Slashdot Mirror
Analysis of Linux Backdoor Used In Freenode Hack
An anonymous reader writes "A detailed analysis has been done of the Linux backdoor used in the freenode hack. It employed port knocking and encryption to provide security against others using it. This seems a little more sophisticated than your average black-hat hacker.
So a common method of securing parts of systems (port knocking) was used by nefarious software to protect itself.
"This seems a little more sophisticated than your average black-hat hacker."
From the article... ...
"Whilst the handshake and data security mechanisms are arguably well designed the persistence mechanism isn’t in any sense stealthy. This particular rootkit would be easily detectible using tools as Tripwire and Rootkit Hunter.
While the techniques used are well engineered they are certainly not unique. For example netfilter hooks were discussed in the context of rootkits back in a 2003 Phrack article titled ‘Kernel Rootkit Experiences‘. Similarly port knocking and RC4 encryption for concealment and transport security are not highly sophisticated yet are sound approaches if developing a rootkit."
Doesn't seem so special after all.
So, it has come to this...
a kernel-mode portknock, on a machine that you already rooted via some other vulnerable app.
No USB, less space than a Nomad, lame.
I want to delete my account but Slashdot doesn't allow it.
Their ops ban to win arguments, and to satisfy personal control issues. Their "help" channels are consistently ruined by ops banning to get attention. They're run by little girls, afraid of their own shadows, and banning anything that shines because it might cause a shadow, and shadows are scary! boo hoo!
The most common black-hat software is pretty dumb, e.g. brute force ssh attack, install custom ssh client, attack other machines' ssh with brute force. By comparison this is pretty savy. It sounds like someone was targeting freenode specifically.
Now that it's been outed, let's all just move on.
All the features listed can be found part of the open source rootkit named jynx 2.0 programmed in C which has been around for years. It employs socket hijacking for a backdoor access on any outbound service, SSL encryption for communications, root shell access, file and socket hiding from root users, as well as loading into every running application via LD_preload. The only detection is looking at which libraries are attached to your processes in which a live CD needs to be used to remove the files.
I'll have offended
He totally did.
http://warrior.logicalnetworki...
It is pitch black. You are likely to be eaten by a grue.
Any news on kernel.org yet? If there was an analysis I missed it.
The OA uses the term "Linux backdoor," but then goes on to describe it as a add-in kernel module. It's not a backdoor, but rather a rogue kernel module someone has written. The module in question, ipt_ip_udp, isn't part of the Linux kernel. It's merely a module some black hat wrote to provide remote access to an already compromised system. This is just FUD and self-promotion by NCC Group to make what they found sound much more important than it really was, no doubt to increase their client base. What crap.
To sum up, it isn't a Linux back door and it isn't a vulnerability in the Linux kernel source code. It's merely a rootkit.
I thought Linux had no such animals possible on it from what I've seen for years here. It's a vulnerability. Period. Get that through your heads around here. No amount of spin, softsoaping, or other bullshit can stop facts and the fact is, Linux got pwned here, plain and simple.
That's exactly what the NSA wants you to think.
How does this 'Linux backdoor' get onto the system in the first place?
It just proves once again that freenode staff is incompetent. end of story.
just stop using that network of self proclaimed open source community irc space (that hates tor)