Slashdot Mirror
Pokemon-Themed Umbreon Rootkit Targets Linux Systems On ARM and x86 (pcworld.com)
New submitter Kinwolf writes: Security researchers have identified a new family of Linux rootkits that, despite running from user mode, can be hard to detect and remove. Called Umbreon, after a Pokemon character that hides in the darkness, the rootkit has been in development since early 2015 and is now being sold on the underground markets. [It targets Linux-based systems on the x86, x86-64 and ARM architectures, including many embedded devices such as routers.] According to malware researchers from antivirus firm Trend Micro, Umbreon is a so-called ring 3 rootkit, meaning that it runs from user mode and doesn't need kernel privileges. Despite this apparent limitation, it is quite capable of hiding itself and persisting on the system. The reports adds: "The rootkit uses a trick to hijack the standard C library (libc) functions without actually installing any kernel objects. Umbreon hijacks these functions and forces other Linux executables to use its own libc-like library. This puts the rootkit in a man-in-the-middle position, capable of modifying system calls made by other programs and altering their output. The rootkit also creates a hidden Linux account that can be accessed via any authentication method supported by Linux, including SSH (Secure Shell). This account does not appear in files like /etc/passwd because the rootkit can modify the output of such files when read, the Trend Micro researchers said in a blog post. Umbreon also has a backdoor component called Espereon, named after another Pokemon character, that can establish a reverse shell to an attacker's machine when a TCP packet with special field values are received on the monitored Ethernet interface of an affected device."
The solution is apps, because only apps can app apps!
Apps!
Linux is supposed to be impervious to such attacks..
No. The solution is NetBSD with verified exec.
The alternate evolution of alureon?
On Windows, are malicious DLLs now being referred to as "rootkits" as well?
It's malware, sure.
#DeleteChrome
Don't read the article, jump to the blog post. Clear and detailed.
The term rootkit is a concatenation of "root" root/admin-level access. And this program "runs in user mode and cannot get kernel" and yet it's a rootkit. Even antivirus trading companies are now writing and speaking newspeak.
So this attack is rendered useless if you don't link against libc?
Not just misleading, but plain wrong.
It's not a rootkit and it's not Pokemon-themed.
How about: "Linux malware gets named for Pokemon"
Compared to what, Windows? There really needs to be an "Idiot" mod tag.
How to detect Umbreon:
/usr directory is located; write privileges are required. /etc/ld.so.. /usr/lib/libc.so.. /usr/share/libc.so...*.so and remove them as well. /etc/ld.so.preload again.
Most of the tools you will find in Linux are written in C. Even programs written in Perl, Python, Ruby, PHP and other scripting languages end up calling GNU C Library wrappers as their interpreters are also written in C. Because Umbreon library hooks libc functions, creating a reliable tool to detect Umbreon would require a tool that doesn’t use libc.
One way is to develop a small tool to list the contents of the default Umbreon rootkit folder using Linux kernel syscalls directly. This bypasses any malicious C library installed by Umbreon. If the output contains one or more files with names starting with libc.so followed by a random integer, this is the red flag that suggests Umbreon is installed in the machine.
We have also created YARA rules that detect Umbreon, which can be downloaded here.
Removal Instructions
Umbreon is a ring 3 (user level) rootkit, so it is possible to remove it. However, it may be tricky and inexperienced users may break the system and put it into an unrecoverable state. If you are brave enough to proceed, the easiest way is to boot the affected machine with Linux LiveCD and follow the steps:
Mount the partition where the
Backup all the files before making any changes.
Remove the file
Remove the directory
Restore the attributes of the files
Patch the loader library to use
Umount the partition and reboot the system normally.
Politics; n. : A religion whereby man is god.
Comprising the root/admin account is sometimes overrated.
... targets Linux-based systems on the x86, x86-64 and ARM architectures ... puts the rootkit in a man-in-the-middle position... creates a hidden Linux account ... does not appear in files like /etc/passwd because the rootkit can modify the output of such files... also has a backdoor component called Espereon, named after another Pokemon character...
Yeah.... but Pokomon!
When will people wake up and say they had enough? Enough of the soo outdated file menus and high color gradients for old people who don't have touch screens and cell phones on their monitors? Enough of no app stores. Enough of too many options and not someone who can make decisions for you on how you use your system?
If only people learned Windows and saw there is an alternative to Linux.
The year of the Windows desktop is almost here where you do not have these rootkit problems .... Oh wait!?
http://saveie6.com/
I want a verified CEO!
This was actually a contentious issue when the shift to ELF happened back in the 90s on Linux. There was a debate over whether it was better to have fixed binaries that if improperly programmed could have security issues, but were only trojanable if a successful elevation attack took place, or ELF binaries which would allow all sorts of fun relocation features, help cut down on memory usage by making symbols easier to relocate, which could also be used with dynamic address relocation (not actually available on Linux for quite a few more years.) to enhance security by making stack smashing attacks more difficult. But as a big potential downside in regards to ELF files, they allowed library preloading in a manner indistinguishable from normal operation, which is a boon for ensuring future portability of binaries, but a huge bane for system integrity and security.
And now we have an example of that being true at the unprivileged user level. The only thing I am not sure about is if they can escalate privileges, since suid binaries are explicitly supposed to ignore LD_PRELOAD settings to ensure such trojaning doesn't happen.
Does running statically linked busybox version of ls will reveal this rootkit? /bin/busybox ls /etc
I did:
$ sudo apt-get install busybox-static
$
Can anyone confirm?
So, if you run this malware with privileges it can modify the system ?
Color me shocked.
On other news, if a desktop is configured with admin access without password, bad things can happen.
Any other amazing news like this ? I can't wait.
Posting anonymously because too lazy to find my password.
-- Thanatiel
looks like the furries just learned how to skiddie.
This is not a rootkit, but a new cool systemD feature found in latest Fedora release, it will be rolled out to other distributions in the coming months. The problem is that libc is full of cruft and written by oldhats so we need to replace that, but as anyone knows, systemD is MODULAR so if you are a smelly LUDDITE you can disable the feature until it becomes a required dependency.
Why is Linux so oldhat and crufty, why could it not just be a cool Electron app?
Hi there. The article says "manual install" but that can be remotely for sure. It is just a program. Once the server is compromised by web applications vulns for example, the attacker can get a shell, escalate privileges and install the rootkit *remotely*.
timberland pas cher Si vous aimez la mode vous aimez forcément les chaussures. Toute grande fashionista dans l’âme est une shoes addict en puissance ! Avec les chaussures, l’avantage c’est qu’il y en a vraiment pour tous les styles et les goûts.Le problème c’est que du coup, vous ne savez plus trop quoi faire et surtout quoi choisir. Le tout est de savoir ce qui est tendance et ce qu'il faut porter en fonction de la tenue et de l'occasion. Mais pas d'inquiétude : grâce à nous, la mode n’aura plus de secret pour vous !Pour une énorme soirée ou un mariage on ne peut pas porter n’importe quoi. Ce genre d’évènement, ça se prépare. Il faut que l’on soit parfaite. Une occasion exceptionnelle mérite des mesures exceptionnelles !
The rootkit uses a trick to hijack the standard C library (libc) functions without actually installing any kernel objects.
This is literally the only interesting part about this announcement and there is jack-all details about how it's doing this. How does this accomplish what it does on Ring 3? I'd imagine that it uses an inline function hook, but I'd like to know for sure.
Espereon is not a pokemon! The proper spelling is Espeon: http://bulbapedia.bulbagarden.net/wiki/Espeon
"News for nerds. Stuff that matters", my foot!
Long time poke-fan here. The companion pokemon to Umbreon is Espeon, not "Espereon"
When your Evee's happiness meter is maxed out and you level up during nightime, you get Umbreon. If you level up the Evee during the day you get Espeon.
Seriously, pokemon has been out for 20 years now, get your facts straight people!
How exactly does this rootkit get to install and run on the target system, without the enduser explicidly downloading and running the app?
..
"Umbreon is manually installed onto an affected device or server by the attacker."
So, the device has to be already compromised and requires manual installation, nothing to see here
You just wasted your time writing this, suckers!! Linux is secure by design/default (take ur pick)
Requiem for the American Dream
Only way to be protected from hackers is to not be on the internet.
How sad when names from an innocent game about child slavemasters running gladiatorial contests are used for something wicked.
Next they'll be using it to encourage loitering, trespassing, and distracted driving. Just you watch.