so that the kernel accepts to load the module
Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild
#7Seems to only relate to RHEL 6, or derivatives of, such as CentOS 6. Yes: 6. Which is as EOL as enterprise software gets: https://access.redhat.com/support/policy/updates/errata#Life...
Comparatively, RHEL 6 is still kind of fine, at least it is still officially supported as virtualized OS in oVirt... We run a lot of CentOS 5 virtual machines (and some physical ones! ; and some RHEL4! , and a few Fedora core 8 and 4 !!!), with no end in sight... :( It is a huge concern for the Infra team, a source of many headaches, and we need to go through oops to keep them running, but: - Clients don't want to mo…
>NEWPRODUCT that is seemingly never fully coming to production
>- New clients are still regularly signed on OLDPRODUCT.
I mean what's the WHY behind that? Why don't even new customers sign on to the new product? Why is the new product not in production? Is that the same reason?
Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild
#8Seems to only relate to RHEL 6, or derivatives of, such as CentOS 6. Yes: 6. Which is as EOL as enterprise software gets: https://access.redhat.com/support/policy/updates/errata#Life...
Comparatively, RHEL 6 is still kind of fine, at least it is still officially supported as virtualized OS in oVirt... We run a lot of CentOS 5 virtual machines (and some physical ones! ; and some RHEL4! , and a few Fedora core 8 and 4 !!!), with no end in sight... :( It is a huge concern for the Infra team, a source of many headaches, and we need to go through oops to keep them running, but: - Clients don't want to mo…
Are you sure you want to disclose your employer's security risks and tech debts on a public forum?
Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild
#9Seems to only relate to RHEL 6, or derivatives of, such as CentOS 6. Yes: 6. Which is as EOL as enterprise software gets: https://access.redhat.com/support/policy/updates/errata#Life...
Comparatively, RHEL 6 is still kind of fine, at least it is still officially supported as virtualized OS in oVirt... We run a lot of CentOS 5 virtual machines (and some physical ones! ; and some RHEL4! , and a few Fedora core 8 and 4 !!!), with no end in sight... :( It is a huge concern for the Infra team, a source of many headaches, and we need to go through oops to keep them running, but: - Clients don't want to mo…
This sounds so familiar. Running an old OS that gets no updates and patches because of an app that relies on an old php version, also the fear of migration costs and an open ended project that never finishes. This is so wide spread it becomes a meme.
Re: Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild
#10Seems to only relate to RHEL 6, or derivatives of, such as CentOS 6. Yes: 6. Which is as EOL as enterprise software gets: https://access.redhat.com/support/policy/updates/errata#Life...
Comparatively, RHEL 6 is still kind of fine, at least it is still officially supported as virtualized OS in oVirt... We run a lot of CentOS 5 virtual machines (and some physical ones! ; and some RHEL4! , and a few Fedora core 8 and 4 !!!), with no end in sight... :( It is a huge concern for the Infra team, a source of many headaches, and we need to go through oops to keep them running, but: - Clients don't want to mo…
> - Clients don't want to move from OLDPRODUCT that requires extremely old php
I know that problem for a thankfully long gone Java internal application, and well... I went with running old stuff in `debian/eol` Docker containers [1]. Turns out you actually can use Docker as a sort of extremely lightweight VM service.