10 ms·
Powerful, highly stealthy Linux trojan may have infected victims for years
- codezero 12y agoIs there a quick and dirty script/one liner I can run to check my VPS right now?
- etcet 12y agoThis may take a while depending on the amount of data you have and the speed of your disk(s): grep -R -e 'TREX_PID=%u' -e 'Remote VS is empty !' / Alternatively you could create ClamAV signatures based on those strings.
- foxylad 12y agoThanks. Being able to provide simple easily verified command on a public forum to detect the most stealthy malware is testament to the brilliant design of unix-style systems. If someone offered a Widows utility to do the same thing on a forum, only fools would run it.
- tedunangst 12y agoBecause you can't type a search string into the search box in explorer on windows?
- gaadd33 12y agoThe search box in explorer searches binaries these days? Honest question, I haven't used it in years. That seems like it would be pretty counterintuitive for users though. Someone tries to search for the string 'program' and it returns all binaries that have 'This program cannot be run in DOS mode' in them. (Which I think is pretty much all PE binaries)
- tedunangst 12y agoI recall "search all files" looking inside pretty much everything, including exe and unknown file types. (it's been a while for me, too.)
- gizmo686 12y agoI recall "search all files" only searching indexed folders, which by default leaves a lot of room for the virus to install itself somewhere that is not being search without even trying.
- tedunangst 12y agoAnd then you click "search all folders (may be slow)".
- nfoz 12y agoI appreciate what you're saying but you could have re-phrased without the negative sarcasm.
- munin 12y agothey would just need to paste a command line to findstr: http://technet.microsoft.com/en-us/library/cc732459.aspx http://technet.microsoft.com/en-us/library/cc732459.aspx but don't let facts get in the way of your platform wars...
- finid 12y agoThat's why I won't use any OS that's not Unix-like. grep for this and that in this directory. Brilliant!
- danieltillett 12y agoWhere does this come from?
- etcet 12y agoI can't confirm that it works but I was going off this: > Administrators who want to check for Turla-infected Linux systems can check outgoing traffic for connections to news-bbc.podzone[.]org or 80.248.65.183, which are the addresses of known command and control channels hardcoded into the Linux trojan. Admins can also build a signature using a tool called YARA that detects the strings "TREX_PID=%u" and "Remote VS is empty !"
- danieltillett 12y agoThanks for this. Before I set off a search like this on my server I like to know why :)
- Bill_Dimm 12y agoThis seems to get stuck for me after a few minutes (grep stops taking up CPU cycles). I thought maybe it was getting stuck trying to read something it shouldn't, but lsof gives no clues.
- bitozoid 12y agoI suggest with nice/ionice: ionice -c 3 nice -n 19 grep -R -e 'TREX_PID=%u' -e 'Remote VS is empty !' / You can also check the whole drive: ionice -c 3 nice -n 19 grep -ab -e 'TREX_PID=%u' -e 'Remote VS is empty !' /dev/sda
- tptacek 12y agoWhy exactly are you checking your VPS for this particular piece of malware? Look at grsecurity; everything it stops is table stakes for Linux exploit code.
- deleted 12y ago[deleted]
- semenko 12y agoDetails via: https://securelist.com/blog/research/67962/the-penquin-turla-2/ https://securelist.com/blog/research/67962/the-penquin-turla... Notably, the C&C domain has been sinkholed by Kaspersky. This has been linked to the complex "Turla" industrial espionage malware, as it shares a C&C server. (Turla: http://securelist.com/analysis/publications/65545/the-epic-turla-operation/ http://securelist.com/analysis/publications/65545/the-epic-t... )
- dsl 12y agoThe Turla malware sends data back using PHP proxies running on hacked servers. The same PHP proxy script is used by MiniDuke. MiniDuke in turn screams Russia in its target selection and spear phishing related to the Ukrainian bid to join NATO.
- click170 12y agoI concede that it's not a panacea, but I really do feel like filtering outbound requests is going to be one of the best defences we have against stuff like this going forward. It protects you against: - viruses / trojans that try to call out - ad tracking (and ads in general, if you want) - intrusive analytics - suspect consumer devices (TVs that transmit live audio, network cameras that connect to the cloud even though the cloud feature is disabled, content players that try to report your activity) Edit: formatting
- utefan001 12y agoA division in the company I work for makes a product that addresses unwanted outbound traffic,http://www.novetta.com/commercial/novetta-advanced-analytics/cyber-analytics/ http://www.novetta.com/commercial/novetta-advanced-analytics...
- justincormack 12y agoOnly if you filter outgoing requests from a different box. If the attacker owns your kernel they can bypass the filtering. A nice OpenBSD box as an outbound filter does make sense though, with a different control mechanism.
- _RPM 12y agoWhat about connecting the suspect device to a switch and filtering all of the outbound requests on that switch. If request is approved, forward it to the internet?
- justincormack 12y agoI think you will find you need a decent packet filter that understands state on that "switch" and most switches wont do that in hardware, so it may as well be an appliance.
- SEJeff 12y agoOne kind of neat thing I do is filter outbound traffic based on the user. If you're using s newish distro like centos7/rhel7 or a newer ubuntu, you can filter packets with ip tables based on the user. I force the apps in various docker containers to run as different users (one per major app or major suite of apps), and use up tables to lock those bits down. My wordpress got owned and there was a little perl script attempting to contact the C&C server, which ip tables happily blocked. It isn't a panacea, but security works best in multiple overlapping layers.
- 0x0 12y agoHow can it run packet dumping as a non-root user?
- tedunangst 12y agoLD_PRELOAD? ptrace? Updated: Actually, I have no idea. The securelist link says "It uses techniques that don't require root access" but then later says "The module statically links PCAP libraries, and uses this code to get a raw socket". I have no idea how one gets a raw socket without root, but I'm not in the business of creating raw sockets on linux...
- 0x0 12y agoNot sure I follow, can a non-root user observe raw packets (like SYN packets and sequence numbers) through these facilities? Edit: well, a statically linked pcap is still just a bunch of user-mode assembly code. I didn't think linux kernel security hinged on keeping libraries secret :P
- tedunangst 12y agoI tried interpreting the ars article (rookie mistake) and assumed it was stealing traffic from other programs running as the same user.
- 0x0 12y agoAha, now I see why you brought up ptrace. But they were talking about magic syn packets etc (in the securelist post linked from another comment, I got the sources mixed up)
- jerf 12y agoIn addition to tedunagnst, as we're talking malware, consider also "kernel exploits". Even if the malware doesn't ship with an exploit, a normal UNIX user has enough privs to examine the kernel version and download and execute code that may exploit the given kernel.
- iamleppert 12y agoWhat a worthless article.
- vernie 12y agoWith a comment to match
- wjoe 12y ago"It can't be detected using the common netstat command." How is this possible? I thought netstat would show any program which is listening for connections on a port, regardless of whether it's actively doing anything.
- mahouse 12y agoFrom what the article says (and it's not very concise as you can see) it's not listening for connections, or at least it's not listening for connections until it's "awoken" by something external.
- tedunangst 12y ago> it's not very concise as you can see The article is very concise. It's just not very correct. :)
- gizmo686 12y agoAssuming the trojan has a rootkit, it can patch the kernel so that netstat does not report it.
- mreiland 12y agohonestly I was trying to figure out how this is something new. rootkits have been around for a long time now.
- tptacek 12y agoIs there any evidence that it patches the kernel? If it infiltrates the kernel, you'd think that'd be the most important detail Kaspersky could reveal; forget about whether the authors ran "strip" on the binary or not.
- gizmo686 12y agoYou're right. I misread the article where it said that the Windows malware had a rootkit. Checking the linked technical description [0] it looks like the Linux version does not require privlage escalation. [0] https://securelist.com/blog/research/67962/the-penquin-turla-2/ https://securelist.com/blog/research/67962/the-penquin-turla...
- tptacek 12y agoIt's a userland trojan and it's "one of the most complex APTs in the world"? One wonders what these people would think if they found MosDef in the wild.
- tedunangst 12y ago"This is sophisticated nation-state malware" doesn't sound quite as stupid as "we found this a year ago but didn't know what it was".
- vacri 12y ago"This is ... nation-state malware" I was wondering why Symantec thought it was from a culturally-homogenous country, and why that would be relevant...
- dmix 12y agoI believe they mentioned the fact it couldn't be detected by netstat as an example of it's sophistication. idk how this got 127 upvotes.
- tptacek 12y agoThe irony for me is that if you wrote a trojan that could only be detected by netstat I'd be boned, because I find netstat incomprehensible and tend to use tcpdump to solve those kinds of problems.
- acdha 12y agoI share your snarky reaction but a more depressing way of looking at it is to remember that these are using ancient techniques and are still infecting large numbers of systems. It's not true that the last couple decades have made no progress but it's somewhat sobering that the bar for successful attacker is still set this low…
- dmix 12y ago> last couple decades have made no progress Who has made no progress? Malware forensic experts are not using netcat to detect malware nor are sysadmins. There are plenty of more modern techniques. The problem is no one has cared about security (especially gov, many big corps) until recently...not that the toolsets have been weak. Which is why all the news this year is coming out because they decided to finally check if they've been compromised for the first time.
- jrochkind1 12y ago> Even a regular user with limited privileges can launch it, allowing it to intercept traffic and run commands on infected machines. Huh, how do they do that? > The underlying executable file is written in the C and C++ languages and contains code from previously written libraries, a property that gives the malicious file self-reliance. Does that mean something? I don't get it. I thought arstechnica usually was written for a technical audience.
- gizmo686 12y ago> The underlying executable file is written in the C and C++ languages and contains code from previously written libraries, a property that gives the malicious file self-reliance. I think they mean that the executable is statically linked.
- usefulcat 12y agoIf they're going to use a description that probably sounds cryptic to average readers, they should at least use a description that's meaningful for the more technically knowledgeable.
- deleted 12y ago[deleted]
- Maakuth 12y ago>> Even a regular user with limited privileges can launch it, allowing it to intercept traffic and run commands on infected machines. >Huh, how do they do that? They must have some pretty powerful zero-day vulnerability they're exploiting. Expect patches.
- billyhoffman 12y agoExcept a few paragraphs up they say: "The trojan is able to run arbitrary commands even though it requires no elevated system privileges" This is just a terribly written article. Few if any tech details, and any tech language just doesn't make sense/contradicts itself. Sadly The this is another example of a larger downward trend in the quality of articles on Ars. They should use some of that sweet Conde Nast money and clone John Siracusa a few times!
- annnnd 12y agoI can't shake the feeling that current security measures are designed in the wrong way. Antiviruses are fundamentally flawed (blacklist instead of whitelist; mostly curing instead of preventing). Filtering traffic is difficult (it is relatively easy to hide information in heavy legitimate traffic). Maybe the way ahead is in ensuring that files (and images in memory, flash,...) don't get changed. Maybe we should have some external device which monitors computer components for change? It should have access to all the computer parts and should be without any interfaces except for physical ones (typing directly on its touch screen). Just an idea...
- ori_b 12y agoThe problem is that we currently rely on user discretion. Users are really bad at preventing malware from infecting their system. We can do some things, sure -- sandboxing by default, etc. But when it comes down to it, if the user is able to click an 'allow access to my banking information' button, then that user will be getting screwed. The only response I can think of is taking that power out of the hands of the user, and putting everyone in a walled garden. That is something that I find distasteful. Is there a solution that leaves users in power over their own computers? I don't know.
- tim333 12y agoIn practice I have power over my computer but there is no 'allow access to my banking information' button for most of my bank stuff because the banks don't allow it. The info is on their servers and in the most extreme case I have to use a physical security device to generate a code to access it. Dunno if that's the way forward?
- agumonkey 12y agoA tripwire monitor with "immutable" data (btrfs/zfs snapshots or nix pure packages) to rollback in case of suspicious modification. ChromeOS does this at the OS update level. There's also the genode way http://genode.org/ http://genode.org/ for strong isolation (AFAIK it's different from VM and Containers)
- debacle 12y ago
- zvrba 12y agoDoes there not yet exist a debugger which runs as a hypervisor?
- deleted 12y ago[deleted]
- icantthinkofone 12y ago"The malware may have sat unnoticed on at least one victim computer for years, although Kaspersky Lab researchers still have not confirmed that suspicion." So it might not have? And they're not sure? And "at least one" means it might only be one. All this makes me highly suspicious of the article.
- touristtam 12y agowould the attacker not need to have access to the target machine to install this?