Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/20/2012
04:46 PM
50%
50%

New Linux Rootkit Discovered Injecting iFrames

The rootkit is the next step in iFrame-injecting cybercrime operations, according to security firm CrowdStrike

A new Linux rootkit has been discovered that researchers say is designed to inject iFrames into websites and push traffic to malicious sites.

News of the rootkit has circulated for the past few days after an anonymous user of the Full Disclosure mailing list posted about it online. Since then, researchers at Kaspersky Lab and CrowdStrike have poked away at the malware and shared their findings. Designed for 64-bit Linux systems, it specifically targets kernel version 2.6.32-5-amd64, which is the latest kernel used in 64-bit Debian Squeezy.

"The rootkit at hand seems to be the next step in iframe injecting cyber crime operations, driving traffic to exploit kits," Georg Wicherski, senior security researcher at CrowdStrike, said in a blog post. "It could also be used in a Waterhole attack to conduct a targeted attack against a specific target audience without leaving much forensic trail."

According to CrowdStrike, the rootkit does not appear to be a modified version of any known malware, and it seems to be the work of an intermediate-level programmer.

"The malware ensures its startup by adding an entry to the /etc/rc.local script: insmod /lib/modules/2.6.32-5-amd64/kernel/sound/module_init.ko," blogs Marta Janus of Kaspersky Lab. "After loading into memory, the rootkit uses one of two methods to retrieve kernel symbols and write them to the /.kallsyms_tmp file:

/bin/bash -c cat /proc/kallsyms > /.kallsyms_tmp

/bin/bash -c cat /boot/System.map-`uname -r` > /.kallsyms_tmp

"Then it extracts the memory addresses of several kernel functions and variables and stores them in the memory for the later use," she blogs.

In order to hide files and the startup entry, the rootkit hooks a number of kernel functions, including: vfs_readdir, vfs_read, filldir64, and filldir.

In order to actually inject the iFrames (or JavaScript code references) into the HTTP traffic, the rootkit hooks the tcp_sendmsg function, which receives one or multiple buffers to be sent out to the target and appends them to a connections outgoing buffer, notes CrowdStrike's Wicherski.

"The TCP code will then later retrieve data from that buffer and encapsulate it in a TCP packet for transmission," he blogs.

"Based on the Tools, Techniques, and Procedures employed and some background information we cannot publicly disclose, a Russia-based attacker is likely," he adds. "It remains an open question regarding how the attackers have gained the root privileges to install the rootkit. However, considering the code quality, a custom privilege escalation exploit seems very unlikely."

Janus speculates in her analysis that the malware is still in the development stage due to the presence of debugging information and some of the functions do not seem to be fully working or implemented.

"So far, in most of the drive-by download scenarios an automated injection mechanism is implemented as a simple PHP script," Janus states. "In the case described above, we are dealing with something far more sophisticated - a kernel-mode binary component that uses advanced hooking techniques to ensure that the injection process is more transparent and low-level than ever before. This rootkit, though it's still in the development stage, shows a new approach to the drive-by download schema and we can certainly expect more such malware in the future." Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-36197
PUBLISHED: 2021-05-13
An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to compromise the security of the software by gaining privileges, reading sensitive information, executing commands, evading detection, etc. This ...
CVE-2020-36198
PUBLISHED: 2021-05-13
A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Malware Remover versions prior to 4.6.1.0. This issue does not affect: QNAP...
CVE-2021-28799
PUBLISHED: 2021-05-13
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3...
CVE-2021-22155
PUBLISHED: 2021-05-13
An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) version(s) 10.1, 9.1 and earlier could allow an attacker to potentially gain access to the application in the context of the targeted user’s acco...
CVE-2021-23134
PUBLISHED: 2021-05-12
Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.2 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability.