11 ms·
Stealthy Linux rootkit found in the wild after going undetected for 2 years
- le-mark 3y ago> Specifically, it hides files and directories beginning with the names “auwd” and “vmware_helper” from directory listings and hides ports 52695 and 52699, where communications to attacker-controlled servers occur. Do people out there really “allow any” ports on their firewalls? Or are those ports for control inside the firewall only?
- 3np 3y agoOutgoing? You bet. Have you been out there?
- BLKNSLVR 3y agoOutgoing, which I believe this would be, is generally far less restrictive than incoming. I'm playing around with IP address level detecting and blocking using incoming ports as indicators. I'm going to set aside some time to think more about restrictions on outgoing ports as a result of this and your comment. Do some logging of frequently used remote ports over a couple of weeks and create a baseline set of allowed ports, block everything else and see what breaks. I already use the limited Feodo Tracker[0] lists to flag in my firewall logs whether any device on the network has attempted to contact a known C&C IP address. Thanks for push. [0]:https://feodotracker.abuse.ch https://feodotracker.abuse.ch
- BLKNSLVR 3y agoFirst things first, found I've got a bunch of devices doing "internet check" pings to Google's DNS servers once per second! I feel dirty that that's been going on so long. Devices reconfigured to NOT do that at all. Now that's cleared, the log won't be quite so cluttered. Edited to add: Also redirected a whole load of regular NTP queries to remain internal.
- BLKNSLVR 3y agoAlso: time of day restrictions. There's sweet FA traffic that should be going out to the 'net when everyone's asleep. But make sure these rules can be switched on and off in case of emergencies. I had to take my daughter to emergency late one night a few months ago (didn't end up being anything worthy of a story), but got home at 2:30am. My garage door opener gets smart-home-switched-off at 1:00am-ish. At 2:30am, just wanting to go to bed after the stress of an emergnecy room, waiting for that thing to boot up felt like 15 minutes.
- peblos 3y agoLog4shell would have been a much smaller problem if so
- goodpoint 3y agoYes. This is some very basic malware, but real ones will use HTTPS on port 443.
- BLKNSLVR 3y agoOnly allow HTTPS out to FAANG (whatever it is now) + Cloudflare IP address ranges
- Kubuxu 3y agoNothing prevents C&C from being fronted by cloudflare.
- viraptor 3y agoAnd CloudFlare will be extremely happy to let them hide there. They don't care about malware abusing their workers infra. But also "Only allow HTTPS out to FAANG" - ok, so now you're allowing encrypted connections to 2 largest cloud providers. At that point what's the benefit at all?
- jay-barronville 3y ago> They [Cloudflare] don't care about malware abusing their workers infra. This is a serious allegation to make. Do you happen to have some supporting evidence?
- fullspectrumdev 3y agoIt’s widely known and talked about in the infosec community - getting CF to do anything about malicious content on their services is an absolute nightmare. I do understand they don’t want to set any bad precedents internally, but their abuse reporting is abysmal.
- jay-barronville 3y ago
- vitus 3y ago> Or are those ports for control inside the firewall only? It seems so. This traffic likely will not even traverse a firewall -- the article lists the IP addresses used with port 52699, which are all RFC1918 space (172.16.0.0/12).
- RCitronsBroker 3y agoattacking telecom infrastructure smells like possibly state actor related to me
- BLKNSLVR 3y agoNovel protocol usage gives off that kind of smell too.
- RCitronsBroker 3y agooh yes, it does. Good catch. False-Flagging your actions as commercially motivated doesn’t strike me as a hard to construct alibi, either. Certainly not beyond the scope of sophisticated, state aligned actors, except maybe the north-Koreans, that guardians of peace Spiel was entertaining tho. This awakens memories of GCHQ attacks on Belgian(?) telecom providers; they really are inherent gold mines for dragnet surveillance, stealing database, offensive cyberattacks and probably lots more. There’s a reason Huawei is subsidized for offering cheap 5g infrastructure to international clients, it’s a real nice thing to have backdoors to. Not saying the west is much better in this regard, Cisco has been more than compliant in similar shenanigans just to name one.
- fullspectrumdev 3y ago“Using weird protocols” for C&C is old hat for hackers tbh. Well over a decade ago after reading an RFC I switched all my backdoors to use SCTP - a protocol many of my peers had never fucking heard of - and found it evaded a shit tonne of IDS/firewall products.
- deleted 3y ago[deleted]
- foobarian 3y agoOr is it low hanging fruit? :-)
- dooopdoop 3y ago[dead]
- spacecadet 3y ago2 years and they don't know how it starts? Well, I bet we can assume at first it was People. It is probably still largely people, but 2 years of possible persistent C2... I would think by now it's possibly using many other areas of ingress without any people involved.
- halJordan 3y agoOh man great insight. Do wealth inequality next?
- TheLoafOfBread 3y ago[flagged]
- hollerith 3y ago>people will disable SELinux the moment their distro boots first time, because that thing is just massive pain to use Linux with. I think you mean secure boot: the only distros that even try to enable SELinux are Fedora and Red Hat, and on those distros SELinux gets in the way only very rarely. (Source: I am a user of Fedora and Red Hat.)
- izzdrasil 3y agoThey definitely mean selinux. There only needs to be a single issue for an average user to disable selinux.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- hollerith 3y agoI always thought that admins of Linux installs other than Fedora and Red Hat installs rarely bothered with selinux and that it is definitely not enabled on an initial install. I thought selinux was available as a package on non-RH distros, but install it and enabling was very painful unless you are an selinux expert, so almost no one on those distros does. Are you sure you don't mean AppArmor?
- freedomben 3y agoI've been a fedora user and Red hat user since 2010, and worked at Red hat for a few years, though not on RHEL. I think they did mean selinux. You are absolutely right that nowadays it just works for the most part. The big exception is for people deploying applications that don't have selinux config shipped by Red hat. Those people have to configure things properly, and rarely do people bother. If you do things like change the default ports for services, that can also get you in selinux trouble.
- Pixie_Dust 3y agoHow does this “stealthy Linux rootkit” get onto the system in the first place. Without opening a malicious email attachment or clicking on a malicious weblink.
- dspillett 3y agoThose methods would work. Could also be included in pirate content in a torrent or similar (this was a significant vector for windows malware in the 2010s). Some instances could also have been manually placed. Or the creator could have bought the services if a bonnet, installing the seeds on machines already backdoored and open. There are a fair few ways to get new rootkits out there, a number of them difficult to trace back to the true source. EDIT: from the article: The researchers have so far been unable to determine precisely how Krasue gets installed. Possible infection vectors include through vulnerability exploitation, credential-stealing or -guessing attacks, or by unwittingly being installed as trojan stashed in an installation file or update masquerading as legitimate software
- 0xDEF 3y agoToday most (by volume) Linux attacks are against IoT devices that run Linux and SSH with weak/no auth. Behind that are attacks on Linux web servers where exploits in the web application (e.g. WordPress) or the web framework (e.g. Rails) are the attack vector.
- fulafel 3y agoThe posing as a VMware helper process and timeframe hints this may be associated with the recent VMware compromise epidemic(s).
- ufmace 3y agoSeems to me this is probably a later stage thing. Somebody got initial access to a company's systems via such a mechanism to some individual's system. A few more cycles of recon, exploitation, and pivoting later, they may be in a position to install something like this on some actually important server. Use it to maintain access to the things they really want, then delete evidence of the previous steps to cover their tracks. Now that it's at least 2 years after the initial intrusion, it could be pretty tough to determine how that happened and what path the attacker took.
- belltaco 3y agoWould SecureBoot have prevented the rootkit parts of this?
- fullspectrumdev 3y agoProbably not, depending on configuration. You can do very clever things with secure boot on Linux to have all kernel modules signed, etc, but if the attacker has ring0 code execution anyway that can be evaded without a huge amount of effort.
- rs_rs_rs_rs_rs 3y agoLinux rootkits meta really did not change much since 1999.
- fullspectrumdev 3y agoYep. They come in basically the same flavours. Binary replacement (replacing top, ps, netstat, etc with patched versions) is the oldest trick. Syscall hooking kernel root kits largely only vary in how exactly they hook the syscalls - there’s a few methods, but the underlying principle is the same. And then you have userland hooks which usually use LD_PRELOAD to intercept system calls/libc calls to get the job done. Honestly most of the time a full blown root kit is overkill, just name your binary something innocuous and have it not do anything too fucking obvious and nobody will notice.
- CableNinja 3y agoItd be obvious if you really look, but i once discovered in Perl you can make your command look however you want when you run `ps`. I was able to make a process appear to be a kernel process (one with `[]`). It was pretty hard to discover unless you were very familiar with what every kernel process did. Ive discovered other fun ways of hiding things too, such as creating `...` as a directory. The first time i encountered that, it took me a whole day to find that dir.
- matheusmoreira 3y agoNot just Perl. Any Linux process can do it. https://www.man7.org/linux/man-pages/man2/prctl.2.html https://www.man7.org/linux/man-pages/man2/prctl.2.html > PR_SET_NAME > Set the name of the calling thread
- CableNinja 3y agoYeah, it was just that id discovered it when i was using perl.
- Jenda_ 3y ago
- milliams 3y agoKrasue is a Linux Remote Access Trojan that has been active since 20 and predominantly targets organizations in Thailand. Off-topic, but this is the first time I've seen post-1999 year denoted with just two digits without the use of an abbreviating apostrophe.
- consumer451 3y agoIn a Darknet Diaries episode from a while back, I recall a three letter agency person saying something along the lines of "oh, haha they are running desktop Linux, those guys never run anti-virus software, this will be easy..." Can anyone give me any more depth on this? Is a typical desktop Linux distro install more likely to be susceptible to attack by a nation-state level actor?
- steve1977 3y agoI mean there’s people installing stuff with curl | sudo bash and friends, so go figure…
- throwaway09223 3y agoAnti-virus software is utterly worthless in detecting previously-unknown rootkits. Not a factor. The typical attack vector for any system would be compromising the inbound software. This is really easy to do when people are downloading and installing random programs from websites. This used to be less common, but popular cutting edge tools have popularized it recently "distro packaging is too slow, etc, curl|bash to install" On linux, most base software comes from the distro repositories. The question there is how hard it would be to compromise these systems (including one of the mirrors). This includes ancillary packaging systems (pip, cpan, gems, conda, etc)
- consumer451 3y ago> Anti-virus software is utterly worthless in detecting previously-unknown rootkits. Maybe the "this will be easy" part was that without AV software, there was a greater chance that they could just spin up Metasploit, and wouldn't even have to use one their stockpiled zero-days?
- autoexec 3y agoWhy worry about stockpiled zero-days even for non-linux systems when they can just force MS or Apple to hand over data or inject whatever they want into an OS "update".
- ninkendo 3y agoQuestion to HN, is chkrootkit still useful to use at all? I remember using that tool decades ago thinking it gave me some semblance of peace of mind, but I’ve also kind of assumed that sophisticated malware would likely be able to evade it.
- halJordan 3y agoProbably not. It's probably similar to windows AVs saying they can catch empire or meterpretor. They can, but it's also not too hard to change the signature away from default
- aborsy 3y agoI wonder if using Qubes-OS will solve some of these security problems. The architecture is pretty good, and I’m surprised it has not been already adopted by OS vendors. But on the other hand, there is huge amount of code installed, and with far fewer eyes on it. Another option is ChromeOS, but that’s tied to google. Also, I’m not sure if it can replace Linux desktop (there is option of installing Linux). A third option is a minimax Debian. The software that the user needs will mostly be installed in VMs.