3 ms·

Very clever hiding techniques. Makes me wonder which state level actor(s) are behind this one?

prvit 4y ago
These are not very clever hiding techniques, for the most part these are the most basic techniques known to every 15 year old malware dev reading decades old literature. Ars fell for marketing speech from an AV company that has every reason to hype their discovery.
- trelane 4y ago
  Any resources (books, articles) you'd recommend for those with a very technical background interested in getting up to speed on the side?
  - prvit 4y ago
    I linked a ton of git repos in another comment here, some of them have very readable code. LD_PRELOAD rootkits are super easy to understand. Phrack has tons of relevant content, Blackhatacademy has some (https://nets.ec/LD_Preload https://nets.ec/LD_Preload) A quick google search also found this simple walkthrough https://fluxius.handgrep.se/2011/10/31/the-magic-of-ld_preload-for-userland-rootkits/ https://fluxius.handgrep.se/2011/10/31/the-magic-of-ld_prelo...
notakio 4y ago
It certainly feels like a nation state's work, or, at the very least, an "advanced persistent threat" group. The packet capture pre-filter aspect, at very least, is strongly reminiscent of code I've seen from a couple of particular SE Asian APT-designated groups.
- prvit 4y ago
  What reason do you have to believe that besides the targets? Feature-wise this isn't significantly more advanced than public LD_PRELOAD kits like Umbreon, developed by literal children. A basic BPF filter isn't fancy or difficult to implement.
  - notakio 4y ago
    Primarily, similarity to forensics samples I've seen via incident response. But you're right; the individual aspects of this aren't particularly outstanding or complex, it's the lack of uncrossed T's and undotted I's, overall, that makes me lean toward the conclusion I'm making. Kids tend to be sloppier than criminal malware organizations, as criminal malware organizations tend to be sloppier than APT groups.

These are not very clever hiding techniques, for the most part these are the most basic techniques known to every 15 year old malware dev reading decades old literature. Ars fell for marketing speech from an AV company that has every reason to hype their discovery.

trelane 4y ago
Any resources (books, articles) you'd recommend for those with a very technical background interested in getting up to speed on the side?
- prvit 4y ago
  I linked a ton of git repos in another comment here, some of them have very readable code. LD_PRELOAD rootkits are super easy to understand. Phrack has tons of relevant content, Blackhatacademy has some (https://nets.ec/LD_Preload https://nets.ec/LD_Preload) A quick google search also found this simple walkthrough https://fluxius.handgrep.se/2011/10/31/the-magic-of-ld_preload-for-userland-rootkits/ https://fluxius.handgrep.se/2011/10/31/the-magic-of-ld_prelo...

notakio 4y ago

It certainly feels like a nation state's work, or, at the very least, an "advanced persistent threat" group. The packet capture pre-filter aspect, at very least, is strongly reminiscent of code I've seen from a couple of particular SE Asian APT-designated groups.

prvit 4y ago
What reason do you have to believe that besides the targets? Feature-wise this isn't significantly more advanced than public LD_PRELOAD kits like Umbreon, developed by literal children. A basic BPF filter isn't fancy or difficult to implement.
- notakio 4y ago
  Primarily, similarity to forensics samples I've seen via incident response. But you're right; the individual aspects of this aren't particularly outstanding or complex, it's the lack of uncrossed T's and undotted I's, overall, that makes me lean toward the conclusion I'm making. Kids tend to be sloppier than criminal malware organizations, as criminal malware organizations tend to be sloppier than APT groups.