Attacks/Breaches
11/20/2012
04:46 PM
50%
50%

New Linux Rootkit Discovered Injecting iFrames

The rootkit is the next step in iFrame-injecting cybercrime operations, according to security firm CrowdStrike

A new Linux rootkit has been discovered that researchers say is designed to inject iFrames into websites and push traffic to malicious sites.

News of the rootkit has circulated for the past few days after an anonymous user of the Full Disclosure mailing list posted about it online. Since then, researchers at Kaspersky Lab and CrowdStrike have poked away at the malware and shared their findings. Designed for 64-bit Linux systems, it specifically targets kernel version 2.6.32-5-amd64, which is the latest kernel used in 64-bit Debian Squeezy.

"The rootkit at hand seems to be the next step in iframe injecting cyber crime operations, driving traffic to exploit kits," Georg Wicherski, senior security researcher at CrowdStrike, said in a blog post. "It could also be used in a Waterhole attack to conduct a targeted attack against a specific target audience without leaving much forensic trail."

According to CrowdStrike, the rootkit does not appear to be a modified version of any known malware, and it seems to be the work of an intermediate-level programmer.

"The malware ensures its startup by adding an entry to the /etc/rc.local script: insmod /lib/modules/2.6.32-5-amd64/kernel/sound/module_init.ko," blogs Marta Janus of Kaspersky Lab. "After loading into memory, the rootkit uses one of two methods to retrieve kernel symbols and write them to the /.kallsyms_tmp file:

/bin/bash -c cat /proc/kallsyms > /.kallsyms_tmp

/bin/bash -c cat /boot/System.map-`uname -r` > /.kallsyms_tmp

"Then it extracts the memory addresses of several kernel functions and variables and stores them in the memory for the later use," she blogs.

In order to hide files and the startup entry, the rootkit hooks a number of kernel functions, including: vfs_readdir, vfs_read, filldir64, and filldir.

In order to actually inject the iFrames (or JavaScript code references) into the HTTP traffic, the rootkit hooks the tcp_sendmsg function, which receives one or multiple buffers to be sent out to the target and appends them to a connections outgoing buffer, notes CrowdStrike's Wicherski.

"The TCP code will then later retrieve data from that buffer and encapsulate it in a TCP packet for transmission," he blogs.

"Based on the Tools, Techniques, and Procedures employed and some background information we cannot publicly disclose, a Russia-based attacker is likely," he adds. "It remains an open question regarding how the attackers have gained the root privileges to install the rootkit. However, considering the code quality, a custom privilege escalation exploit seems very unlikely."

Janus speculates in her analysis that the malware is still in the development stage due to the presence of debugging information and some of the functions do not seem to be fully working or implemented.

"So far, in most of the drive-by download scenarios an automated injection mechanism is implemented as a simple PHP script," Janus states. "In the case described above, we are dealing with something far more sophisticated - a kernel-mode binary component that uses advanced hooking techniques to ensure that the injection process is more transparent and low-level than ever before. This rootkit, though it's still in the development stage, shows a new approach to the drive-by download schema and we can certainly expect more such malware in the future." Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2808
Published: 2015-04-01
The PRNG implementation in the DNS resolver in Bionic in Android before 4.1.1 incorrectly uses time and PID information during the generation of random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a rel...

CVE-2014-9713
Published: 2015-04-01
The default slapd configuration in the Debian openldap package 2.4.23-3 through 2.4.39-1.1 allows remote authenticated users to modify the user's permissions and other user attributes via unspecified vectors.

CVE-2015-0259
Published: 2015-04-01
OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.

CVE-2015-0800
Published: 2015-04-01
The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2...

CVE-2015-0801
Published: 2015-04-01
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.