9 ms·
Linux.Rex.1 – A multifunctional self-replicating Trojan for Linux written in Go
- zalmoxes 10y agoSome of the same things that make Go an amazing language for legitimate use, also make it good for writing malwwre. This isn't the first time I see Go get used in such a fashion.
- stock_toaster 10y agoMaybe soon we will have some malware written in rust. You know, for security.
- unsignedqword 10y agoBut I thought everything written in Rust was supposed to be safe! /s
- toxicFork 10y agoSure, it will be safe from crashes and errors ;)
- 0xFFC 10y agoTechnically speaking program written in rust would crash like any other programs. The only differences here is program written in typesafe languages would crash without possibility of undefined behavior.
- stcredzero 10y agoSafe from the POV of malware is like debt from the POV of a bank. Your debt is their asset. Your asset is their liability. Or as Amazon says, your margins are their opportunity.
- bediger4000 10y agoI can't tell from the write-up: did they find this in-use/in the wild somewhere, or does it come from a VirusTotal submission?
- f2f 10y agoVT has first submission for analysis in mid-august and 22/55 vendors convicting. from the comments, it seems like the story broke here in may: http://news.softpedia.com/news/crooks-used-sql-injections-to-hack-drupal-sites-and-install-web-ransomware-504300.shtml http://news.softpedia.com/news/crooks-used-sql-injections-to...
- f2f 10y agoThis is not the first malware to use the Go language. Here is the first, from 2012: http://www.symantec.com/connect/blogs/malware-uses-google-go-language http://www.symantec.com/connect/blogs/malware-uses-google-go... i believe at the same time symantec decided to block every binary compiled with Go's compiler. because that was easiest.
- mholt 10y agoIndeed. https://github.com/golang/go/issues/3606 https://github.com/golang/go/issues/3606
- stock_toaster 10y ago"Status changed to Unfortunate."
- themartorana 10y agoIt's heartening when your security software takes the easy way out. Of anything.
- 0xmohit 10y agoNot only Symantec. See https://github.com/golang/go/issues/16292 https://github.com/golang/go/issues/16292
- wangchow 10y agoFunny the binary has the strings embedded in them. You'd think they'd at least make it better at hiding itself. You could just do "strings <binfile>" to find them "We are Anonymous. All your servers will be DDoS-ed starting {{ .Time.Weekday.String }} ({{ .Time.Format "Jan 2 2006" }}) if you don't pay {{ .Amount }} Bitcoins @"
- parenthephobia 10y agoHow often do you check your binaries to find out if they've got suspicious strings in them? :) I think if you're at the point of running strings on it, you're probably already pretty sure the binary is not above-board.
- oinksoft 10y agoObligatory warning about running `strings` on untrusted files: https://lcamtuf.blogspot.com/2014/10/psa-dont-run-strings-on-untrusted-files.html https://lcamtuf.blogspot.com/2014/10/psa-dont-run-strings-on...
- wangchow 10y agoAh good call.
- wangchow 10y agoHmm. Yeah lol I never run it actually. Still though, if I was writing some malware first question I would ask is how to hide it from people.
- mappu 10y agoThe go toolchain leaves a lot of metadata in a compiled binary, even if you supply `ldflags="-s -w"` - including full paths to source files. Although i appreciate struct member names are needed for reflection (e.g. json.Marshal if you're not using ffjson/equivalent). In this case, it helped to reverse engineer a malicious binary, but in $DAYJOB we have some concerns about more technical end users using this extra metadata to help patch out our license check code, to the point where we're considering commercial exe packers.
- kuschku 10y ago> In this case, it helped to reverse engineer a malicious binary, but in $DAYJOB we have some concerns about more technical end users using this extra metadata to help patch out our license check code, to the point where we're considering commercial exe packers. Considering that that’s a second semester excercise for students, I’m not sure anything can help with that. I mean, literally, the "bomblab", aka "Dr. Evil's Insidious Bomb, Version 1.1" is standard at every university’s computer science course, and teaches how to reverse engineer and bypass such checks in binaries.
- tormeh 10y agoDenuvo might work. Sure, someone can crack it, but it would raise the bar enormously.
- deleted 10y ago[deleted]
- serf 10y ago> I mean, literally, the "bomblab", aka "Dr. Evil's Insidious Bomb, Version 1.1" is standard at every university’s computer science course, and teaches how to reverse engineer and bypass such checks in binaries. i've read the syllabus from such a class; do you happen to know of such an activity that can be participated in by a non-student? I would like to learn more about executable reverse engineering, and that sort of approach appeals to me.
- IANAD 10y agoThe ultimate definition of a douche is someone that writes malware for Linux.
- wott 10y agoHow could they develop this without generics!