3 ms·

"It can't be detected using the common netstat command." How is this possible? I thought netstat would show any program which is listening for connections on a

by wjoe 12y ago

"It can't be detected using the common netstat command." How is this possible? I thought netstat would show any program which is listening for connections on a port, regardless of whether it's actively doing anything.

mahouse 12y ago
From what the article says (and it's not very concise as you can see) it's not listening for connections, or at least it's not listening for connections until it's "awoken" by something external.
- tedunangst 12y ago
  > it's not very concise as you can see The article is very concise. It's just not very correct. :)
gizmo686 12y ago
Assuming the trojan has a rootkit, it can patch the kernel so that netstat does not report it.
- mreiland 12y ago
  honestly I was trying to figure out how this is something new. rootkits have been around for a long time now.
- tptacek 12y ago
  Is there any evidence that it patches the kernel? If it infiltrates the kernel, you'd think that'd be the most important detail Kaspersky could reveal; forget about whether the authors ran "strip" on the binary or not.
  - gizmo686 12y ago
    You're right. I misread the article where it said that the Windows malware had a rootkit. Checking the linked technical description [0] it looks like the Linux version does not require privlage escalation. [0] https://securelist.com/blog/research/67962/the-penquin-turla-2/ https://securelist.com/blog/research/67962/the-penquin-turla...
renaudg 12y ago
The program doesn't set up a listening socket (which would show up in netstat), it's doing what is normally the kernel's job (analyzing traffic on the interface and parsing IP packets) all by itself in userspace.
- tptacek 12y ago
  And it's using libpcap to do it, making it (in that regard) asymptotically as sophisticated as dsniff. It appears to literally be using cd00r, which FX wrote almost 15 years ago. It's like they assembled it out of junkyard parts from PacketStorm.
kh_hk 12y ago
http://www.phenoelit.org/stuff/cd00r.c http://www.phenoelit.org/stuff/cd00r.c
- e12e 12y ago
  But it still need root or CAP_NET_RAW?
  - kh_hk 12y ago
    The article does not mention anything about privilege escalation, but this backdoor requires root.

by wjoe 12y ago

mahouse 12y ago

From what the article says (and it's not very concise as you can see) it's not listening for connections, or at least it's not listening for connections until it's "awoken" by something external.

tedunangst 12y ago
> it's not very concise as you can see The article is very concise. It's just not very correct. :)

gizmo686 12y ago

Assuming the trojan has a rootkit, it can patch the kernel so that netstat does not report it.

mreiland 12y ago
honestly I was trying to figure out how this is something new. rootkits have been around for a long time now.
tptacek 12y ago
Is there any evidence that it patches the kernel? If it infiltrates the kernel, you'd think that'd be the most important detail Kaspersky could reveal; forget about whether the authors ran "strip" on the binary or not.
- gizmo686 12y ago
  You're right. I misread the article where it said that the Windows malware had a rootkit. Checking the linked technical description [0] it looks like the Linux version does not require privlage escalation. [0] https://securelist.com/blog/research/67962/the-penquin-turla-2/ https://securelist.com/blog/research/67962/the-penquin-turla...

renaudg 12y ago

The program doesn't set up a listening socket (which would show up in netstat), it's doing what is normally the kernel's job (analyzing traffic on the interface and parsing IP packets) all by itself in userspace.

tptacek 12y ago
And it's using libpcap to do it, making it (in that regard) asymptotically as sophisticated as dsniff. It appears to literally be using cd00r, which FX wrote almost 15 years ago. It's like they assembled it out of junkyard parts from PacketStorm.

kh_hk 12y ago

http://www.phenoelit.org/stuff/cd00r.c http://www.phenoelit.org/stuff/cd00r.c

e12e 12y ago
But it still need root or CAP_NET_RAW?
- kh_hk 12y ago
  The article does not mention anything about privilege escalation, but this backdoor requires root.