Slashdot Mirror
New Linux Rootkit Emerges
Trailrunner7 writes "A new Linux rootkit has emerged and researchers who have analyzed its code and operation say that the malware appears to be a custom-written tool designed to inject iframes into Web sites and drive traffic to malicious sites for drive-by download attacks. The rootkit is designed specifically for 64-bit Linux systems, and while it has some interesting features, it does not appear to be the work of a high-level programmer or be meant for use in targeted attacks. The Linux rootkit does not appear to be a modified version of any known piece of malware and it first came to light last week when someone posted a quick description and analysis of it on the Full Disclosure mailing list. That poster said his site had been targeted by the malware and some of his customers had been redirected to malicious sites."
There's a new secure OS called Windows 8 - maybe it's time you nerds started upgrading to it!
The harsh light of daylight shines on the Linux security model, and the time of preaching from a pedestal about security due to the fact nobody really uses this OS except hobbyists and niche markets comes shockingly into view. Fact is, all operating systems are insecure, and while it's nice that Linux has gained a reputation as a secure alternative to Windows, the fact of the matter is that no one has really given a shit until now enough to really poke a hole in it. Trust me, the weaknesses are there, and be exploited they shall.
it does not appear to be the work of high-level programmer or be meant for use in targeted attacks
So basically it's installed by some jerkoff contractor with root access, and it's not something involving a hole in the server security?
... The APK copy-paste spam is coming...
How come neither of the links actually describe how this malware infects the machine in the first place? I'd say that's quite an important piece of information completely missing.
Just curious why the root kit is only targeting 64-bit. Is it specifically targeting the intel 64bit spec that allows for privileged escalation, or something like that? Reading the article makes it sound like it's an exploit of the AMD little endian pointers which, since I don't know hardware on that level, I don't know if that means it's actually a CPU exploit or an OS exploit. And if it's a CPU exploit I don't know if it's all AMD64 based including or excluding Intel.
If patch is made, kindly share asap.
Must be specifically targeted at Gentoo then.
If you dig into the articles to some of the raw analysis you'll discover two things.
1) "It remains an open question regarding how the attackers have gained the root privileges to install the rootkit. However, considering the code quality, a custom privilege escalation exploit seems very unlikely." So it unlikely that they gained root with something new, but it was a web site that was hacked, so the likely vector is something related to what the site it was running. PHP, WordPress, DB Injection, and Apache exploits.
2) "Based on the Tools, Techniques, and Procedures employed and some background information we cannot publicly disclose, a Russia-based attacker is likely."
Linux rootkit?
Yes! It's about time some of the big manufacturers got interested in Linux. Way to go Sony.
If it's meant to attack websites, it's aimed at web servers. Do actual production web servers that receive non-trivial levels of traffic and haven't been migrated to 64-bit hardware still exist?
He didn't mention any form of infection. Apparently it is just an application you manually have to start as root, which then hooks itself into the system like a rootkit.
Without infection mechanism, it's not a rootkit. Let alone dangerous.
This is a case of PEBKAC. If somebody has root access, it doesn't matter if he installs some lame rootkit. He already has full access! It's already too late!
Kids these days...
Ok, why this story is tagged with conditionbrownpants? Anybody cares to explain?
(and no, it's not because of my post, because I'm asking after this tag appeared)
#
#\ @ ? Colonize Mars
#
Your boss first funds some smearing of FreeBSD and Linux and now he pays you for your great suggestions. Nice.
1.) Pseudonymous source "stacktrace"
2.) Noone explains which weakness is being "exploited"
I call bullshit on this until they show the code which actually own the Linux kernel. If you could trace this whole thing, I am quite positive it leads to the checkbook of a Mr Ballmer, resident of Redmon, WA, USA.
The best short term defense against this?
Just put /etc/rc.local and the rootkit becomes unloadable. Just like in Debian Squeeze.
exit 0
at the end of your
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
LMAO, from the shock that all the years of /. fud are at an end!
Just out of curiosity:
As a Linux user, in general, how safe is my web-browsing experience from attackers installing the code of their choice on my system?
I run a GNU/Linux 64-bit system that was released in 2012. I use the latest Firefox with common media plugins, running as an ordinary unprivileged user. Assume that I have an average level of awareness of Internet security issues (which is to say: not much, but I am smart enough not to execute random files).
Linux gets used by the majority since they're smallfry and cash strapped since Linux = free. You now see the price of not being able to hide by security by obscurity/lack of widespread usage/majority of marketshare in a particular role. That price? Getting attacked. Just as Windows has been for decades since it has maintained such a majority of usership/marketshare on PC desktops and Servers combined, and it surely isn't the % you quote. On desktops it is a 90% in favor of Windows, and in the Fortune 100/500 it's nearer to 50/50. Oh the glorious years of FUD and complete bullshit lies by the Penguins on slashdot comes to a close in 2012 but they still keep trying to spread the FUD!
http://linux.slashdot.org/comments.pl?sid=3263519&cid=42045967
This rootkit on Linux and the security breach @ FreeBSD http://it.slashdot.org/story/12/11/19/1649254/two-freebsd-project-servers-hacked
Rootkit for Liunux: requires that rc.local have no "exit 0" at the end of the script and a very specific kernel. Darn, my kernel is different *and* I have "exit 0" at the end of /etc/rc.local. The only good part about noting this exploit and rc.local is that when I looked at rc.local I noticed that I don't update my CPU writeable control store currently (and that's something I normally do). Thanks for the notice. I downloaded the latest firmware from Intel, and I've once again got it loading in rc.local (before the exit 0 line). Yay!
A natural reaction to a large 'root' going up into that area of his torso.
The recent "incidents" on xBSD and Linux are short on substance (kernel-level exploits) and long on irrelevant "meat" to impress those who don't know the subject.
It's Propaganda Campaign by Redmond and their "partners" in the Virus Scanner "Protection Business" to scare people away from Free Operating Systems. You bet they have the money to hire shady people to steal an SSH key and you as we see here, they have the money to program pointless "viruses" to be installed while running as root.
This is a clear sign that the Sleazebags in Washington State are Scared To Hell. They know that they can't win on technical or economical merits, so they try Mud-Lobbing.
This "rootkit" fails to demonstrate an actual exploit in a browser and/or the Linux kernel. It's 100% Propaganda.
If you want have even more security, use an AppArmor to limit the access rights of your browser. It has no business in reading your OpenOffice files, for example.
..new Baseless Smear Tactics by a Scared Mr Ballmer.
..all you say must be true.
But here is some good advice for your Evil Lord Ballmer:
1.) Don't always use the old Redmond Propaganda Memes. You are too easy to identify and blasted back into your rathole.
2.) Find an ACTUAL Exploit, instead of coming up with this irrelevant crap. You know, something like "virus hiding in icon on USB stick an pwning the box upon insertion of stick." Something like these hundreds of Windows kernel-level exploits.
"The rootkit is designed specifically for 64-bit Linux systems .. The new Linux rootkit is loaded into memory and once there"
How does this 'rootkit' get executed on the target machine, does it require prior root access in order to sucessfully execute?
AccountKiller
"All Operating Systems Are As Crappily Insecure As Windows".
Except that this "rootkit" has to be run with root privileges to be a threat. Message to Redmond: Unix systems are not browsing as administrative user, unlike the historical norm of WINDOWS.
They happen all the time since Android's a Linux. Security by Obscurity no more Penguins.
Or are you just another Redmond FUD-$hill ?
4 NIX users (BSD hacked, Linux rootkit, Android exploits galore daily) http://linux.slashdot.org/comments.pl?sid=3263519&cid=42047493 so your FUD charade? It's over.
An iframe injection that redirects you to a malicious website where you have to download something and run it as root to get infected sounds almost nothing like something that runs as a normal user and exploits local weaknesses to gain privileged access surreptitiously.
It sounds like just plain old malware - maybe it does have a rootkit as part of the package - but still.. iFrame injection and a slew of other functional abilities are not in the domain of a 'rootkit'. The definition of a worm is a malicious program that replicates itself.
So since the "root kit" involves some other vector letting the intruder append something to rc.local (or somehow pivot on whether rc.local ends with an "exit 0") the root kit ins't a root kit but a post-root-promotion exploit.
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press
Reading the original article I have to ask how does this rootkit get installed. There is enough info on how it works once it is in a system, but nothing on how it can install itself.
As written, it looks like you need direct access to the machine to infect it.
They don't write about any exploit, because they don't have one.
Regarding Sandboxie - on Linux you have several options to do sandboxing. First, there is AppArmor, then there is SE Linux and finally you can roll your own sandbox using Linux Security Modules. A well-defined API you can use according to your specific needs.
But, as I wrote, you don't need sandboxing to defend against this "threat", as it is not a real one. It's just part of a cheap propaganda campaign by M$ and their Partners In Sleaze.
2011. Top Pharmacy List! Best Prices Online!
I noticed that several fairly high profile sites (stumbleupon, apartmentratings) had been compromised and were trying to pump traffic to spammer sites through an iframe on the compromised site about 5 months ago and published it here: http://joshwieder.blogspot.com/2012/07/blogger-traffic-source-spam-stumbleupon.html
None of the servers I am responsible for were infected. Without server side access, I didnt see the cause, just the effects. This bit of software fits the profile rather nicely.
In any event, its worth pointing out there is not much that is new about this.
2011. Top Pharmacy List! Best Prices Online!
Since my code runs perfectly (and it did @ least 5x in front of you this week, and many more times before that as well, plus 100's of times vs. trolls (simply giving them what they NEED, in a dose of "ReVeRsE-PsyChoLoGy', lol))?
* Have you *ever* considered that it's /. formatting upon my pasting it that causes the format I get on posting the actual code itself?
(Some "Food 4 Thought" for you there, lol, 'CruTcHy'...)
APK
P.S.=> I can see it now, lol: A lightbulb ignites over 'CruTcHy''s puny skull, lmao... (it's a bit dim, like 'CruTcHy', but... it's there!)
... apk
hmm,
are there any sources or similiar out of the rk for further studies?
Many thanks for any hint...