On Tue, Nov 20, 2012 at 12:11 PM, Jay Lozier <span dir="ltr"><<a href="mailto:jslozier@gmail.com" target="_blank">jslozier@gmail.com</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF"><div><div class="h5">
<div>On 11/20/2012 02:18 PM, David Tomaschik
wrote:<br>
</div>
<blockquote type="cite">Looks like it's targeting 64-bit Debian: <a href="https://threatpost.com/en_us/blogs/new-linux-rootkit-emerges-112012" target="_blank">https://threatpost.com/en_us/blogs/new-linux-rootkit-emerges-112012</a><br clear="all">
<div><br>
</div>
-- <br>
David Tomaschik<br>
OpenPGP: 0x5DEA789B<br>
<a href="http://systemoverlord.com" target="_blank">http://systemoverlord.com</a><br>
<a href="mailto:david@systemoverlord.com" target="_blank">david@systemoverlord.com</a><br>
</blockquote></div></div>
Quick question - how does determine if the rootkit is running? I
tried ps -u foo and did not see any listings for its processes.
Also, the article was some what confusing about who is at risk. The
kernel mentioned is used by Debian but it is an older version (2
something) not a 3 series and it is not clear to me if that is
important.<br></div></blockquote><div><br></div><div>If you want the technical details, see <a href="http://blog.crowdstrike.com/2012/11/http-iframe-injecting-linux-rootkit.html">http://blog.crowdstrike.com/2012/11/http-iframe-injecting-linux-rootkit.html</a>. But basically, the version in the wild does a terrible job of hiding itself. It fails to hide from ps, instead showing kernel threads of [get_http_inj_fr] and [write_startup_c] in ps. That and the traces in /etc/rc.local are probably enough to find the current incarnation easily. That being said, there's nothing on how the attacker is getting root in the first place, and I suspect new versions with better hiding will come out soon.</div>
</div><br><br clear="all"><div><br></div>-- <br>David Tomaschik<br>OpenPGP: 0x5DEA789B<br><a href="http://systemoverlord.com" target="_blank">http://systemoverlord.com</a><br><a href="mailto:david@systemoverlord.com" target="_blank">david@systemoverlord.com</a><br>
</div>