Slashdot Mirror
Stealthy Linux Trojan May Have Infected Victims For Years
An anonymous reader writes: Researchers from Moscow-based Kaspersky Labs have uncovered an extremely stealthy trojan for Linux systems that attackers have been using to siphon sensitive data from governments and pharmaceutical companies around the world.
The malware may have sat unnoticed on at least one victim computer for years, although Kaspersky Lab researchers still have not confirmed that suspicion. The trojan is able to run arbitrary commands even though it requires no elevated system privileges.
The malware may have sat unnoticed on at least one victim computer for years, although Kaspersky Lab researchers still have not confirmed that suspicion. The trojan is able to run arbitrary commands even though it requires no elevated system privileges.
I thought that the systemd infection of Debian was much more recent than that. Like within the past year. But maybe I'm wrong, and it has been longer?
I certainly don't prefer security through obscurity and generally support transparence in all aspects of life, but it sure makes it easier for hackers to have access to the source code. I guess Open Source tends to give a false sense of security as seen several times this year (OpenSSL, Linux kernel, etc).
The privilege system does not protect commands, it protects data. You can always run any command on any data that belongs to you. But when you want to access data of others or the system, you need elevated privileges and same for attacking to privileged network ports.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
just how many botnets the NSA is actually running?
I work for the Department of Redundancy Department.
If you are establishing a raw socket, you have to have privileges...
It seems to be anyone else.
My ism, it's full of beliefs.
There are a lot of things you can do to cripple a user's experience without elevated system privileges. Dice for exemple, does a pretty good job at spamming my Slashdot page with ads and they do not have root access to my machine and they don't even need to infect my computer with a stealthy trojan! Man I never felt the need to install Adblock on my browser and I can't beleive I will have to do it because of Slashdot.
And no, I don't want to discover Slashdot Deals. Thanks.
It's an ordinary piece of malware.
It talks home to a hard-coded URL.
It has to have a secret "knock" before it will talk back to you (port-knocking has uses both ways, it seems!).
It contains easily-greppable strings.
Quite what distinguishes this from other malware, I'm not too sure. Just that nobody had seen it before?
is this the same secure, unbreakable, no-virus-possible Linux system?
Perhaps it's time for companies/governments with highly-sensitive data to do periodic offline audits of their systems. If you find something that doesn't belong and which isn't clearly harmless, investigate further.
Yes, it's expensive but it's getting to the point where the alternative is even more expensive.
Today is patch Tuesday so we will be all set and good to go once we patch our boxen.
It's good to be king
Louis da here-and-now
I think generally we think that somehow this stuff just get's rooted out naturally. But unless your a security firm either looking for it, or someone has found something suspicious. It could easily sit in all that code for years without being noticed. That is the key these days, that the worst stuff is not detected right away and the simple malware rarely does any damage. Sure, buy all the security you want, but truth is unless something is found and a definition is created to detect it with a scan. It won't find it. This is why security software is worthless except for giving paranoid people a false sense of security. Many times it even finds PUP (potentially unwanted programs) just to make people feel its working. I'm glad the claims that certain operating systems are immune is disappearing. This is another false assumption that cannot be guaranteed or proven. Nobody should argue or brag that their OS is safe. Obviously Windows is under far more attacks simply because of its large user base. It means more targets, more hackers trying to find holes and more success. But it does not mean nobody is looking elsewhere for opportunity.
To me the main difference seemed that this is a targeted malware, specifically showing up (in fairly small numbers) in places that might interest nation state level snoops. Not just some random financial information/game password/login trawling generic malware.
Reading from disk is only one portion of a process and process protection, the actual execution occurs in memory and is _ALSO_ protected in *nix.. An easy example is to open a socket on a specific port as a user. A non privileged user can not open a port below 1024 because this is in protected space, but you can open a socket on 1025->64K without issues.
There is no point in attempting to explain SUID/SGID in addition to normal execution, because you don't even have the normal execution correct. I will however state that this is another dynamic to review after you figure out the difference between reading and executing.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Something does not compute here. The SecureList blog post says that the port knocking works by getting a raw socket from pcap and looking at the ack. On any Linux system I've ever used, this DOES require root privileges. And yet, they also claims it does not need any special privileges?
Reading TFA I see no mention of Linux at all, it mentions Windows and PHP. Perhaps the author is confused and believes that anything with .PHP must exist in Linux, but I'm skeptical. They spend lots of time talking about the various .exe files, "Administrator" privileges, and "Network Shares" which are exclusive terminology to the Windows OS. Nobody can be that ignorant as a technical writer.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
From the article link to from the article in the summary:
Although Linux variants from the Turla framework were known to exist, we haven't seen any in the wild yet.
It might be because you need root and command line access to install it. After that, however, it can be activated without root.
Group hug!
Faster! Faster! Faster would be better!
There are costs involved in all decisions. I can't drive a car without contributing to the cost of a road. I can't keep warm in a snowstorm without buying shelter. I can't prosper, or even live long, without paying for defense.
Do not rail against war and its expenses, but rather oppose those who use force to achieve their ends.
Contribute to civilization: ari.aynrand.org/donate
This is why you should set SELinux to Enforcing. It will limit the damage done by a rogue application.
Unless you want to do the latter, why spend so much money on preparing for it?
To have a right to do a thing is not at all the same as to be right in doing it
"This Turla cd00r-based malware .. can't be discovered via netstat, a commonly used administrative tool" link
'To activate the real remote access service (the attached code starts an inetd to listen on port 5002, which will provide a root shell), one has to send several packets (TCP SYN) to ports on the target system' link
How exactly does this 'Linux trojan' get onto the computers in the first place, without the end user going to a site and downloading the malware and explicidly running it and entering the root password.
@ledow: "Quite what distinguishes this from other malware, I'm not too sure. Just that nobody had seen it before?"
What this is even doing as an article on slashdot is beyond me, apart from giving Kaspersky some free advertising space.
Submit. The thug prospers, I suffer and probably die early. If nearly all people do this, thugs find it an easy way to live, and the class of thugs expands until it dominates the whole world. The whole world becomes a cesspool like North Korea.
Arm myself to resist the thug, and on a national scale arm to resist thug-states. At the cost of defending myself, I can prosper in relative freedom. One of the worse costs is listening to ignorant tools like you advising me to let my throat be cut.
Here is where your black-and-white, false dichotomy fails. You can "arm" yourself to resist the thug by hiring your own gang of thugs, by buying your own gun, or by buying armor. You can arm yourself against the worst thug your imagination can conjure, or against thugs that actually exist. You can prove the strength of your arms by walking into every dark alley, kicking down the doors of hovels and speakeasies, loudly proclaiming your invincibility, or you can follow open, well-lighted paths without offering to fight all comers, and at least pretend to be civil.
Or I can walk the well-lighted paths (those that still exist) and hose the dark corners with my flamethrower.
If a user can read a file on a *nix system, and can write to even a *single* location, that user can execute that file.
1) Copy the file to the location where I can write.
2) Set the execute flag on the file.
3) Execute the file.
Permissions will prevent you from accessing data you don't have permission to, but will only prevent you from running an application if you can't even see it.
one can debate how much defense is "good enough" relative to its cost, and further debate whether any particular country has reached or exceeded that threshold. but seems to me that having a defensive force that could, if so desired, conquer (with some very good odds) all other forces implies a high probability of success when defending against said forces. that is, the best defense is a good offense.
One link is Epic Turla for Windows, the other is for Linux. https://securelist.com/blog/research/67962/the-penquin-turla-2/
I found it amusing that claims are made that the program needs no permissions, then the article demonstrates it running with root:
[root@localhost Turla]# ./Tur.1
Also, you have to have the "Snake" rootkit installed:
"The attack tool takes us further into the set alongside the Snake rootkit and components first associated with this actor a couple years ago."
Ars adds, "Even a regular user with limited privileges can launch it" http://arstechnica.com/security/2014/12/powerful-highly-stealthy-linux-trojan-may-have-infected-victims-for-years/
Would this be a moron who just rooted their Android phone to use a Chinese app store?
FUD indeed!
However, consider the consequences. My country's armed forces are clearly for defense, and your country's are to potentially attack me. This means that, when I decide we need to spend more on defense, you feel threatened, and spend more on defense, meaning from my point of view you're preparing an attack, and I need more defense, etc.
This produces an arms race that can lead to war, when one side decides that its best chance to survive is to attack now.
There are ways to defuse this sort of arms race, such as maintaining good relations, but every warship launched is not only money that could be used productively but provokes yet more warships to be launched.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Every gun that is made, every warship launched, every rocket fired signifies, in the final sense, a theft from those who hunger and are not fed, those who are cold and are not clothed
Nice platitude. Prove it.
"There is no god but allah" - well, they got it half right.
Because in the end, someone has to be as powerful as the most powerful state we might logically fear. Right now that is the Russians (simple tanks and bombs), the Chinese (economic warfare), and the Islamofascists (intent). Of these, we cannot afford to fight the Chinese, we are not the bleeding edge in defending against the Russians, and we might be able to defeat the Islamofascists here at home using ideas, not so sure about in other countries.
But the old days of raising armies only when needed has gone the way of the horse and buggy. Unless you are the Swiss, who count on others to provide defacto long-arm defense, you probably cannot count on an armed population either ("Red Dawn not withstanding)
"There is no god but allah" - well, they got it half right.
Speaking of links, the descriptive texts in the first two links in this post are backwards. The reference to the "siphon data from governments and pharmaceutical companies" links to the stealthy trojan link and the "stealthy trojan..." link, links to the "siphon data ..." article.
Tracy Johnson
Old fashioned text games hosted below:
http://empire.openmpe.com/
BT
Raising armies only when needed... Old idea?
Isn't it more of a new idea that really didn't pan out? Are there some examples throughout history of it being tried and working? We can't talk about it like it's merely outdated, it is a _bad_ idea. IMHO