New Linux Rootkit Emerges

No big deal? by YodasEvilTwin · 2012-11-20 05:49 · Score: 1

it does not appear to be the work of high-level programmer or be meant for use in targeted attacks

So basically it's installed by some jerkoff contractor with root access, and it's not something involving a hole in the server security?

Infection method? by Gaygirlie · 2012-11-20 05:50 · Score: 5, Insightful

How come neither of the links actually describe how this malware infects the machine in the first place? I'd say that's quite an important piece of information completely missing.

Re:Infection method? by hawguy · 2012-11-20 06:00 · Score: 2, Informative

How come neither of the links actually describe how this malware infects the machine in the first place? I'd say that's quite an important piece of information completely missing.
I don't think it's self-replicating or installing itself by some vulnerability, I believe it would have to be installed maliciously (perhaps by an employee, or maybe by someone using an unrelated root exploit), or as a Trojan Horse - many people are happy to blindly install unsigned packages on their system, running the installation as root.
Back in the day, I used to make at least a cursory inspection of the Makefile and sometimes would even look over the source code associated with distributed packages. But now I just install the package without even paying attention to what files are being installed. I am a little careful about where I download my packages from, and almost always installed signed packages by a trusted distributor, but I do install packages from unknown developers from time to time.
Re:Infection method? by hobarrera · 2012-11-20 06:12 · Score: 2

Indeed. All it says is thay you're redirected to an iframe. How it breaks out of the browser's sandbox and then obtains root priviledges isn't mentioned either. I'm quite interested in how they achieved this too, since it would mean that there's a huge priviledge escalation in linux that nobody noticed.
Re:Infection method? by ThatsNotPudding · 2012-11-20 06:27 · Score: 1

How come neither of the links actually describe how this malware infects the machine in the first place? I'd say that's quite an important piece of information completely missing.
It's something new in the Defense of The Dark Arts: Security Thru Obscurity!
Re:Infection method? by Gaygirlie · 2012-11-20 06:35 · Score: 1

That does not explain how it gets installed.
Re:Infection method? by sl4shd0rk · 2012-11-20 06:38 · Score: 2

Looks like an infected kernel module so one of the below:
1) server was cracked, and module compiled
2) compromised kernel mod in distro
more likely #1 but probably too early to tell. Grepping kernel sources for some of the text in the module_init binary may be fun:
http://seclists.org/fulldisclosure/2012/Nov/94

--
Join the Slashcott! Feb 10 thru Feb 17!
Re:Infection method? by tyleroar · 2012-11-20 06:43 · Score: 3, Informative

I think you are confused as to what this is doing. How the malware initially got loaded onto the *NIX box is not discussed in the write-up. The malware does not break out of the browser's sandbox and obtain root privileges. The malware is used to add/change the file being served by the web server. There is no mention of what file the malware was being used to serve up...it could be used just to transparently serve up ads or could be used to serve up some client-side exploits.

--
Portland, North Dakota Puppies
Re:Infection method? by squiggleslash · 2012-11-20 07:55 · Score: 1

To be honest, other than constantly using the word "rootkit", I don't see any references to getting root via this "kit". And the link (this one: https://threatpost.com/en_us/blogs/new-linux-rootkit-emerges-112012) looks like it was written by a computer program pulling random sentences from a malware description and turning it into an article.
I'm going to wait for the dup, hopefully it'll link to an Ars Technica article or something else relatively reputable.

--
You are not alone. This is not normal. None of this is normal.
Re:Infection method? by marcosdumay · 2012-11-20 12:13 · Score: 1

Maybe it depends on stupid users clicking OK on a download dialogue and then running a compiled ELF binary
You can't run a program by just clicking OK on a browser dialogue. No Linux browser knows how to chmod a downloaded file.

--
Rethinking email
Re:Infection method? by donaldm · 2012-11-20 21:27 · Score: 1

How come neither of the links actually describe how this malware infects the machine in the first place? I'd say that's quite an important piece of information completely missing.
From the article. "Since the command is appended to the end of rc.local, there might actually be shell commands that result in the command not being executed as intended".

The only way to write or edit rc.local is as root, however if you are running a Fedora distribution rc.local does not exist.

--
There ain't no such thing as proprietary standards only proprietary formats. Standards are by definition open.
Re:Infection method? by defaria · 2012-11-21 03:53 · Score: 1

Then how is this a rootkit? It is not by that definition.
Re:Infection method? by marcosdumay · 2012-11-21 13:23 · Score: 1

Yes, wine does that. But I've never seen KDE running scripts that didn't have the execution bit set. I can't tell about mono, as I simply never installed it.

--
Rethinking email
Re:Infection method? by scared+masked+man · 2012-11-21 15:52 · Score: 1

Firefox on linux used to be able to execute arbitrary commands from extensions: I wrote one which did that on Firefox 2 and ported it to firefox 3. that means if you can fool someone into installing your extension, you've got them.
Similarly, a *.desktop file (used for Gnome and KDE desktop items) can contain arbitrary shell script. This doesn't need +x, because it isn't executed directly when you click on it, instead the string is passed to system(3). The way I'd use that would be to overwrite a common program's file, then use that to find something which is called via the graphical sudo (wireshark or the package manager, for example), and patch that to insert my evil kernel module.
I'm sure there are other places where scripts could be inserted without needing to do a chmod or find an undocumented flaw.

Why Only 64-bit by medv4380 · 2012-11-20 05:51 · Score: 2

Just curious why the root kit is only targeting 64-bit. Is it specifically targeting the intel 64bit spec that allows for privileged escalation, or something like that? Reading the article makes it sound like it's an exploit of the AMD little endian pointers which, since I don't know hardware on that level, I don't know if that means it's actually a CPU exploit or an OS exploit. And if it's a CPU exploit I don't know if it's all AMD64 based including or excluding Intel.

Re:Why Only 64-bit by Sulphur · 2012-11-20 06:02 · Score: 1

Just curious why the root kit is only targeting 64-bit. Is it specifically targeting the intel 64bit spec that allows for privileged escalation, or something like that? Reading the article makes it sound like it's an exploit of the AMD little endian pointers which, since I don't know hardware on that level, I don't know if that means it's actually a CPU exploit or an OS exploit. And if it's a CPU exploit I don't know if it's all AMD64 based including or excluding Intel.
Did it work on 32-bit?
Re:Why Only 64-bit by hobarrera · 2012-11-20 06:11 · Score: 4, Informative

amd64 is the name of the architecture you normally call "64bits" or "x86_64" every day, and is an extension of "i686".
The name is so merely because amd came up with it.
Intel's modern microprocessors are amd64 as well (they just call it a different name).
Re:Why Only 64-bit by quintus_horatius · 2012-11-20 06:21 · Score: 3, Interesting

FTFA (emphasis added):

"To hook private functions that are called without indirection (e.g., through a function pointer), the rootkit employs inline code hooking. In order to hook a function, the rootkit simply overwrites the start of the function with an e9 byte. This is the opcode for a jmp rel32 instruction, which, as its only operand, has 4 bytes relative offset to jump to," Georg Wicherski of CrowdStrike wrote in a detailed analysis of the new Linux malware.
"The rootkit, however, calculates an 8-byte or 64-bit offset in a stack buffer and then copies 19 bytes (8 bytes offset, 11 bytes unitialized) behind the e9 opcode into the target function. By pure chance the jump still works, because amd64 is a little endian architecture, so the high extra 4 bytes offset are simply ignored."
Re:Why Only 64-bit by mlts · 2012-11-20 07:01 · Score: 1

If I were a betting person, I'd say the reason why it was built for 64 bit architectures is because most servers use more than 4GB of RAM, which is the limit for 32 bit operating systems. I could be completely wrong on all counts though.
Re:Why Only 64-bit by fearlezz · 2012-11-20 08:18 · Score: 1

I'm not so sure about that. The kernel module uploaded to the full discosure list happened to be a amd64 module targetting debian kernel 2.6.32-5. But when it's not php, most malware I've seen was distributed as source code, compiled at the target machine to match the targets specifications.

--
.sig: No such file or directory
Re:Why Only 64-bit by medv4380 · 2012-11-20 08:47 · Score: 1

I read that already, but "By pure chance the jump still works, because amd64 is a little endian architecture" which makes me think this is an exploit of the CPU, and not an exploit of the OS. From what that says it overwrites the start of the function that it's targeting with a relative jump of 32 bits of 1 byte. It then calculates a 64 bit address of 8 bytes I assume this is the address of some Root Level command. It then copies the 8 bytes after the 1 byte rel32 byte and an additional 11 bytes of junk. Then some magic happens with the little endian arch and it only reads 4 bytes of the 8 when it does the relative jump. So was the exploit that the OS let the malware overwrite the functions start. Was it that the OS let the malware calculate the 64bit address to no ware. Or was the exploit that the CPU ignored the 4 bytes of the 8 bytes resulting in it going to a completely different part of memory? If it's the CPU's fault then this exact trick would work on Windows. If it's the OS fault then this wouldn't work this way in Windows.
Re:Why Only 64-bit by medv4380 · 2012-11-20 09:03 · Score: 1

Except Intel didn't implement AMD64 correctly 100%. You can read the US-CERT for yourself if you want. For that all you had to do was run a couple of commands and your code could be escalated to kernel level privileges, but only on Intel 64bit. It would be bad to assume that what works on one as an exploit would work the same way on the other. My concern is about this being a flaw in the CPU similar to what happened with Intel 64bit.
Re:Why Only 64-bit by antdude · 2012-11-20 12:38 · Score: 1

That is confusing. :( I kept thinking amd64 is only for AMD and not Intel.

--
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Re:Why Only 64-bit by marcopo · 2012-11-20 20:10 · Score: 1

Finally something that works better on 64-bit.
Re:Why Only 64-bit by donaldm · 2012-11-20 21:34 · Score: 1

That is confusing. :( I kept thinking amd64 is only for AMD and not Intel.
They are both fully binary compatible.

--
There ain't no such thing as proprietary standards only proprietary formats. Standards are by definition open.
Re:Why Only 64-bit by antdude · 2012-11-21 01:01 · Score: 1

Yeah, now I know. They should just remove AMD part. :P

--
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Re:Why Only 64-bit by Qu4Z · 2012-11-21 16:28 · Score: 1

There's no "exploit". The emphasized section just says the programmer was incompetent, but by chance his rootkit still (mostly) works.
Again, this is a rootkit. You need root access through some other means to install it. Still a nuisance, though.

Re:Security through obscurity FAIL by Gaygirlie · 2012-11-20 05:52 · Score: 4, Informative

Yada-yada-blabber-blabber.

nobody really uses this OS except hobbyists and niche markets

Yeah, what with Microsoft, Amazon, Google, Valve and so on. Oh, pssh, they're irrelevant; they count as nobodies, right?

Re:There's a new secure OS called... by Sulphur · 2012-11-20 05:53 · Score: 4, Funny

There's a new secure OS called Rootkit Server 12 - maybe it's time you nerds started upgrading to it!

This is the year of the Linux rootkit.

Re:Security through obscurity FAIL by 0123456 · 2012-11-20 05:54 · Score: 2

Since you're so knowledgeable, maybe you could explain to us which 'weakness' this rootkit is exploiting to get itself installed?

Re:Security through obscurity FAIL by Penguinisto · 2012-11-20 06:17 · Score: 4, Informative

Dunno about AC, but first glance seems to be that it exploits shitty PHP code in order to get itself hosted onto the websites.

According to TFA, it appears to target one specific kernel (Debian-based), and tries to do some hokey-pokey with RAM to get itself executed. If you want a better description go to the original report

TFA gives some details, however:

The kernel module in question has been compiled for a kernel with the version string 2.6.32-5. The -5 suffix is indicative of a distribution-specific kernel release. Indeed, a quick Google search reveals that the latest Debian squeeze kernel has the version number 2.6.32-5.

The module furthermore exports symbol names for all functions and global variables found in the module, apparently not declaring any private symbol as static in the sources. In consequence, some dead code is left within the module: the linker can't determine whether any other kernel module might want to access any of those dead-but-public functions, and subsequently it can't remove them.

...doesn't say exactly how, but there is one thing that is entirely left out of the equation... if it's a drive-by download, does it definitely require user involvement, or not? According to the original report, the complaints were that they customers were being redirected to a malicious site, but nothing about a trojan being involved.

--
Quo usque tandem abutere, Nimbus, patientia nostra?

Re:Security through obscurity FAIL by Penguinisto · 2012-11-20 06:19 · Score: 2

He may be a bastard, but he makes the trains run on time.

...try and submit some shit code onto Linus' lap for kernel inclusion... I dare you. ;)

--
Quo usque tandem abutere, Nimbus, patientia nostra?

Re:There's a new secure OS called... by DickBreath · 2012-11-20 06:23 · Score: 2

> This is the year of the Linux rootkit.

. . . on the desktop?

Or on hundreds of millions of Android phones. Or supercomputers. Or TiVos or other DVRs. Or routers, printers, and countless other devices. OMG the world is going to end in 2012!!!

Better to switch to a safe proprietary OS that has never had a security problem.

--

I'll see your senator, and I'll raise you two judges.

Rootkit emerged by Anonymous Coward · 2012-11-20 06:24 · Score: 3, Funny

Must be specifically targeted at Gentoo then.

Infection Method - Well it's not... by Kagato · 2012-11-20 06:25 · Score: 5, Informative

If you dig into the articles to some of the raw analysis you'll discover two things.

1) "It remains an open question regarding how the attackers have gained the root privileges to install the rootkit. However, considering the code quality, a custom privilege escalation exploit seems very unlikely." So it unlikely that they gained root with something new, but it was a web site that was hacked, so the likely vector is something related to what the site it was running. PHP, WordPress, DB Injection, and Apache exploits.

2) "Based on the Tools, Techniques, and Procedures employed and some background information we cannot publicly disclose, a Russia-based attacker is likely."

Re:Infection Method - Well it's not... by Gaygirlie · 2012-11-20 06:41 · Score: 2

1) "It remains an open question regarding how the attackers have gained the root privileges to install the rootkit. However, considering the code quality, a custom privilege escalation exploit seems very unlikely." So it unlikely that they gained root with something new, but it was a web site that was hacked, so the likely vector is something related to what the site it was running. PHP, WordPress, DB Injection, and Apache exploits.
That's what I thought, too, but it should be researched more carefully. If the malware in question was injected in the first place via PHP, WordPress or something similar then that makes this much, much less of an important issue. However, if the malware did indeed use one or another exploit in the kernel or the default GNU userland, well, THAT would be truly news-worthy and should raise some serious flags.
Re:Infection Method - Well it's not... by Gaygirlie · 2012-11-20 10:20 · Score: 1

You clearly didn't read TFA. (The one with the black background.)
It doesn't contain any form of exploit at all. It is a program that has to be executed as root. If you are root, you already can do everything. (Like write to /dev/mem.) No need for exploits.
It isn't even a rootkit. Because "rootkit" implies getting root access from a non-root state.
You're assuming things. I did obviously read TFA. The thing is that the kernel module and its files could be a PART of a rootkit, not that the module itself contains any exploit code. That's why I used the wording "malware in question was injected," ie. the actual infection was done by another entity -- we just do not yet know whether or not it was done by a human person or computer code.
Re:Infection Method - Well it's not... by marcosdumay · 2012-11-20 12:17 · Score: 1

Because "rootkit" implies getting root access from a non-root state.
That's priviledge escalation. A rootkit is a piece of malware that disgusses itself by installing hooks at system functions.

--
Rethinking email
Re:Infection Method - Well it's not... by khairephon · 2012-11-20 20:52 · Score: 1

A Russia based attacker eh? Well, when I view the RSS feed through Google Reader, under the article title I see a picture of "Marina 26, Russia" and she does look a little naughty. So, I guess that's that cleared up.

Re:There's a new secure OS called... by slashmydots · 2012-11-20 06:36 · Score: 2, Informative

There's a new secure OS called Rootkit Server 12 - maybe it's time you nerds started upgrading to it!

This is the year of the Linux rootkit.

Why? Linux has been around 85% of all web servers in the world for a loooooong time. You don't target the 15% windows servers to get stuff done.

Re:Security through obscurity FAIL by mlts · 2012-11-20 06:59 · Score: 2

The rootkit is half the battle as TFA says... what gets me really wondering is the exploit they used to get unfettered root access, especially if SELinux is enabled and enforcing.

The best short term defense against this? A monolithic kernel that has all modules compiled in, and has module loading disabled. Of course, this loses a lot of functionality.

Long term, maybe the best defense would be to take the TE (trustchk) system from AIX (which can be configured to not run any binaries that are not in a signed database), have signed kernel modules, and use a TPM + LUKS to ensure that if there is tampering, the boot process stops because there is no key to mount the root filesystem. Yes, TPM is a double-edged sword, but it does do well in guarding against these types of attacks.

Re:There's a new secure OS called... by Anonymous Coward · 2012-11-20 07:00 · Score: 1

Better to switch to a safe proprietary OS that has never had a security problem.

Menuet64?

Re:Security through obscurity FAIL by TheRaven64 · 2012-11-20 07:15 · Score: 1

To be fair to Linux, glibc is not in the Linux kernel. That's why it's important to say GNU/Linux: because Drepper deserves the blame at least as much as Linus. Android, for example, is Linux and uses a FreeBSD libc derivative instead of glibc.

--
I am TheRaven on Soylent News

conditionbrownpants ?? by Janek+Kozicki · 2012-11-20 07:19 · Score: 1

Ok, why this story is tagged with conditionbrownpants? Anybody cares to explain?

(and no, it's not because of my post, because I'm asking after this tag appeared)

--
# #\ @ ? Colonize Mars #

Re:Security through obscurity FAIL by K.+S.+Kyosuke · 2012-11-20 07:31 · Score: 2

Dunno about AC, but first glance seems to be that it exploits shitty PHP code in order to get itself hosted onto the websites.

How does "first glance" tell you that? And are you talking about code written in the PHP language or about the PHP implementation? And even if you break into a PHP implementation remotely, how do you make the kernel load the module, assuming the administrator isn't an outright idiot and the PHP process isn't running as root?

--
Ezekiel 23:20

It Could Entirely Be Redmond Propaganda by Anonymous Coward · 2012-11-20 07:34 · Score: 1

1.) Pseudonymous source "stacktrace"

2.) Noone explains which weakness is being "exploited"

I call bullshit on this until they show the code which actually own the Linux kernel. If you could trace this whole thing, I am quite positive it leads to the checkbook of a Mr Ballmer, resident of Redmon, WA, USA.

Re:It Could Entirely Be Redmond Propaganda by Dishevel · 2012-11-20 08:12 · Score: 1

Who is Noone and how well does he explain the weakness being exploited.?
Damn that guy gets around.

--
Why is it so hard to only have politicians for a few years, then have them go away?

Re:This is not a rootkit! It's a joke! by maxwell+demon · 2012-11-20 07:55 · Score: 2

Wrong. A rootkit is code which maliciously takes over certain functionality at root level. How it got installed doesn't matter for its classification as rootkit. Of course most rootkits get installed by some virus, worm or trojan, but a rootkit which some cracker installed by hand is still a rootkit.

--
The Tao of math: The numbers you can count are not the real numbers.

Quick fix by AliasMarlowe · 2012-11-20 08:03 · Score: 5, Interesting

The best short term defense against this?

Just put
exit 0
at the end of your /etc/rc.local and the rootkit becomes unloadable. Just like in Debian Squeeze.

--
Those who can make you believe absurdities can make you commit atrocities. - Voltaire

Re:Quick fix by rastos1 · 2012-11-20 21:30 · Score: 1

The best short term defense against this?
Just put
exit 0
at the end of your /etc/rc.local and the rootkit becomes unloadable. Just like in Debian Squeeze.

I did not get that. Would you kindly explain that?
Re:Quick fix by AliasMarlowe · 2012-11-21 04:13 · Score: 1

The best short term defense against this?
Just put
exit 0
at the end of your /etc/rc.local and the rootkit becomes unloadable. Just like in Debian Squeeze.
I did not get that. Would you kindly explain that?
Well, it's even in TFA, and described in more detail here. According to the guy who analyzed it (Georg Wicherski): "the command is appended to the end of rc.local" and "On a default Debian squeeze install, /etc/rc.local ends in an exit 0 command, so that the rootkit is effectively never loaded". This is what happens when you try to install the rootkit on Debian Squeeze.

--
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
Re:Quick fix by crutchy · 2012-11-23 14:09 · Score: 1

also, rc.local on my machine (default install of squeeze, no permissions tampering) has write permissions on /etc/rc.local for owner (root) only, so for any malware to write to /etc/rc.local it would have to be running as root anyway (in which case my system would already be fucked).

TFA doesn't make a very clear connection between "iFrame injection mechanism" and full root access on the server, particularly as servers don't usually display iframes in a web browser (that's usually on the client end). sure there are plenty of ways of corrupting a mysql database and fucking up a poorly secured website app, but there is significantly more effort to get from mysql or www-data user permissions to root permissions on a server.

sounds more like at most a social engineering hack than any kind of technical exploit in the software itself. if you change your filesystem permissions in a rediculous way (chmod everything to be rwxrwxrwx or something) then maybe you could cause yourself some grief.

Re:where's patch?? by Anonymous Coward · 2012-11-20 08:08 · Score: 1

there is nothing to patch, idiot

Re:There's a new secure OS called... by Anonymous Coward · 2012-11-20 08:20 · Score: 3, Funny

A more apt joke would be about Windows Server 2008 or 2012.

An even more apt joke would be something like:

# apt-get install windows-server-2008 Reading package lists... Done Building dependency tree Reading state information... Done E: Unable to locate package windows-server-2008

But that doesn't seem to work.

Re:Security through obscurity FAIL by micheas · 2012-11-20 08:24 · Score: 2

Debian does not have SELinux enabled by default. So that is one barrier that frequently they won't have to cross in getting root access.

Debian might also have been targeted for its large market share and not having security extension installed by default. Considering the wide range of uses that Debian is put to it seems like maybe they should create a "public server" install profile that includes things like SELinux enabled and checkrootkit and other routine auditing tools installed.

--
Work bio at MMWD

Re:Security through obscurity FAIL by mlts · 2012-11-20 08:49 · Score: 1

IMHO, this is one thing they really need to look into fixing to keep up with what threats are out there.

It doesn't matter if they use SELinux or AppArmor. Just use something to limit the context things run in so even if something like Apache gets compromised, even with a way to UID 0, the mischief they can do is limited, be it to a directory or filesystem, or to only a segment of process space.

One thing I like is how sandboxie works on Windows -- a sandboxed program would have a list of executables (either explicitly specified, or via directory wildcards) that it can run, and this would include what context the process would run under (be it SUID root, user, or another user). Attempts to run anything else under a different context would be blocked. That way, if the apache binary tried to run the /bin/passwd command, it would be blocked.

Re:Security through obscurity FAIL by V!NCENT · 2012-11-20 09:23 · Score: 1

How about MAC (Mandatory Acces Control)?

Hello SELinux... (Fedora)

--
Here be signatures

Re:Security through obscurity FAIL by mcgrew · 2012-11-20 09:28 · Score: 1

...while it's nice that Linux has gained a reputation as a secure alternative to Windows, the fact of the matter is that no one has really given a shit until now enough to really poke a hole in it.

Frothing at the mouth, Mr. Ballmer? Linux isn't a "a secure alternative to Windows for most folks using it, it runs on everything from wristwatches to the most powerful supercomputers in the world. Most web servers are running Linux. If Linux were easy to exploit, you'd have heard of a LOT of exploits.

--
Free Martian Whores!

Re:Security through obscurity FAIL by Belial6 · 2012-11-20 09:58 · Score: 1

I would think that TVs would be the ideal target. Sure, the processing power is low, but nobody even considers watching for malware on TVs. I wouldn't be surprised to find out that the computer running Linux inside my TV never turns off. Of that is the case, a malware writer the targeted TVs would have 100k - millions of low power but always on and never protected computers to run there malware on.

Of course that would only be if Linux were easy to exploit.

Rootkit loads into memory? by dgharmon · 2012-11-20 09:59 · Score: 1

"The rootkit is designed specifically for 64-bit Linux systems .. The new Linux rootkit is loaded into memory and once there"

How does this 'rootkit' get executed on the target machine, does it require prior root access in order to sucessfully execute?

--
AccountKiller

Re:Rootkit loads into memory? by Gaygirlie · 2012-11-20 10:31 · Score: 2

"The rootkit is designed specifically for 64-bit Linux systems .. The new Linux rootkit is loaded into memory and once there"
How does this 'rootkit' get executed on the target machine, does it require prior root access in order to sucessfully execute?
Yes, it does. It contains no exploits whatsoever.
Re:Rootkit loads into memory? by Gaygirlie · 2012-11-20 11:20 · Score: 1

So it isn't a rootkit (rootkit is only class of malware what is made against operating system like Linux [kernel]) but just a malware what needs user to grant it a root rights.
Since TFA doesn't give enough details the kernel module and its files could, in theory, be a PART of a rootkit, but the party that installed the module and its files did all the work and the module is indeed just malware. And well, we don't know if the party that installed it in there was indeed using an unknown exploit or if it was just a person who got inside the server due to poorly-developed websites and/or SQL-injection, and it's much more likely it's just the latter.

Re:How safe is Linux web-browsing in general? by Gaygirlie · 2012-11-20 10:30 · Score: 3, Informative

There aren't any known, widespread Linux-based viruses or malware, and the few ones that do exist target server software, Java and/or Flash. And even if you found malware that still made its way in your computer via e.g. a vulnerability in the browser's Javascript - implementation that malware would still have to get root privileges in order to properly hide its existence -- there aren't any known, widespread security holes either in the Linux-kernel or the GNU userland, so if you keep your system up-to-date the chances are very, very slim the code would be able to get root privileges.

That is to say that if you e.g. used Firefox without Java and with the Flashblock add-on there'd be more-or-less no chances of you getting anything. Don't get scared by articles like this one because, well, this one doesn't spread via the web browser in the first place -- it was likely installed on the system by hand by someone who got access to it because of poor website implementation.

Re:There's a new secure OS called... by mug+funky · 2012-11-20 11:17 · Score: 4, Funny

no no, read the summary. these boxes were using red hat - "A new Linux rootkit has emerged"

Is this a rootkit? by EmagGeek · 2012-11-20 11:29 · Score: 1

An iframe injection that redirects you to a malicious website where you have to download something and run it as root to get infected sounds almost nothing like something that runs as a normal user and exploits local weaknesses to gain privileged access surreptitiously.

Re:Is this a rootkit? by lgw · 2012-11-20 12:56 · Score: 2

A "rootkit" is not "a kit to get root" but "a kit to keep root, once you somehow get it". Rootkits try to make an intrusion undetectable and un-removable, but they don't provide the intrusion.

--
Socialism: a lie told by totalitarians and believed by fools.

Re:There's a new secure OS called... by quintus_horatius · 2012-11-20 11:49 · Score: 3, Funny

these boxes were using red hat - "A new Linux rootkit has emerged"

That would be Gentoo, where we even have to compile our viruses from source (but then the virus is super-optimized).

"Rootkit" by GigaBurglar · 2012-11-20 12:08 · Score: 1

It sounds like just plain old malware - maybe it does have a rootkit as part of the package - but still.. iFrame injection and a slew of other functional abilities are not in the domain of a 'rootkit'. The definition of a worm is a malicious program that replicates itself.

No rc.local file in Gentoo by IBitOBear · 2012-11-20 12:38 · Score: 2

So since the "root kit" involves some other vector letting the intruder append something to rc.local (or somehow pivot on whether rc.local ends with an "exit 0") the root kit ins't a root kit but a post-root-promotion exploit.

--
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press

Re:There's a new secure OS called... by mug+funky · 2012-11-20 12:56 · Score: 1

ah, whoops. s/red hat/gentoo/

Re:How safe is Linux web-browsing in general? by Teun · 2012-11-20 17:08 · Score: 1

Then why are you asking?
Did you get new information about some novel and previously unknown exploit for Linux desktop installs?
Nothing is infallible but the historic record has persistently shown the *nix development system delivers a rather robust OS.
So yes stay vigilant on any system that's exposed to the web or (USB) media but also do enjoy some peace from knowing you are running a from a security standpoint better designed OS than the de-facto industry standard for desktops.

--
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."

Re:Security through obscurity FAIL by mcgrew · 2012-11-21 03:22 · Score: 1

That's why I'll never buy a Sony product. I would expect a Sony TV to be pre-rooted.

--
Free Martian Whores!

Re:Linux rootkit by Qu4Z · 2012-11-21 16:32 · Score: 1

In fairness, both of those flaws could be easily worked around. The worrying implication is that the developer didn't know what he was doing.

Having said that, you need to already have root access to install this, so it's really not a big deal.

Re:How does it install itself by Qu4Z · 2012-11-21 16:34 · Score: 1

At this stage, it looks like someone with root-level access installs it.

Ultracet no prior script by HHRHHR · 2012-11-22 08:43 · Score: 1

Buy Ultracet online HERE FROM TOP TEN ONLINE PHARMACIES Best Price,Payment information >>> (LOWEST PRICE! DISCOUNTS!)

Without Prescription
Free Consultation
Fast And Discreet Shipping Worldwide
24/7 Customer Support
And Much More
Bonus Policy>>>
Order 3 or more products and get free Regular Airmail (12-21 days) shipping!
Free insurance (guaranteed reshipment if delivery failed)

2011. Top Pharmacy List! Best Prices Online!

Special Internet Prices (up to 40% off average US price)
Best quality drugs
100% Anonimity & Discreet shipping
Fast FREE shipping (4 to 7 days)

Re:Slashdot years of FUD at an end by crutchy · 2012-11-23 11:54 · Score: 1

Linux gets used by the majority since they're smallfry and cash strapped since Linux = free

...yeah cos ibm linux servers just keep falling out the back of various trucks, not to mention all the "cash strapped" geeks in fortune 500 corporations can afford to fill their multi-million dollar datacenters with linux blades

i get microsoft also missed the memo cos even they have linux on azure

Re:Shurely Mr Micro$hill by crutchy · 2012-11-23 11:58 · Score: 1

Nix Nuke Week in progress (lmao)

from TFA in linked comment regarding hacked freebsd servers; "hackers were able to gain access to the servers using legitimate SSH keys and not by exploiting any operating system vulnerabilities"...

try again shill

Re:Brace yourselves... by crutchy · 2012-11-23 14:37 · Score: 1

this one sounds like APK that we all know and loathe :)

...overly concerned about mod points, trolls, and posting as AC himself

so how's that bug in your pointless and overly bloated and mindlessly exception handled Python function coming along then?

Re:Brace yourselves... by crutchy · 2012-11-23 19:06 · Score: 1

APK makes no sense anyway... even though he posts as AC, he still rants about mod points.... go figure

Re:Slashdot years of FUD at an end by crutchy · 2012-11-23 19:49 · Score: 1

omg ok you've convinced me with your infinite bullsh.... i mean wisdom :)

Re:Slashdot years of FUD at an end by crutchy · 2012-11-24 14:28 · Score: 1

we don't want "your kind" on the #1 most used OS platform there is on PC desktops and servers combined

your kind stinks and is full of whingeing morons who don't even realise how much they rely on the "2nd rate least used OS platform"

...used google lately?
http://en.wikipedia.org/wiki/Google_platform#Software

...read it and weep moron

Re:Brace yourselves... by crutchy · 2012-11-24 15:41 · Score: 1

go back to trying to figure out where the bug is in your Python code, idiot

meanwhile, linux will continue to dominate the world hahahahah!!!!

Re:Shurely Mr Micro$hill by crutchy · 2012-11-24 15:46 · Score: 1

the servers were most likely administered by wintards with no concept of security... social engineering at its best

Re:Brace yourselves... by crutchy · 2012-11-24 19:10 · Score: 1

try looking at the code in your posts

Re:Apparently you can't figure it out by crutchy · 2012-11-26 08:50 · Score: 1

keep posting your buggy code then... it makes you look bad, not me

i'm just another bored fool trying in vain to highlight a bug in it

ignore that advice all you want, but anyone who understands Python will read it and think "hahahaha there's an indentation bug on the 5th line... what a dumbass!!!!"
particularly because of the arrogant and rediculous context that you repeatedly post it

Re:Apparently you can't figure it out by crutchy · 2012-11-28 09:15 · Score: 1

maybe different code ran (maybe you just typed the "output" manually), but the code that you post won't run with the indentation bug on the 5th line

Re:Apparently you can't figure it out by crutchy · 2012-12-03 09:11 · Score: 1

hence my original post here http://slashdot.org/comments.pl?sid=3258205&cid=42016107

and your classic repsponse here: http://slashdot.org/comments.pl?sid=3258205&cid=42018527

quote: "(No bugs 5x above, & 100's of times before it the past year or so here)"

i guess its also slashdot's fault that you're a douchebag?

Re:Apparently you can't figure it out by crutchy · 2012-12-03 09:14 · Score: 1

slashdot didn't forget to put that missing indent in... slashdot doesn't automagically indent code for you

the error was your own... you forgot to include the required indent for bug-free posted python code

the fact that it has taken you so long to actually look at your code and realize (even after numerous attempts to point it out to you) confirms how much of an arrogant noob you are

just don't expect me to debug all your code or i'll have to start charging by the hour :)

Re:Apparently you can't figure it out by crutchy · 2012-12-03 18:32 · Score: 1

slashdot doesn't "mess up code pastes" you fucking toolbag.

it doesn't put indents in. you have to do that yourself, and you fucked up by missing one... and then bragged about how your code was "bug free" hahahahaha what a douche

"his".... right whatever APK

89 of 172 comments (clear)