Slashdot Mirror
Stealthy Linux Trojan May Have Infected Victims For Years
An anonymous reader writes: Researchers from Moscow-based Kaspersky Labs have uncovered an extremely stealthy trojan for Linux systems that attackers have been using to siphon sensitive data from governments and pharmaceutical companies around the world.
The malware may have sat unnoticed on at least one victim computer for years, although Kaspersky Lab researchers still have not confirmed that suspicion. The trojan is able to run arbitrary commands even though it requires no elevated system privileges.
The malware may have sat unnoticed on at least one victim computer for years, although Kaspersky Lab researchers still have not confirmed that suspicion. The trojan is able to run arbitrary commands even though it requires no elevated system privileges.
I thought that the systemd infection of Debian was much more recent than that. Like within the past year. But maybe I'm wrong, and it has been longer?
The privilege system does not protect commands, it protects data. You can always run any command on any data that belongs to you. But when you want to access data of others or the system, you need elevated privileges and same for attacking to privileged network ports.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
just how many botnets the NSA is actually running?
I work for the Department of Redundancy Department.
If you are establishing a raw socket, you have to have privileges...
It seems to be anyone else.
My ism, it's full of beliefs.
It's an ordinary piece of malware.
It talks home to a hard-coded URL.
It has to have a secret "knock" before it will talk back to you (port-knocking has uses both ways, it seems!).
It contains easily-greppable strings.
Quite what distinguishes this from other malware, I'm not too sure. Just that nobody had seen it before?
There has been plenty of people here who have claimed that Linux and open source provide an architecture which is by design more resilient against malware than proprietary solutions.
With closed source there are also no guarantees the bad guys won't see the source either. And it's far better to make the code visible to all then to wait for the exploit to be found in the usual ways while everyone was in the dark about it.
Security through obscurity is just like peril-sensitive sunglasses. Having the code visible makes you nervous for some reason? Well we'll just keep you from seeing it! Problem solved!
"When information is power, privacy is freedom" - Jah-Wren Ryel
And it's far better to make the code visible to all then to wait for the exploit to be found in the usual ways while everyone was in the dark about it.
That is quite a strong claim to make without providing evidence to back it up.
And it is. The fact that you may have a 10-year old server infected with some malware, and a FUD article for someone with vested interests in running AV solutions for every machines does not disprove it. Plus it is very easy to have malware and or running external commands through applicational holes, like wordpress both in Windows or Linux if your PHP is not well configured, and it is not exactly "Linux" fault. Pity the article is more concerned with fear mongering than providing technical details.
Linux certainly isn't obscure, or you're being sarcastic and suck at it ...
- Michael T. Babcock (Yes, I blog)
People are cutting corner and costs everywhere... and then they got surprised.
There has been plenty of people here who have claimed that Linux and open source provide an architecture which is by design more resilient against malware than proprietary solutions.
It is. That is why a Linux malware get to be news whereas yet another Windows malware does not register above the noise as news because there are so damn many of them. The same thing with the Bash, GnuTLS, OpenSSL etc vulnerabilities. "More resilient" does not mean immune - claiming immiunity would just be silly. News of Critical Vulnerabilities in Windows are about as frequent as every Patch Tuesday.
Pity the article is more concerned with fear mongering than providing technical details.
I read through both articles and it read as "The sky is falling! The sky is falling! Everyone panic!" but they did not really provide any technical details.
/(^o^)\
Oh the horror
There ain't no such thing as proprietary standards only proprietary formats. Standards are by definition open.
Reading from disk is only one portion of a process and process protection, the actual execution occurs in memory and is _ALSO_ protected in *nix.. An easy example is to open a socket on a specific port as a user. A non privileged user can not open a port below 1024 because this is in protected space, but you can open a socket on 1025->64K without issues.
There is no point in attempting to explain SUID/SGID in addition to normal execution, because you don't even have the normal execution correct. I will however state that this is another dynamic to review after you figure out the difference between reading and executing.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Something does not compute here. The SecureList blog post says that the port knocking works by getting a raw socket from pcap and looking at the ack. On any Linux system I've ever used, this DOES require root privileges. And yet, they also claims it does not need any special privileges?
Reading TFA I see no mention of Linux at all, it mentions Windows and PHP. Perhaps the author is confused and believes that anything with .PHP must exist in Linux, but I'm skeptical. They spend lots of time talking about the various .exe files, "Administrator" privileges, and "Network Shares" which are exclusive terminology to the Windows OS. Nobody can be that ignorant as a technical writer.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
From the article link to from the article in the summary:
Although Linux variants from the Turla framework were known to exist, we haven't seen any in the wild yet.
It might be because you need root and command line access to install it. After that, however, it can be activated without root.
There are costs involved in all decisions. I can't drive a car without contributing to the cost of a road. I can't keep warm in a snowstorm without buying shelter. I can't prosper, or even live long, without paying for defense.
Do not rail against war and its expenses, but rather oppose those who use force to achieve their ends.
Contribute to civilization: ari.aynrand.org/donate
"This Turla cd00r-based malware .. can't be discovered via netstat, a commonly used administrative tool" link
'To activate the real remote access service (the attached code starts an inetd to listen on port 5002, which will provide a root shell), one has to send several packets (TCP SYN) to ports on the target system' link
How exactly does this 'Linux trojan' get onto the computers in the first place, without the end user going to a site and downloading the malware and explicidly running it and entering the root password.
@ledow: "Quite what distinguishes this from other malware, I'm not too sure. Just that nobody had seen it before?"
What this is even doing as an article on slashdot is beyond me, apart from giving Kaspersky some free advertising space.
Submit. The thug prospers, I suffer and probably die early. If nearly all people do this, thugs find it an easy way to live, and the class of thugs expands until it dominates the whole world. The whole world becomes a cesspool like North Korea.
Arm myself to resist the thug, and on a national scale arm to resist thug-states. At the cost of defending myself, I can prosper in relative freedom. One of the worse costs is listening to ignorant tools like you advising me to let my throat be cut.
Here is where your black-and-white, false dichotomy fails. You can "arm" yourself to resist the thug by hiring your own gang of thugs, by buying your own gun, or by buying armor. You can arm yourself against the worst thug your imagination can conjure, or against thugs that actually exist. You can prove the strength of your arms by walking into every dark alley, kicking down the doors of hovels and speakeasies, loudly proclaiming your invincibility, or you can follow open, well-lighted paths without offering to fight all comers, and at least pretend to be civil.
If a user can read a file on a *nix system, and can write to even a *single* location, that user can execute that file.
1) Copy the file to the location where I can write.
2) Set the execute flag on the file.
3) Execute the file.
Permissions will prevent you from accessing data you don't have permission to, but will only prevent you from running an application if you can't even see it.
What evidence would you find convincing? (I can't assess this, as I'm already convinced.)
I think we've pushed this "anyone can grow up to be president" thing too far.
A valid point, but this *is* an unusual case. OTOH, we don't necessarily know that a bug isn't being exploited just because nobody had noticed it happening.
FWIW, in my viewpoint Linux gave up a lot of it's security when it allowed files that were expanded from archives to have the executable bit set. And that's a long time ago. (OTOH, even without the executable bit set, you could always execute a file from an explicit shell command [usually "sh"].)
I think we've pushed this "anyone can grow up to be president" thing too far.
Did you actually try doing that? Because IIS is doing quite well on that score, last I checked.
Because in the end, someone has to be as powerful as the most powerful state we might logically fear. Right now that is the Russians (simple tanks and bombs), the Chinese (economic warfare), and the Islamofascists (intent). Of these, we cannot afford to fight the Chinese, we are not the bleeding edge in defending against the Russians, and we might be able to defeat the Islamofascists here at home using ideas, not so sure about in other countries.
But the old days of raising armies only when needed has gone the way of the horse and buggy. Unless you are the Swiss, who count on others to provide defacto long-arm defense, you probably cannot count on an armed population either ("Red Dawn not withstanding)
"There is no god but allah" - well, they got it half right.
Speaking of links, the descriptive texts in the first two links in this post are backwards. The reference to the "siphon data from governments and pharmaceutical companies" links to the stealthy trojan link and the "stealthy trojan..." link, links to the "siphon data ..." article.
Tracy Johnson
Old fashioned text games hosted below:
http://empire.openmpe.com/
BT
I've also seen non-FOSS systems that I've trusted. One of them read paper tape.
You are asking for evidence that is guaranteed to not be available. I'm sorry, but it's impossible. Some of the users who are sabotaged will refuse a subpoena rather than admit that they had been penetrated. And the software that they are using is irrelevant to their opinion. Their opinion is driven by image.
OTOH, let me point out that it is irrelevant what the average FOSS user does. It's that any FOSS user who chooses CAN check the code. And this does happen. With closed source products, nobody can legally check the code and report on problems except the company (not the individuals) that owns the copyright. This isn't invariably true, but is almost always true. It's also true that there are open source software packages that aren't free. That used to be a very common model. And most of them would also allow any user to report a detected error TO THEM. Only some of them would allow publication of the error. So there do exist intermediate positions.
The fact that you trust a system says much about how you feel about the system, and little about the system, without knowing you. What tests did you run? Etc. (I'm not asking for an answer, this is rhetoric.) I have often encountered systems which many people trusted and which were later found to have SERIOUS security flaws. Thos Sumner, a Systems Programmer at LBL, once asserted that no program longer than 10 lines could he be certain was operating as intended. I'm not sure whether he was thinking of assembler.
Well, there ARE languages that claim to have proofs of program correctness available. One is a subset of Ada. I once looked into it, and what they proved is that the programs match the specifications, but the specifications were required to be so complex that I was unsure that this improved the actual correctness in any but a formal sense.
I think we've pushed this "anyone can grow up to be president" thing too far.
I assume you meant "than" rather than "then" in your second sentence; it changes the meaning of the whole sentence in this case...
Yep my mistake.
"When information is power, privacy is freedom" - Jah-Wren Ryel