15 ms·
RotaJakiro: A long live secret backdoor with 0 VT detection
- SavantIdiot 6y agoDumb question but how does an ELF file end up in the Kernel? I thought everything was source-only?
- mossity 6y agoThis wasn't in the kernel, this was just a piece of malware targeting Linux systems
- gvb 6y agoThe user (perhaps running as root) was tricked into installed it. It has nothing to do with the kernel installation. The file name is chosen by the attackers to look like a legit executable - systemd-daemon if installed as root, $HOME/.gvfsd/.profile/gvfsd-helper if installed without root privileges. That way victims who are looking at file names won't be alarmed because they look like an expected file e.g. hiding in the forest of legit "systemd-*" files.
- jozvolskyef 6y agoThis is completely off topic but I love the Caesar cipher implementation in your bio. What does HAL stand for?
- lainga 6y ago2001:ASO's villain is named HAL execute the cipher on it and see :)
- Cyph0n 6y agoThe full name of the movie is “2001: A Space Odyssey”. It’s based on a novel by the great Arthur C. Clarke.
- dllthomas 6y ago"Based on" is a little imprecise. IIRC, the two were developed simultaneously and cooperatively, until Kubrick deviated at the end in some ways that made Clarke mad.
- Cyph0n 6y agoHuh, didn't know that! Thanks for sharing.
- jozvolskyef 6y agoThat's a shame. The book's ending is one of the most memorable things I ever read.
- kingsuper20 6y agoBased on a short story.
- Igelau 6y agoIBM
- thebigspacefuck 6y agoIBM is HAL
- cronix 6y agoSpecifically, each letter in H-A-L is one less than I-B-M
- overtomanu 6y agothis caesar cipher implementation doesnt replace z with a. incomplete??
- gvb 6y agoYes, but it is unnecessary for the specific application. It also doesn't "encode" '@' which was more awkward. :-)
- deleted 6y ago[deleted]
- dathinab 6y agoThe kernel repository, i.e. where the kernel code comes from is source-only and didn't had anything todo with that ;-). The kernel any OS including linux runs is not source only at all, it's compiled, maybe by the user from source or by a redistributor which then passes it in compiled form to your system. Furthermore this malware seem to not mess with the kernel, but pretend to be a normal system service. ELF means Executable and Linkable Format, it's the executable format which Linux binaries use (and not just them). E.g. a shared library (Linux version of DLL) is in elf format. A variation of ELF is also used by UEFI but that doesn't seem to matter in this article. So basically someone or something hacked their system and installed this malware or they where tricked into installing it themself. The fact that the involved files where named in ways which totally could be normal parts of the system didn't help (but is also common, so I wouldn't say it made it harder).
- DelaneyM 6y agoThe obvious question not answered (but asked) in the article is: "Who put it there and why?" Surely this should be easily knowable?
- detaro 6y agoHow would that be easy? If I put a random file on your computer X years ago while trying to cover my tracks, how would you tell when and how I did it?
- laburn 6y agoAttribution of malware can be difficult and the lack of details like who was targeted and missing plugins don't leave enough information to guess who might have been interested in developing this.
- temp667 6y agoIt's not actually shipping with Linux - someone installed a virus. That's really it.
- jokoon 6y agoWell this might be answered by asking who got it, what is their business, etc. In general good malwares either try to make money or have some kind of geopolitical goal (industrial spying etc). Information is power, but generally, a good hacker would know how to obfuscate the reasons why he is putting malware.
- speeder 6y agoFor those wondering why "RotaJakiro" the name, Jakiro is a reference to a Dota2 character, that is a dragon with 2 heads, thus why the double-behaviour got the name "Jakiro"
- FirstLvR 6y agoso thats why the name was bothering me, thanks for the reference
- fguerraz 6y agoPardon me if it's a stupid question, but a backdoor to what? I don't really understand what it's about. In my mind a backdoor is hidden feature built into another _useful_ piece of software. Is this "just a backdoor"? Like, its sole purpose is to give remote access / exfiltrate information? If so, how does it end up on systems? What is the vector?
- cyberpunk 6y agoThis is what you drop on a system after it's compromised for use later, it's a RAT. It gets there via some kind of compromise, either an insecure application, some drive-by exploit for some missing patch, owning a sysadmin and pushing it out via ansible/salt/etc.
- fguerraz 6y agoGot it thanks!
- 55555 6y agoit's a virus. lol. there are many ways to get them onto systems. file download site, typosquatted apt/pip package names, buying/hacking a download mirror website, 0-day browser exploits, etc.
- fguerraz 6y agoerr, no it's not a virus, it seems it has no ability to reproduce on its own.
- x86_64Ubuntu 6y agoI'm loving the differences between the word "virus" in the computer and biology sense.
- danparsonson 6y agoI think the comparison is quite apt actually - a software virus requires a host (system) to reproduce, just as a meat-space virus does.
- _hyn3 6y agoIt's systemd-daemon. The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file. It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.
- tyingq 6y agoProbably a good choice running as "systemd-whatever". People have lost track of all the systemd pieces as it's grown in scope, so it doesn't look immediately suspicious.
- fullstop 6y agoOther malware has hidden itself as init, mysqld, php-fpm, etc. This is really nothing new.
- deleted 6y ago[deleted]
- acdha 6y ago
- duxup 6y agoThis isn't my area of expertise but ... where did they find this? >On March 25, 2021, 360 NETLAB's BotMon system flagged a suspiciousELF file (MD5=64f6cfe44ba08b0babdd3904233c4857) with 0 VT detection, the sample communicates with 4 domains on TCP 443 (HTTPS), but the traffic is not of TLS/SSL. A close look at the sample revealed it to be a backdoor targeting Linux X64 systems, a family that has been around for at least 3 years. They saw it communicating over the network? But ... where was it? On their linux system? Someone else's? Any idea how it got there?
- Mathnerd314 6y agoBotMon is a "DDoS botnet C2 command tracking system". So I guess they're doing some kind of traffic analysis. https://ddosmon.net/faq https://ddosmon.net/faq doesn't say much. "0 VT detection" means that no virus scan on VirusTotal detected it. The ZDNet article is a little more informative with regard to the terms: https://www.zdnet.com/article/rotajakiro-a-linux-backdoor-that-has-flown-under-the-radar-for-years/ https://www.zdnet.com/article/rotajakiro-a-linux-backdoor-th...
- ziml77 6y agoThanks for explaining what 0 VT detection means. In the context of Linux, I was reading VT as "virtual terminal".
- hiccuphippo 6y agoThe website this was posted in seems to be a company offering network monitoring tools. So they probably saw it in one of their customer's systems.
- zhte415 6y ago360 is a huge, and I cannot emphasise how huge, antivirus company in China. It is also widely known for slowing down consumer Windows, hijacking IE (with the grace to add an identical logo but in green), and adding spyware to 'keep you safe'. They also pay well and employ some pretty competent people.
- cyberpunk 6y agoThis is pretty cool, but I keep waiting until someone finds a horribly malicious version of bash that hides processes, directories and so on unless you have a specific env var set.. It could even detect when you do a update and just copy itself back over the new version, since almost all updates are being applied under a shell somewhere (may need a malicious python also then..)
- spookthesunset 6y agoBack in my younger days... I’ve had boxes hacked through bugs in bind or sendmail. The hacker would cover their tracks with replacements of “ps”, “ls” and such that attempted to cover their tracks. Good times.
- cyberpunk 6y agoBack in my younger days I wrote a few such patches. Not a lot of people use tripwire anymore!
- tux3 6y agoThe old tripwire makes less sense in a world of cloudwalking cattle. Ephemeral containers and VMs everywhere. Machines go up, they go down.
- cyberpunk 6y agoSome of my containers run for weeks between deploys, I’d like to know what changes in ‘em just as much as thay oldskool iaas db server marketing uses ;)
- jcrawfordor 6y agoReplacing coreutils used to be a semi-common persistence strategy on Linux, you either swapped out the actual tools or a common library with one that had a hook to start up your RAT or whatever other malicious payload. It had the advantage of almost certainly getting it started very quickly after boot without necessarily leaving anything in an "obvious" place (e.g. cron, profile scripts, etc). I haven't seen this in a while, I would guess the increasing use of antivirus/rootkit detection (these things would be pretty easy to signature) and auditing package managers are both factors. Actually, last time I saw it the cracker (really a script) had replaced a couple of libraries with 32 bit versions on a 64 bit machine, which lead to most of the coreutils no longer working. Very subtle. 64-bit machines were becoming common by that point but maybe not so much on Linux servers, but still it was a clear sign of low effort!
- Phurist 6y agoI did not really understand it from the article but... how can one verify the existence of this on their own system and if needed, purge it ?
- fguerraz 6y agoThey give some md5, so you could check if any of your binaries gives any of these hashes
- danuker 6y agoToo bad MD5 is broken. To really confuse things, the attackers could generate an innocent but colliding binary.
- mvolfik 6y agoHow does it help them? If you find file with this MD5 on your system, you have either the virus, or a colliding binary crafted by the attackers - bad in either case \o/
- gvb 6y agols -l $HOME/.gvfsd/.profile/gvfsd-helper /bin/systemd/systemd-daemon /usr/lib/systemd/systemd-daemon If one or more of those files is found, you likely are infected - they probably are not "real" system files. If you find one, do a system audit https://linux-audit.com/determine-file-and-related-package/ https://linux-audit.com/determine-file-and-related-package/
- ramshanker 6y agoCat : So my guess is the point where the virus author slipped is not making the traffic to port 443 look like genuine HTTPS. The moment a firewall notices 443 and NOT HTTPS it is tell-telle sign of something. Mouse: OK. see you next time.
- pmoriarty 6y agoWhat's "VT" and "C2" ?
- ramshanker 6y agoC2 is "Command and Control" server I guess. VT no idea. EDIT: Someone else commented below. VT is number of scans on Virus Total website.
- IChooseY0u 6y agoVirusTotal?
- luto 6y agoVT = virustotal.com, a popular site to check unknown binaries. C2 = command & control, a server which tells the malware what to do.
- detaro 6y agoVirusTotal, online virus scanner and file sample collection Command & Control - server coordinating a botnet
- deleted 6y ago[deleted]
- chrisbrandow 6y agoIt’s not clear to a non-systems person, me specifically, whether this is something that was added to Linux code base itself, or as a virus-like file that was added and has spread.
- dathinab 6y agoThe article didn't say anything of it being added to any code base, so no. It's just another "backdoor" which had been installed by a hacker or malware. (Backdoor doesn't mean it's build into existing systems, it means it gives you access to a system through a unintended path. Most backdoors are installed by hackers or other malware to allow the attacker to again gain access at a later point. Most viruses bundle a backdoor, but it totally can be a separate thing).
- marcodiego 6y agoSo, it doesn't makes use of any 0day or exploit to enter the system. Has to be deliberately run. Makes me think of https://www.gnu.org/fun/jokes/evilmalware.en.html https://www.gnu.org/fun/jokes/evilmalware.en.html
- jacob019 6y agoThe infection vector is not clear, this is the payload.
- spookthesunset 6y agoRunning something is as easy as hijacking one of those “copy and paste this line into your command prompt to install this package” things you see on many open source sites. The command always curls some bigger script down and executes it. Often times it even has you sudo to root. While it would be prudent to examine the script rather than just blindly execute it... I imagine most don’t (myself included).
- marcodiego 6y ago3 features browsers should not have: - access clipboard - mess with scrolling - overlapping controls.
- acdha 6y agoAlso you have to do that every time you run it (or pin hashes) — the codecov uploader was fine for a long time before that changed.
- habibur 6y agoWhich doesn't sound worse than installing non-app-store applications on any other platform, my take.
- salawat 6y agoYou say that like doing so is a negative thing. How do you think executable code gets on a system in the first place? Either an Admin builds from source, an Admin installs a binary from a source they deem trustworthy, or you YOLO, download something sketchy to an older system and watch what your Network Analyzer/reverse engineering stack spits out. App stores changed none of that in terms of fundamental activity one needs to do. They just lull users into a false sense of security because "someone else did it". I've run into too many devs who salivated over the idea of embedding cryptominers in game clones to believe it isn't done on a semi-regular basis.
- chmod775 6y agoThis is pretty noisy as backdoors go. I wouldn't call this stealthy. It places a whole bunch of files in various locations, is running as a separate process, and doesn't do https properly. It's surprising really - when LD_PRELOAD'ing your malware into an existing process is way stealthier. Preferably one that nobody will bat an eyelash at for making TCP connections. The best ones will probably hide in (places such as) your initial ramdisk, be invisible when the system is running, and copy themselves into the new ramdisk whenever you generate a new one. Anyways. This isn't 'stealthy'. Not at all. It's hardly the bare minimum.
- ProAm 6y agoYou can hide in plain sight and still be hiding.
- hdjfmtnrn 6y agoOn Windows, using the equivalent of LD_PRELOAD makes all the antiviruses go crazy. One way around this if you insist is tricking another app into loading you, instead of you forcing your way in, this looks more legit. But the best way to stay undetected is to behave as a regular innocent program and not use any tricks at all. These days, when computers have hundreds of processes running, nobody is going to notice another one. For network communications there are ways of delegating this to other apps, so that you don't trigger the firewall. For example you can write something in the Chrome user profile directory which will make Chrome fetch data for you on the next start.
- chmod775 6y ago> On Windows, using the equivalent of LD_PRELOAD makes all the antiviruses go crazy. There is no such thing on modern-day Windows. There used to be AppInit DLLs, but that 'feature' was broken to a degree that no legitimate application would have used it anyways and it likely wasn't a malware author's first choice either. Further, by the time you place a backdoor such as this, you would have neutralized any antivirus software. This used to be done by 'patching' them and turning their update process into something that did essentially nothing after any download. No idea what the state of the art is here for either. This is a backdoor after all, not a vector. As a backdoor you mostly care about humans noticing you messed with their system. You have defeated and subverted the machine and now need to keep the meat ignorant. So you want to avoid having random suspiciously named files lying around or weird extraneous processes showing up. Even the most technologically illiterate users know to watch for weird processes.
- 101001001001 6y agoWhy can’t Linux keep track of parent-child relationships and visualize them when you look at running processes? You could instantly identify this virus. And why can’t Linux apps have a universal and straightforward install directory?
- deleted 6y ago[deleted]
- detaro 6y agoWhat do you mean by "parent-child relationships"?
- lysium 6y agoDo you mean pstree?
- cgh 6y agoAssuming you are talking about parent/child processes, use the --forest option in ps for an ascii art process tree.
- souprock 6y agoI implemented the --forest option in ps. It can't fully work. The kernel forgets parent-child relationships when processes die. Every orphan is adopted by init, and the kernel doesn't bother to remember the original parent. I've always hated this. Anybody want to fix it? The simple fix, kind of bad, is to simply remember the number and report it. The trouble here is that the number might get recycled. Adding a boolean to indicate "my original parent died" would help. The proper fix is to keep some PID values allocated. Do not free a PID value until all the children of it have died. This would mean that every living process without a living original parent would have a ghost parent that gets reported to ps. Sadly, for compatibility reasons, the getppid() call would need to report the adoptive parent. The fix for this is to add a new system call that reports both the original parent PID and a flag to indicate adoption.
- 6y ago
- temp667 6y agoI know you are not supposed to blanket block foreign IP's, but I often do that and it seems to knock down a fair bit of crap. Also saves you from inadvertently messing up GPDR. Where does this stuff C2 back to / come from?
- ficklepickle 6y ago176.107.176.16 DeltaHost - VPS, VDS, dedicated servers in Ukraine & Netherlands
- temp667 6y agoWell, at least another one is overseas IP for C2 - my lazy blocking would have stopped it.
- de6u99er 6y agoNow a script would be great helping check if the backdoor is present on a system or not.
- vaylian 6y agoSure. Just use this one: http://totally-legit-website.com/downloads/linux-systemd-rootkit-checker http://totally-legit-website.com/downloads/linux-systemd-roo...
- jessaustin 6y agoShould one use the "curl <url> | sh" idiom to install this tool?
- cblconfederate 6y agobut only as root in a production machine
- ValueNull 6y agoAdd some sudos in there for good measure.
- egberts1 6y agoThis is why Linux firewall is terrible at blocking systemd’s access to a network port. Yeah, I had a corner case where I wanted to use ISC DHCP client (due to Juniper DHCP server at my ISP) where I wanted to block all network access to systemd. Alas, no can do. So i’ve since moved over to Denuvan distro where SysV unit can still be used while having Debian APT repo. This is a plus for OpenBSD which can firewall by-PID (PID 1, systemd).
- squarefoot 6y agoThe malware contains some hardcoded domains: news.thaprior.net blog.eduelects.com cdn.mirror-codes.net status.sublineover.net Just out of curiosity I did a simple search and found no mention of any of those domains, except for status.sublineover.net which is being reported here: https://raw.githubusercontent.com/shargon/Fwhibbit/master/TorStats/dns_log.txt https://raw.githubusercontent.com/shargon/Fwhibbit/master/To... Which is stored on a 4 years old project by what seems to be a ethical hackers group: https://github.com/shargon/Fwhibbit https://github.com/shargon/Fwhibbit (possibly related to: https://fwhibbit.es https://fwhibbit.es )
- lgats 6y agohttps://domain.glass/status.sublineover.net https://domain.glass/status.sublineover.net -registered 2015-12-09 -cisco umbrella ranked intermittently since 2020-07 https://domain.glass/news.thaprior.net https://domain.glass/news.thaprior.net -registered 2015-12-09 -intermittent cisco umbrella ranking since 2021-01-31 https://domain.glass/cdn.mirror-codes.net https://domain.glass/cdn.mirror-codes.net -registered 2015-12-10 https://domain.glass/blog.eduelects.com https://domain.glass/blog.eduelects.com -registered 2015-12-09 All domains registered with Web4Africa (Pty) Ltd, hosting provided by Deltahost PTR, Kiev, Ukraine
- deleted 6y ago[deleted]
- hollerith 6y agoDid Fedora's selinux policy stop this?
- angry_octet 6y agoThey already have local exec before they install this, and it's a user land persistence kit, so no.
- TheMagicHorsey 6y agoIt's not quite clear to me, but is this Malware part of any of the popular Linux distributions, or was it part of an infection on that particular machine through some installation after the fact?
- williesleg 6y ago# rm -rf / send me bitcoin and I'll get your files back
- numpad0 6y agoPSA: when communicating known malicious FQDN/URLs in good cause, either add [.] before TLD or use hxxps URL scheme(e.g. example[.]com or hxxps://example.com). Modern websites/browsers recognize these and disable autolinking.
- afturkrull 6y agoHow does RotaJakiro deploy on a not already compromised system. Without the enduser downloading and running an execututable? will it run on non-systemd systems? Or non-gnome desktops? "How did RotaJakiro spread, and what was its purpose?" There's no evidence it has spread, apart from being uploaded to the VirusTotal anti-malware engine?
- averyfreeman 6y agoI figured I could see if I'd been exposed by this backdoor by using the md5 supplied by netlab.360: find / -type f -exec md5sum {} + | grep '^64f6cfe44ba08b0babdd3904233c4857' Any feedback about using this method?