4 ms·
Other malware has hidden itself as init, mysqld, php-fpm, etc. This is really nothing new.
by fullstop 5y ago
Other malware has hidden itself as init, mysqld, php-fpm, etc. This is really nothing new.
- deleted 5y ago[deleted]
- acdha 5y agoThis technique is really effective when the attacker does a little bit of homework on the system: if it’s a web server, a lot of people (even security analysts) will miss that the 147 httpd process are 146 /usr/sbin/httpd and one /usr/local/sbin/httpd — or they’ll assume that was where someone installed a custom build.
- fullstop 5y agoRight. It wouldn't be all that difficult to look at the process list and use heuristics to select a relevant process name.
- tyingq 5y agoYou could set argv[0] too: $ perl -e '$0="/usr/sbin/httpd";fork or sleep 1000';ps
- swills 5y agoFor me, it looks like: 17630 27 S 0:00.00 /usr/sbin/httpd (perl) which stands out like a sore thumb, IMHO.
- rofrol 5y agoWhat does it do?
- dcow 5y agoThe name of the program as it was invoked is stored in `argv[0]`. The perl script overwrites the value before continuing on.
- pdimitar 5y agoHides the startup command line of the program by masking it with another value. In this example you wouldn't see that the perl program was started, you'll see this httpd thing. It's not completely reliable but most people wouldn't look that deep anyway.
- acdha 5y agoGood point - I was thinking about persistence but I saw the argv trick in the wild in the early 2000s when someone hit a PHP script in one of our undergrad’s home directory and dropped something fun onto the system. I think I used lsof back then but it’s been a while.
- nousermane 5y ago$ readlink /proc/`pgrep /usr/sbin/httpd`/exe /usr/bin/perl
- modshatereality 5y agoTrue, though systemd-* naming scheme provides a substantial amount of brush for mal-binaries/configs to use as persistent cover. Every system could be different, but distros are lazy it seems.