Attacks/Breaches
11/20/2012
04:46 PM
Connect Directly
RSS
E-Mail
50%
50%

New Linux Rootkit Discovered Injecting iFrames

The rootkit is the next step in iFrame-injecting cybercrime operations, according to security firm CrowdStrike

A new Linux rootkit has been discovered that researchers say is designed to inject iFrames into websites and push traffic to malicious sites.

News of the rootkit has circulated for the past few days after an anonymous user of the Full Disclosure mailing list posted about it online. Since then, researchers at Kaspersky Lab and CrowdStrike have poked away at the malware and shared their findings. Designed for 64-bit Linux systems, it specifically targets kernel version 2.6.32-5-amd64, which is the latest kernel used in 64-bit Debian Squeezy.

"The rootkit at hand seems to be the next step in iframe injecting cyber crime operations, driving traffic to exploit kits," Georg Wicherski, senior security researcher at CrowdStrike, said in a blog post. "It could also be used in a Waterhole attack to conduct a targeted attack against a specific target audience without leaving much forensic trail."

According to CrowdStrike, the rootkit does not appear to be a modified version of any known malware, and it seems to be the work of an intermediate-level programmer.

"The malware ensures its startup by adding an entry to the /etc/rc.local script: insmod /lib/modules/2.6.32-5-amd64/kernel/sound/module_init.ko," blogs Marta Janus of Kaspersky Lab. "After loading into memory, the rootkit uses one of two methods to retrieve kernel symbols and write them to the /.kallsyms_tmp file:

/bin/bash -c cat /proc/kallsyms > /.kallsyms_tmp

/bin/bash -c cat /boot/System.map-`uname -r` > /.kallsyms_tmp

"Then it extracts the memory addresses of several kernel functions and variables and stores them in the memory for the later use," she blogs.

In order to hide files and the startup entry, the rootkit hooks a number of kernel functions, including: vfs_readdir, vfs_read, filldir64, and filldir.

In order to actually inject the iFrames (or JavaScript code references) into the HTTP traffic, the rootkit hooks the tcp_sendmsg function, which receives one or multiple buffers to be sent out to the target and appends them to a connections outgoing buffer, notes CrowdStrike's Wicherski.

"The TCP code will then later retrieve data from that buffer and encapsulate it in a TCP packet for transmission," he blogs.

"Based on the Tools, Techniques, and Procedures employed and some background information we cannot publicly disclose, a Russia-based attacker is likely," he adds. "It remains an open question regarding how the attackers have gained the root privileges to install the rootkit. However, considering the code quality, a custom privilege escalation exploit seems very unlikely."

Janus speculates in her analysis that the malware is still in the development stage due to the presence of debugging information and some of the functions do not seem to be fully working or implemented.

"So far, in most of the drive-by download scenarios an automated injection mechanism is implemented as a simple PHP script," Janus states. "In the case described above, we are dealing with something far more sophisticated - a kernel-mode binary component that uses advanced hooking techniques to ensure that the injection process is more transparent and low-level than ever before. This rootkit, though it's still in the development stage, shows a new approach to the drive-by download schema and we can certainly expect more such malware in the future." Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2886
Published: 2014-09-18
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during ins...

CVE-2014-4352
Published: 2014-09-18
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.

CVE-2014-4353
Published: 2014-09-18
Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.

CVE-2014-4354
Published: 2014-09-18
Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.

CVE-2014-4356
Published: 2014-09-18
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.

Best of the Web
Dark Reading Radio