5 ms·
CronRAT malware hides behind February 31st
- sys_64738 5y agoI don't get it. If they are hidden within valid but never occurring crontab dates then they don't get executed. What am I missing?
- rzzzt 5y agoanacron can run entries that are past their due date. ...after reading: but also because one entry has a valid "every 30 minutes" specification :) and the rest are only used for storage.
- 4llan 5y ago> The CronRAT adds a number of tasks to crontab with a curious date specification: 52 23 31 2 3. These lines are syntactically valid, but would generate a run time error when executed. However, this will never happen as they are scheduled to run on February 31st. Instead, the actual malware code is hidden in the task names and is constructed using several layers of compression and base64 decoding. The actual malware uses the task name from these "never occurring crontab". The invalid date is just a kind of signature.
- yborg 5y agoDunno how stealthy this is given that masses of base-64 garbage you didn't put into a crontab seems like a pretty big red flag.
- tyingq 5y agoI think the idea is that various Linux endpoint protection products don't look there.
- cyberCleve 5y agoThat seems like an obvious oversight. This is a well known and widely used malware technique. https://attack.mitre.org/techniques/T1053/003/ https://attack.mitre.org/techniques/T1053/003/
- tata71 5y agoWhen's the last time you checked yours, before this story?
- vmoore 5y ago> Most online stores have only implemented browser-based defenses, and criminals capitalize on the unprotected back-end. Security professionals should really consider the full attack surface What's the entry point for such a RAT? Does it scan for vulns in the server and plant itself there, or what? Article is lacking explanation of how a Linux e-commerce backend actually gets comp'd.
- tata71 5y agoOne of thousands of unpatched (either at the sysops level, or the distro level) kernel RCE vulns.
- vmoore 5y agoI thought that. "criminals capitalize on the unprotected back-end" is a bit vague though. An exposé of the actual vulnerability would make this write-up even better, but I imagine the company doesn't want to discuss that for obvious reasons.
- tata71 5y agoThrow a dart: https://www.cvedetails.com/vulnerability-list.php?vendor_id=33&product_id=47&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=7&cvssscoremax=7.99&year=0&cweid=0&order=1&trc=662&sha=27cc1be095dd1cc4189b3d337cc787289500c13e https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
- tuankiet65 5y agoRunning outdated web applications with vulnerabilities I suppose.
- marcodiego 5y ago> In the run-up to Black Friday, Sansec discovered a sophisticated threat that is packed with never-seen stealth techniques. This malware, dubbed “CronRAT”, hides in the Linux calendar system on February 31st. It is not recognized by other security vendors and is likely to stay undetected on critical infrastructure for the coming months. For years I've heard people saying: "People is not as used as windows, that's why nobody is interested in writing virus for linux." Turns out that considering the number of "embedded" linux these days, linux is probably much more popular than any other OS. Consider android devices, smart tv, routers... all these are devices that are directly in touch with the end users. The fact that these have been nowhere near as annoying as windows devices is a testament to how seriously developers and vendors have been taking security and also a bit of luck and the heritage of some unix ideas. Of course, most high profile linux use are on servers. So it is expected that these systems are preferred targets. But considering all that, if you look closely at how some linux users, distributors and vendors behave, it seems like they are in another world. Security is mostly ignored as if linux was somehow magically free from vulnerabilities simply because you're using a package manager and mostly no extra security action is taken. Maybe linux users and sysadmins became lazy or lax for the long years of a perceived security calmness. They will probably need a few incidents before learning some lessons from the windows crowd.
- marcosdumay 5y ago> They will probably need a few incidents before learning some lessons from the windows crowd. Hum, thank-you but no. The lessons the Windows crowd learned are mostly bullshit, officialized due to people's helplessness and total lack of any reasonable alternative. Linux people are very serious about things like supply-chain verification, auditable software, and machine activity monitoring. All actions with viable engineering principles and real impact, differently from the "you need to install an antivirus" insanity.
- michaelbuckbee 5y agoI think the parent commenter was making an interesting point which is that linux users are bifurcated: 1. The group you described (conscientious sysadmins) and 2. IOT vendors throwing Linux on devices without thought to updates and security.
- iRobbery 5y agoIn which year does February have 31 days?
- kingcharles 5y agoI had to check in case it had actually ever occurred, since I had recently read about 30 February existing for reals: https://www.timeanddate.com/date/february-30.html https://www.timeanddate.com/date/february-30.html It looks like there has never been a real 31 February.
- encoderer 5y agoAt Cronitor we scan your crontab files when you install the service and I’m thinking we should add a check for this kind of thing.