4 ms·

Use statically-linked utilities compiled elsewhere.

by caf 13y ago

jet1 13y ago
Can you explain in a more newbie friendly language? How do you detect this? Then how do you remove this? This type of high level tools becoming more mainstream as time passes. Today there is not much generic anti-tools for this or the upcoming ones!
- Tuna-Fish 13y ago
  Firstly, this is not some virus or worm that works it's way onto your machine. It's a payload that someone puts there possibly among other things. This means that if you have this on your machine, or if you have reason to think you have this on your machine, simple removal is not an acceptable solution. Whoever put the rootkit on the machine could have done almost anything else while he did it, and you are not guaranteed to find it all. If you find this on your machine, you need to produce a data-only backup of the machine, kill the partitions, and set it up again. As these rootkits are designed by rather smart people to overcome all existing tools, there simply cannot be generic tools that catch them all. If you get hit by a bunch of script kiddies using outdated tools, things like rkhunter and chkrootkit can help. Modern rootkits are almost by definition undetectable by them. If it's actually new, the way you find out about it is typically either a separate NID box between the machine and the wall that alerts, or the behaviour of the box changing.
  - keithpeter 13y ago
    So for a low traffic Web server like application, we might be running the OS itself (/) from a read only filesystem (e.g. making a 'live' CD-ROM or USB image) and having read/write only for user files and logs? End user here: I just have a Linux laptop, interested in servers on the 'wild' web
    - rbanffy 13y ago
      Booting from an unchangeable image is the Joyent SmartOS approach, IIRC.
- jamesaguilar 13y ago
  Typically when you're compromised, you don't bother trying to fix the problem. You wipe the device and start over from a believed-good backup.
  - jet1 13y ago
    Even wiping device might not be the solution. What if that softwate injected into boot or any other microcontroller of a hw part.
cnvogel 13y ago
Adding to that: Most Linux distributions will have a ready-compiled "busybox" in their repositories (which is a "swiss-army-knife" program incorporating the functionality of a lot of the common utilities). Of course taking it from a potentially infected machine doesn't makes sense, but you might want to copy it over with a usb-stick. $ ldd /usr/bin/busybox not a dynamic executable $ ls -l /usr/bin/busybox -rwxr-xr-x 1 root root 1795976 Jan 20 14:21 /usr/bin/busybox* $ file /usr/bin/busybox /usr/bin/busybox: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=76e26ac5c916fc1e715c9a49c10db3405b26a22c, stripped $ busybox BusyBox v1.22.1 (2014-01-20 17:20:52 MSK) multi-call binary. BusyBox is copyrighted by many authors between 1998-2012. Licensed under GPLv2. See source distribution for detailed copyright notices. Usage: busybox [function [arguments]...] or: busybox --list[-full] or: busybox --install [-s] [DIR] or: function [arguments]... BusyBox is a multi-call binary that combines many common Unix utilities into a single executable. Most people will create a link to busybox for each function they wish to use and BusyBox will act like whatever it was invoked as. Currently defined functions: [, [[, addgroup, adduser, adjtimex, ar, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst, chroot, chrt, chvt, cksum, clear, cmp, comm, cp, cpio, crond, (...) uudecode, uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip
b6fan 13y ago
Or use dlopen, dlsym to get the real function.
- CUViper 13y ago
  Yes, as long as dlopen and dlsym aren't also hooked. You could also use asm to directly invoke sys_ptrace, since this rootkit doesn't have any kernel components.

Use statically-linked utilities compiled elsewhere.

by caf 13y ago

Use statically-linked utilities compiled elsewhere.

jet1 13y ago

Can you explain in a more newbie friendly language? How do you detect this? Then how do you remove this? This type of high level tools becoming more mainstream as time passes. Today there is not much generic anti-tools for this or the upcoming ones!

Tuna-Fish 13y ago
Firstly, this is not some virus or worm that works it's way onto your machine. It's a payload that someone puts there possibly among other things. This means that if you have this on your machine, or if you have reason to think you have this on your machine, simple removal is not an acceptable solution. Whoever put the rootkit on the machine could have done almost anything else while he did it, and you are not guaranteed to find it all. If you find this on your machine, you need to produce a data-only backup of the machine, kill the partitions, and set it up again. As these rootkits are designed by rather smart people to overcome all existing tools, there simply cannot be generic tools that catch them all. If you get hit by a bunch of script kiddies using outdated tools, things like rkhunter and chkrootkit can help. Modern rootkits are almost by definition undetectable by them. If it's actually new, the way you find out about it is typically either a separate NID box between the machine and the wall that alerts, or the behaviour of the box changing.
- keithpeter 13y ago
  So for a low traffic Web server like application, we might be running the OS itself (/) from a read only filesystem (e.g. making a 'live' CD-ROM or USB image) and having read/write only for user files and logs? End user here: I just have a Linux laptop, interested in servers on the 'wild' web
  - rbanffy 13y ago
    Booting from an unchangeable image is the Joyent SmartOS approach, IIRC.
jamesaguilar 13y ago
Typically when you're compromised, you don't bother trying to fix the problem. You wipe the device and start over from a believed-good backup.
- jet1 13y ago
  Even wiping device might not be the solution. What if that softwate injected into boot or any other microcontroller of a hw part.

cnvogel 13y ago

Adding to that: Most Linux distributions will have a ready-compiled "busybox" in their repositories (which is a "swiss-army-knife" program incorporating the functionality of a lot of the common utilities). Of course taking it from a potentially infected machine doesn't makes sense, but you might want to copy it over with a usb-stick. $ ldd /usr/bin/busybox not a dynamic executable $ ls -l /usr/bin/busybox -rwxr-xr-x 1 root root 1795976 Jan 20 14:21 /usr/bin/busybox* $ file /usr/bin/busybox /usr/bin/busybox: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=76e26ac5c916fc1e715c9a49c10db3405b26a22c, stripped $ busybox BusyBox v1.22.1 (2014-01-20 17:20:52 MSK) multi-call binary. BusyBox is copyrighted by many authors between 1998-2012. Licensed under GPLv2. See source distribution for detailed copyright notices. Usage: busybox [function [arguments]...] or: busybox --list[-full] or: busybox --install [-s] [DIR] or: function [arguments]... BusyBox is a multi-call binary that combines many common Unix utilities into a single executable. Most people will create a link to busybox for each function they wish to use and BusyBox will act like whatever it was invoked as. Currently defined functions: [, [[, addgroup, adduser, adjtimex, ar, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst, chroot, chrt, chvt, cksum, clear, cmp, comm, cp, cpio, crond, (...) uudecode, uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip

b6fan 13y ago

Or use dlopen, dlsym to get the real function.

CUViper 13y ago
Yes, as long as dlopen and dlsym aren't also hooked. You could also use asm to directly invoke sys_ptrace, since this rootkit doesn't have any kernel components.