8 ms·
New SysJoker Backdoor Targets Windows, Linux, and macOS
- mro_name 5y agotalking security and the webpage loading dozends of 3rd parties? ugh.
- yepthatsreality 5y ago> SysJoker masquerades as a system update and generates its C2 by decoding a string retrieved from a text file hosted on Google Drive. During our analysis the C2 changed three times, indicating the attacker is active and monitoring for infected machines.
- uniqueuid 5y agoIs that a common technique? Are there other methods in use for masquerading, or do people simply hard-code a group of C2 IPs or DNS entries?
- moritonal 5y agoThere are infinite ways. One for example is to generate a dns address from the uct time and try connect to that. It's easy to simply buy the correct dns name and send an order out to the botnet. Or to hide the commands in a DNS request itself, or lookup a gist, or a tweet ect.
- monkeybutton 5y agoPastebin!
- thatfunkymunki 5y agonot sure if this specific TTP is common, but generally there are a lot of ways that malware authors perform first c2 discovery and then actual c2. attackers can use DNS itself for both of these aspects of C2. Even very old reports of since-long-gone attackers like APT1 https://www.mandiant.com/media/9941/download https://www.mandiant.com/media/9941/download indicate use of covert c2 over otherwise benign web applications like google calendar.
- deleted 5y ago[deleted]
- blacksmith_tb 5y agoThat seems like a fragile command and control choice, couldn't Google just shut down the account that owns the gDoc?
- ASalazarMX 5y agoThe author likely has a pool of fake accounts. Besides, once the C&C is configured the Google Drive link becomes obsolete.
- Thorrez 5y agoBut the malware has to have a list of them in order to check them. Google could deactivate them all at once.
- Animats 5y ago"For Linux machines, use Intezer Protect" How do we know that isn't an attack?
- thenthenthen 5y agoIndeed. This blog post reads like an advertising, much like the vintage McAfee strategy of spreading fear of viruses and offering a solution.
- metadat 5y agoRight, collectively we can't really trust those Fly-By-Night startups with root on our machines. Probably the folks in this case are currently benign, but I don't know them so how can I really know? And what about the future as startup finances and resources for the Community Edition dwindle? In past weeks wasn't it revealed that even major AV vendors have been begun auto-installing shady crypto miners on end-user machines? Running all mounts as RO isn't feasible in every case. Maybe docker and VMs can help insulate and protect to a degree. Yet even still, once an attacker makes it into your private network it's pretty likely that the state converges to Game Over. This stonks to high heaven. EDIT: Here is the Norton anti virus crypto miner story https://news.ycombinator.com/item?id=29795910 https://news.ycombinator.com/item?id=29795910
- Animats 5y agoRight. We need to run anti-virus programs in jails with read-only file system access. That should be a standard OS feature. They should output a list of files to be examined or deleted or jailed, but not actually do anything about them. That should be the job of a separate, very dumb, open source program.
- metadat 5y agoThat would be nice, but would they still need to deflect or at least detect infections-in-progress? This seems impossible to achieve if you are locked up in jail.
- rkagerer 5y agoSysJoker will create persistence by adding an entry to the registry run key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run I regularly run tools like Autoruns to disable unwanted new entries in places like this. These days it's more of a problem for me with regular software than it is malware. Unfortunately locking down the registry key can break legitimate installers. Does anyone know of a decent utility that monitors for changes in the background and notifies you via an unintrusive little icon in the system tray (no balloons) which you can click when convenient to review the offenders? Have also contemplated a process "whitelist" that allows you to whitelist regular programs (maybe it has a mode you can run for a time where it learns automatically) and let's you easily view stuff running that you don't recognize.
- softblush 5y agoDepending on your exact use case checkout - MJ Registry Watcher - RegShot - Or monitor yourself with some WMI query
- deleted 5y ago[deleted]
- mrcsharp 5y agoWindows 11 does notify the user when a program registers itself to run at startup.
- pluc 5y agoHow it took Windows 30 years to do this is beyond me
- pfundstein 5y agoDoes Linux? OSX? There's a hundred and one different ways to get Windows to run something at boot, even as an unpriviliged user. So it's not as simple as just monitoring HKCU\..\Run. With Linux at least it's somewhat more limited: Unpriviliged users typeically only have access to cron for running things at boot.
- zokier 5y agoModern malware is so often quite boring. Like this one, it doesn't actually perform any interesting attacks on its own, it just uses bog-standard autorun for persistence and generic names to obfuscate its presence. Nothing particularly sophisticated or technically impressive imho.
- ancode 5y agoWhy blow the interesting stuff on generic targets
- ASalazarMX 5y agoThis is why we can't have nice malware.
- ReactiveJelly 5y agoYeah. If the article is right, SysJoker is "stage 1" to infiltrate networks. The C&C servers will only deploy a more interesting "stage 2" to the target they care about. Maybe the attack is already completely done, and they're just leaving the C&C servers and the rest of the botnet up to avoid leaking "The C&C servers went offline at X time" as a piece of information.
- 323 5y agoYou want to look as "boring and regular app" as possible, to avoid detection based on heuristics. So that means using no "malware techniques" like DLL injection, process scanning, fancy persistence, ...
- taneq 5y agoDon't dress like Seal Team Six and abseil in through the skylight, just dress like you're in IT, walk fast and carry a clipboard.
- the_only_law 5y agoHah yeah, I have had the same observation as well, but as other replied noted this makes sense. I’ve also noticed I don’t really find much malware in the wild, at least nothing targeting you’re typical PC user. Maybe I’ll find some boring, barely obfuscated adware, but of it seems to target larger, enterprise organization, which I suppose also makes sense. There was a write up a few days ago about an exploit targeting MS Word that was at least mildly more interesting than most of the stuff I hear about now.
- nimbius 5y agochrist spare me the 70mb CSS dog and pony show. give me the CVE or get off my lawn.. - so far the only people i see flogging this are some company called Intezer. - MITRE related security sites all show a blurb on it saying NPM packages "might" be a vector. - NOWHERE is it listed the vector or method of attack employed for linux systems, but sure, add linux because SEO reasons. can anyone give a tech source for the linux side of the house?
- deleted 5y ago[deleted]
- tyingq 5y agoI agree it doesn't show anything about how it gets itself run/installed in Linux, but there are some details on what it does once it's running on Linux, checksums for elf binaries, etc. They do at least provide some evidence of Windows, Linux, and MacOS payloads.
- phendrenad2 5y agoIs there a CVE-like thing for malware? It seems as though CVEs/MITRE are just security hole reports, and the viruses that use these holes are left as an exercise of one's imagination.
- jacquesm 5y agoWhat are the odds of some of these software peddlers being in the malware business directly or indirectly? The chances of them happening to want you to download an otherwise unknown piece of stuff and run it privileged seem to be more of a risk than that you have the malware on your system. Does anybody know what came of this? https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targeting-linux-systems/ https://www.intezer.com/blog/malware-analysis/hiddenwasp-mal... Did the threat materialize or was it a dud?