8 ms·
Security researchers identify new malware targeting Linux
- deleted 2y ago[deleted]
- linsomniac 2y agoIf I am skimming this correctly, this is a C&C client allowing remote control over the network, and uses "a rootkit" for further compromise once it somehow gets installed? I understand the value of in-depth security reports, but the 5th time they told me "WolfsBane is the Linux counterpart of Gelsevirine, while FireWood is connected to Project Wood." I was wondering when I'd get to the meat and potatoes.
- gerdesj 2y ago"once it somehow gets installed?" The report mentions: "we conclude ... exploited an unknown web application vulnerability ... ." The chain of events, post initial exploit, is all very well but what was the initial point of entry? The IoCs etc are welcome - thanks.
- aorloff 2y agoI thought SQL injection but actually Tomcat ? Might be just an old unpatched server allowing PUTs
- deleted 2y ago[deleted]
- PcChip 2y agoI agree it was very wordy
- snvzz 2y agoFor signs of the analyzed version, there's this file: /lib/systemd/system/display-managerd.service And a process called "kde".
- stepupmakeup 2y agoWhat's the point of these kinds of articles? Most Linux malware (including this one) are not sophisticated at all, built off of pre-existing rootkit code samples off Github and quite sloppy with leaving files and traces (".Xl1", modifying bashrc, really?). And there's a weird fixation on China here, is it just more anti-China propaganda?
- jamesmotherway 2y agoThreat actors don't create malware to impress people; they do it to accomplish their goals. Apparently, this sample was sufficient for them. Security companies attribute activity based on their observations. ESET- a Slovakian company- is no exception.
- stepupmakeup 2y agoI was under the impression that persistent, but SILENT access was China's goal. Dropping files in home and /tmp/ seems like the total opposite of that and any competent sysadmin would detect these anomalies manually real quick with a simple "ls -a", even possibly by accident.
- NegativeK 2y agoChinese threat actors are not one homogeneous group. Just like every other country out there.
- jchmbrln 2y agoFrom the article: > The WolfsBane Hider rootkit hooks many basic standard C library functions such as open, stat, readdir, and access. While these hooked functions invoke the original ones, they filter out any results related to the WolfsBane malware. I took this to mean some things like a simple “ls -a” might now leave out those suspicious results.
- TacticalCoder 2y ago> The FireWood backdoor, in a file named dbus, is the Linux OS continuation of the Project Wood malware... > The analyzed code suggests that the file usbdev.ko is a kernel driver module working as a rootkit to hide processes. Where is the backdoor coming from? If there's a backdoor, something is backdoored. An unknown exploit installing a rootkit and using a modified file, like usbdev.ko, is not a backdoor. Which pakage / OS ships with the backdoor? Or doesn't the author of TFA know the definition of a backdoor? Or is it me? I mean, to me the XZ utils exploit attempt was a backdoor (for example). But I see nothing here indicating the exploit they're talking about is a backdoor. It reads like they classify anything opening ports and trying to evade detection as "backdoors". Am I going nuts?
- remram 2y agoFits the usual definition, e.g. from Wikipedia: > A backdoor is a typically covert method of bypassing normal authentication or encryption
- aulin 2y agoAgree with OP, wikipedia is also wrong. A backdoor is something intentional. That definition fits any exploitable bug.
- wood_spirit 2y agoPerhaps we use the term back door in computer security because it comes from the general English expression to get someone or something in by the back door, which more generally is any exploit?
- remram 2y agoNeither Wikipedia nor GP said something about intentions. My understanding of GGP's complaint is that they'd refer to the package containing the security issue as "backdoor", rather than the malware itself, and I disagree. This driver thing is a backdoor, the package is backdoored, this fits usual definitions.
- 2y ago
- ajsnigrutin 2y agoSo, an aplication started as root it does a lot, if started as a normal user, does less. Sure, any first year CS student can write something like that. Or you can.. well.. install an ssh server or a vnc server or whatever. How it gets onto the system in the first place is the interesting (and dangerous) part, that sadly gets skimmed over here.
- INTPenis 2y agoI agree. Sophisticated to me would be if they tried to MITM the sudo command. Instead they simply place code into profile.d and run when the user logs in.
- lyu07282 2y agoSophisticated would be fileless with persistence through flashing of some firmware code, but those aren't gonna be uploaded randomly on virustotal lmao
- cookiengineer 2y agoSeems like their malware relies on a couple of things: - intended target is KDE and GNOME - privilege escalation through LD_PRELOAD hooking from userland via open, stat, readdir access (of any other program that the user executes, see down below) - persistence through display manager config for KDE - persistence through desktop autostart files for GNOME - fallback persistence through .bashrc, profile or profile.sh in /etc - installs trojanized ssh client version - installs a JSP webshell - sideloads kernel module as libselinux.so and .ko module. Probably the rootkit helpers to access them from userland Despite the snarky comments in here, this malware is actually quite sophisticated. If you don't agree, I challenge you now to measure the time it takes for you to find all .so files on your system that are loaded right now, and have been modified since your package manager installed them. My point being that there is no EDR on Linux that catches this (apart from ours that's WIP), because all existing tools are just checking for windows malware hashes (not even symbols) as they're intended for linux fileservers.
- b3lvedere 2y ago>intended target is KDE and GNOME Apologies for the dumb question, but does this mean my PiHole running on a small Debian server that has no KDE or Gnome installed, is safe from this?
- cookiengineer 2y agoYes, if it's not running Tomcat. (Personal opinion: You should never run Tomcat, history of really unsecure development practices)
- c16 2y agoWhat AV (if any?) would people recommend for linux? I feel that clamav is more for incoming files than something which would or could catch this?
- INTPenis 2y agoNone, I would instead recommend monitoring file paths and alerting when they change. Known as a tripwire system. In this case for example the attackers tried to hide their files by disguising them as other known file paths on the system. If you use a tripwire setup you will get an alert when a file appears that is not supposed to be there. Of course this requires a more hands-on approach where you create excludes for all your applications.
- internet_points 2y agoAny tools or resources you'd recommend for this?
- INTPenis 2y agoI favor Red Hat and I know we use ossec at work. I believe you can use it under a free license but the configuration is rather complex imho. There is also snort which is a more libre project, but it's more of a full featured IDS that try to sell subscriptions for patterns. Think of them sort of like virus definitions but for rootkits and intrusions. You can technically setup Snort as a tripwire. A tripwire is very simple, some people have made them from scratch using Cronjobs and shell scripts. They simply maintain a database of all your files and their checksums, and alert you when a checksum changes. But security is more than just an IDS. I would recommend SElinux+IDS+remote logging+MFA+granular user security and more!
- lowleveldesign 2y agoThere is also Sysmon for Linux [1]. I work often with Windows systems that's how I know it (it's a popular choice on Windows to analyze Sysmon logs for suspicious events), but it's probably niche in Linux world. [1] https://github.com/microsoft/SysmonForLinux https://github.com/microsoft/SysmonForLinux
- gorgonical 2y agoThe use of LD_PRELOAD as part of the attack surface makes me think that a statically-linked binary has some value. Not a maximalist approach like some experimental distros, but I think there's clearly some value in your standard userland utilities always performing "as you expect," which LD_PRELOAD subverts. Plenty of Linux installs around the world get on fine using BusyBox as the main (only?) userland utility package.
- saagarjha 2y agoThey load a kernel driver so your avoidance of LD_PRELOAD wouldn’t really be able to protect against this anyway.
- gorgonical 2y agoUnless I misread they don't state exactly how the attack escalates privileges to install the driver. Could there be two versions of the attack with varying levels of severity?
- voidUpdate 2y agoThese things always get really cool names, like "Wolfsbane" and "firewood". makes me want to make some malware to see what cool name security researchers give it lol
- deleted 2y ago[deleted]