Slashdot Mirror
Stealthy Linux Trojan May Have Infected Victims For Years
An anonymous reader writes: Researchers from Moscow-based Kaspersky Labs have uncovered an extremely stealthy trojan for Linux systems that attackers have been using to siphon sensitive data from governments and pharmaceutical companies around the world.
The malware may have sat unnoticed on at least one victim computer for years, although Kaspersky Lab researchers still have not confirmed that suspicion. The trojan is able to run arbitrary commands even though it requires no elevated system privileges.
The malware may have sat unnoticed on at least one victim computer for years, although Kaspersky Lab researchers still have not confirmed that suspicion. The trojan is able to run arbitrary commands even though it requires no elevated system privileges.
I thought that the systemd infection of Debian was much more recent than that. Like within the past year. But maybe I'm wrong, and it has been longer?
The privilege system does not protect commands, it protects data. You can always run any command on any data that belongs to you. But when you want to access data of others or the system, you need elevated privileges and same for attacking to privileged network ports.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
If you are establishing a raw socket, you have to have privileges...
It's an ordinary piece of malware.
It talks home to a hard-coded URL.
It has to have a secret "knock" before it will talk back to you (port-knocking has uses both ways, it seems!).
It contains easily-greppable strings.
Quite what distinguishes this from other malware, I'm not too sure. Just that nobody had seen it before?
The NSA doesn't run botnets... well, not many, anyways. However, they do analyze botnets completely and thoroughly, and thus they can take command of known botnets in a heartbeat if the need arises.
When our name is on the back of your car, we're behind you all the way!
With closed source there are also no guarantees the bad guys won't see the source either. And it's far better to make the code visible to all then to wait for the exploit to be found in the usual ways while everyone was in the dark about it.
Security through obscurity is just like peril-sensitive sunglasses. Having the code visible makes you nervous for some reason? Well we'll just keep you from seeing it! Problem solved!
"When information is power, privacy is freedom" - Jah-Wren Ryel
And it's far better to make the code visible to all then to wait for the exploit to be found in the usual ways while everyone was in the dark about it.
That is quite a strong claim to make without providing evidence to back it up.
And it is. The fact that you may have a 10-year old server infected with some malware, and a FUD article for someone with vested interests in running AV solutions for every machines does not disprove it. Plus it is very easy to have malware and or running external commands through applicational holes, like wordpress both in Windows or Linux if your PHP is not well configured, and it is not exactly "Linux" fault. Pity the article is more concerned with fear mongering than providing technical details.
Linux certainly isn't obscure, or you're being sarcastic and suck at it ...
- Michael T. Babcock (Yes, I blog)
Reading TFA I see no mention of Linux at all, it mentions Windows and PHP. Perhaps the author is confused and believes that anything with .PHP must exist in Linux, but I'm skeptical. They spend lots of time talking about the various .exe files, "Administrator" privileges, and "Network Shares" which are exclusive terminology to the Windows OS. Nobody can be that ignorant as a technical writer.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
There are costs involved in all decisions. I can't drive a car without contributing to the cost of a road. I can't keep warm in a snowstorm without buying shelter. I can't prosper, or even live long, without paying for defense.
Do not rail against war and its expenses, but rather oppose those who use force to achieve their ends.
Contribute to civilization: ari.aynrand.org/donate
Because obviously all the world's problems are always and only caused by government.
It's a pretty good first approximation ....
Faster! Faster! Faster would be better!
"This Turla cd00r-based malware .. can't be discovered via netstat, a commonly used administrative tool" link
'To activate the real remote access service (the attached code starts an inetd to listen on port 5002, which will provide a root shell), one has to send several packets (TCP SYN) to ports on the target system' link
How exactly does this 'Linux trojan' get onto the computers in the first place, without the end user going to a site and downloading the malware and explicidly running it and entering the root password.
If a user can read a file on a *nix system, and can write to even a *single* location, that user can execute that file.
1) Copy the file to the location where I can write.
2) Set the execute flag on the file.
3) Execute the file.
Permissions will prevent you from accessing data you don't have permission to, but will only prevent you from running an application if you can't even see it.
No they can't, and I gave the example. A socket is a file, so go ahead and open up a socket on port 99 as a user. After you figure out you are wrong come back and tell me so. I don't want to rub your nose in you being incorrect, I want others to see that you are incorrect.
If you want another example, go ahead and write and compile a piece of code that executes a shell with UID=0. This is 2 system calls, yet you won't be able execute the shell by running your code without root access, even though you can write the source and compile the binary. The system calls are "suid()" and system() just in case you are lost. Another example would be to copy the su command to what ever location you want and lets see how quickly you can su root. The protection in this case has absolutely nothing to do with what files you can read and where you can write.
File system protection is only 1 layer of *nix security, there is also process protection and memory protection. This does not even consider add on or additional tuning available in limits and SE *nix kernels.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
A government, like any other entity, has a tendency to grow and expand its powers and perimeter. The problem is that the government also makes the laws, which makes it the worst and most dangerous of all entities, because if it doesn't have the absolute powers it's pretty damn close.
Write boring code, not shiny code!