Slashdot Mirror
Stealthy Linux Trojan May Have Infected Victims For Years
An anonymous reader writes: Researchers from Moscow-based Kaspersky Labs have uncovered an extremely stealthy trojan for Linux systems that attackers have been using to siphon sensitive data from governments and pharmaceutical companies around the world.
The malware may have sat unnoticed on at least one victim computer for years, although Kaspersky Lab researchers still have not confirmed that suspicion. The trojan is able to run arbitrary commands even though it requires no elevated system privileges.
The malware may have sat unnoticed on at least one victim computer for years, although Kaspersky Lab researchers still have not confirmed that suspicion. The trojan is able to run arbitrary commands even though it requires no elevated system privileges.
the courting jester of the WMD on credit kingdumb should let colbert run it's 'show' for an episode or two?
I thought that the systemd infection of Debian was much more recent than that. Like within the past year. But maybe I'm wrong, and it has been longer?
I certainly don't prefer security through obscurity and generally support transparence in all aspects of life, but it sure makes it easier for hackers to have access to the source code. I guess Open Source tends to give a false sense of security as seen several times this year (OpenSSL, Linux kernel, etc).
The privilege system does not protect commands, it protects data. You can always run any command on any data that belongs to you. But when you want to access data of others or the system, you need elevated privileges and same for attacking to privileged network ports.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
just how many botnets the NSA is actually running?
I work for the Department of Redundancy Department.
If you are establishing a raw socket, you have to have privileges...
Every gun that is made, every warship launched, every rocket fired signifies, in the final sense, a theft from those who hunger and are not fed, those who are cold and are not clothed.
This world in arms is not spending money alone. It is spending the sweat of its laborers, the genius of its scientists, the hopes of its children. The cost of one modern heavy bomber is this: a modern brick school in more than 30 cities. It is two electric power plants, each serving a town of 60,000 population. It is two fine, fully equipped hospitals. It is some fifty miles of concrete pavement. We pay for a single fighter with a half-million bushels of wheat. We pay for a single destroyer with new homes that could have housed more than 8,000 people. . . . This is not a way of life at all, in any true sense. Under the cloud of threatening war, it is humanity hanging from a cross of iron.
It seems to be anyone else.
My ism, it's full of beliefs.
colbert might change this; https://www.youtube.com/results?search_query=wmd+weather+media+censorship .. to this; https://www.youtube.com/results?search_query=free+world+energy .. we already have the hardware we paid for all of it? stay tuned...
There are a lot of things you can do to cripple a user's experience without elevated system privileges. Dice for exemple, does a pretty good job at spamming my Slashdot page with ads and they do not have root access to my machine and they don't even need to infect my computer with a stealthy trojan! Man I never felt the need to install Adblock on my browser and I can't beleive I will have to do it because of Slashdot.
And no, I don't want to discover Slashdot Deals. Thanks.
It's an ordinary piece of malware.
It talks home to a hard-coded URL.
It has to have a secret "knock" before it will talk back to you (port-knocking has uses both ways, it seems!).
It contains easily-greppable strings.
Quite what distinguishes this from other malware, I'm not too sure. Just that nobody had seen it before?
is this the same secure, unbreakable, no-virus-possible Linux system?
Perhaps it's time for companies/governments with highly-sensitive data to do periodic offline audits of their systems. If you find something that doesn't belong and which isn't clearly harmless, investigate further.
Yes, it's expensive but it's getting to the point where the alternative is even more expensive.
Today is patch Tuesday so we will be all set and good to go once we patch our boxen.
It's good to be king
Louis da here-and-now
I think generally we think that somehow this stuff just get's rooted out naturally. But unless your a security firm either looking for it, or someone has found something suspicious. It could easily sit in all that code for years without being noticed. That is the key these days, that the worst stuff is not detected right away and the simple malware rarely does any damage. Sure, buy all the security you want, but truth is unless something is found and a definition is created to detect it with a scan. It won't find it. This is why security software is worthless except for giving paranoid people a false sense of security. Many times it even finds PUP (potentially unwanted programs) just to make people feel its working. I'm glad the claims that certain operating systems are immune is disappearing. This is another false assumption that cannot be guaranteed or proven. Nobody should argue or brag that their OS is safe. Obviously Windows is under far more attacks simply because of its large user base. It means more targets, more hackers trying to find holes and more success. But it does not mean nobody is looking elsewhere for opportunity.
To me the main difference seemed that this is a targeted malware, specifically showing up (in fairly small numbers) in places that might interest nation state level snoops. Not just some random financial information/game password/login trawling generic malware.
Reading from disk is only one portion of a process and process protection, the actual execution occurs in memory and is _ALSO_ protected in *nix.. An easy example is to open a socket on a specific port as a user. A non privileged user can not open a port below 1024 because this is in protected space, but you can open a socket on 1025->64K without issues.
There is no point in attempting to explain SUID/SGID in addition to normal execution, because you don't even have the normal execution correct. I will however state that this is another dynamic to review after you figure out the difference between reading and executing.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Something does not compute here. The SecureList blog post says that the port knocking works by getting a raw socket from pcap and looking at the ack. On any Linux system I've ever used, this DOES require root privileges. And yet, they also claims it does not need any special privileges?
Reading TFA I see no mention of Linux at all, it mentions Windows and PHP. Perhaps the author is confused and believes that anything with .PHP must exist in Linux, but I'm skeptical. They spend lots of time talking about the various .exe files, "Administrator" privileges, and "Network Shares" which are exclusive terminology to the Windows OS. Nobody can be that ignorant as a technical writer.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
From the article link to from the article in the summary:
Although Linux variants from the Turla framework were known to exist, we haven't seen any in the wild yet.
It might be because you need root and command line access to install it. After that, however, it can be activated without root.
This is why you should set SELinux to Enforcing. It will limit the damage done by a rogue application.
"This Turla cd00r-based malware .. can't be discovered via netstat, a commonly used administrative tool" link
'To activate the real remote access service (the attached code starts an inetd to listen on port 5002, which will provide a root shell), one has to send several packets (TCP SYN) to ports on the target system' link
How exactly does this 'Linux trojan' get onto the computers in the first place, without the end user going to a site and downloading the malware and explicidly running it and entering the root password.
@ledow: "Quite what distinguishes this from other malware, I'm not too sure. Just that nobody had seen it before?"
What this is even doing as an article on slashdot is beyond me, apart from giving Kaspersky some free advertising space.
If a user can read a file on a *nix system, and can write to even a *single* location, that user can execute that file.
1) Copy the file to the location where I can write.
2) Set the execute flag on the file.
3) Execute the file.
Permissions will prevent you from accessing data you don't have permission to, but will only prevent you from running an application if you can't even see it.
One link is Epic Turla for Windows, the other is for Linux. https://securelist.com/blog/research/67962/the-penquin-turla-2/
I found it amusing that claims are made that the program needs no permissions, then the article demonstrates it running with root:
[root@localhost Turla]# ./Tur.1
Also, you have to have the "Snake" rootkit installed:
"The attack tool takes us further into the set alongside the Snake rootkit and components first associated with this actor a couple years ago."
Ars adds, "Even a regular user with limited privileges can launch it" http://arstechnica.com/security/2014/12/powerful-highly-stealthy-linux-trojan-may-have-infected-victims-for-years/
Would this be a moron who just rooted their Android phone to use a Chinese app store?
FUD indeed!
Speaking of links, the descriptive texts in the first two links in this post are backwards. The reference to the "siphon data from governments and pharmaceutical companies" links to the stealthy trojan link and the "stealthy trojan..." link, links to the "siphon data ..." article.
Tracy Johnson
Old fashioned text games hosted below:
http://empire.openmpe.com/
BT