4 ms·

Dumb question but how does an ELF file end up in the Kernel? I thought everything was source-only?

mossity 6y ago
This wasn't in the kernel, this was just a piece of malware targeting Linux systems
gvb 6y ago
The user (perhaps running as root) was tricked into installed it. It has nothing to do with the kernel installation. The file name is chosen by the attackers to look like a legit executable - systemd-daemon if installed as root, $HOME/.gvfsd/.profile/gvfsd-helper if installed without root privileges. That way victims who are looking at file names won't be alarmed because they look like an expected file e.g. hiding in the forest of legit "systemd-*" files.
- jozvolskyef 6y ago
  This is completely off topic but I love the Caesar cipher implementation in your bio. What does HAL stand for?
  - lainga 6y ago
    2001:ASO's villain is named HAL execute the cipher on it and see :)
    - Cyph0n 6y ago
      The full name of the movie is “2001: A Space Odyssey”. It’s based on a novel by the great Arthur C. Clarke.
      - dllthomas 6y ago
        "Based on" is a little imprecise. IIRC, the two were developed simultaneously and cooperatively, until Kubrick deviated at the end in some ways that made Clarke mad.
        Cyph0n 6y ago
        Huh, didn't know that! Thanks for sharing.
        jozvolskyef 6y ago
        That's a shame. The book's ending is one of the most memorable things I ever read.
      - kingsuper20 6y ago
        Based on a short story.
  - Igelau 6y ago
    IBM
  - thebigspacefuck 6y ago
    IBM is HAL
    - cronix 6y ago
      Specifically, each letter in H-A-L is one less than I-B-M
  - overtomanu 6y ago
    this caesar cipher implementation doesnt replace z with a. incomplete??
    - gvb 6y ago
      Yes, but it is unnecessary for the specific application. It also doesn't "encode" '@' which was more awkward. :-)
    - deleted 6y ago
      [deleted]
dathinab 6y ago
The kernel repository, i.e. where the kernel code comes from is source-only and didn't had anything todo with that ;-). The kernel any OS including linux runs is not source only at all, it's compiled, maybe by the user from source or by a redistributor which then passes it in compiled form to your system. Furthermore this malware seem to not mess with the kernel, but pretend to be a normal system service. ELF means Executable and Linkable Format, it's the executable format which Linux binaries use (and not just them). E.g. a shared library (Linux version of DLL) is in elf format. A variation of ELF is also used by UEFI but that doesn't seem to matter in this article. So basically someone or something hacked their system and installed this malware or they where tricked into installing it themself. The fact that the involved files where named in ways which totally could be normal parts of the system didn't help (but is also common, so I wouldn't say it made it harder).

This wasn't in the kernel, this was just a piece of malware targeting Linux systems

gvb 6y ago

The user (perhaps running as root) was tricked into installed it. It has nothing to do with the kernel installation. The file name is chosen by the attackers to look like a legit executable - systemd-daemon if installed as root, $HOME/.gvfsd/.profile/gvfsd-helper if installed without root privileges. That way victims who are looking at file names won't be alarmed because they look like an expected file e.g. hiding in the forest of legit "systemd-*" files.

jozvolskyef 6y ago
This is completely off topic but I love the Caesar cipher implementation in your bio. What does HAL stand for?
- lainga 6y ago
  2001:ASO's villain is named HAL execute the cipher on it and see :)
  - Cyph0n 6y ago
    The full name of the movie is “2001: A Space Odyssey”. It’s based on a novel by the great Arthur C. Clarke.
    - dllthomas 6y ago
      "Based on" is a little imprecise. IIRC, the two were developed simultaneously and cooperatively, until Kubrick deviated at the end in some ways that made Clarke mad.
      - Cyph0n 6y ago
        Huh, didn't know that! Thanks for sharing.
      - jozvolskyef 6y ago
        That's a shame. The book's ending is one of the most memorable things I ever read.
    - kingsuper20 6y ago
      Based on a short story.
- Igelau 6y ago
  IBM
- thebigspacefuck 6y ago
  IBM is HAL
  - cronix 6y ago
    Specifically, each letter in H-A-L is one less than I-B-M
- overtomanu 6y ago
  this caesar cipher implementation doesnt replace z with a. incomplete??
  - gvb 6y ago
    Yes, but it is unnecessary for the specific application. It also doesn't "encode" '@' which was more awkward. :-)
  - deleted 6y ago
    [deleted]

dathinab 6y ago

The kernel repository, i.e. where the kernel code comes from is source-only and didn't had anything todo with that ;-). The kernel any OS including linux runs is not source only at all, it's compiled, maybe by the user from source or by a redistributor which then passes it in compiled form to your system. Furthermore this malware seem to not mess with the kernel, but pretend to be a normal system service. ELF means Executable and Linkable Format, it's the executable format which Linux binaries use (and not just them). E.g. a shared library (Linux version of DLL) is in elf format. A variation of ELF is also used by UEFI but that doesn't seem to matter in this article. So basically someone or something hacked their system and installed this malware or they where tricked into installing it themself. The fact that the involved files where named in ways which totally could be normal parts of the system didn't help (but is also common, so I wouldn't say it made it harder).