6 ms·

The article says the rootkit works by inserting a line into /etc/rc.local. If my /etc/rc.local file looks OK, can I assume I haven’t been infected, or does the

by sethg 14y ago

The article says the rootkit works by inserting a line into /etc/rc.local. If my /etc/rc.local file looks OK, can I assume I haven’t been infected, or does the rootkit use more sophisticated means to hide its presence?

deweerdt 14y ago
According to http://seclists.org/fulldisclosure/2012/Nov/94 http://seclists.org/fulldisclosure/2012/Nov/94 it would inject an iframe in each http response.
0x0 14y ago
No, one of the earlier reports showed how the rootkit detects reads of /etc/rc.local and feeds you a file that looks like it doesn't contain the rootkit loading insmod calls.
- csense 14y ago
  Disclaimer: I don't have a copy of the rootkit to experiment with; all of this is pure speculation. My guess is you could detect the rootkit by booting to a known-clean system -- for example a distro install CD -- and checking the contents of rc.local by mounting the questionable system's fs. This examination could probably be performed without downtime by taking an LVM snapshot and downloading it to a known-clean machine. The rootkit could fake the contents of the LVM snapshot as well, but it seems like this would be much harder for the rootkit authors and they probably didn't bother. You might also be able to disable it by modifying your startup scripts to ignore rc.local (perhaps you could put a replacement in a non-standard location if you need the functionality).
- wulczer 14y ago
  CrowdStrike says that it hooks vfs_read and if the data read contains the line it injects into /etc/rc.local, it is removed from the read buffer. This means you could just read the file byte-by-byte (I guess runnin dd a couple of times would work), though I haven't tried myself.
stusmall 14y ago
In this article it shows a few ways to check. Apparently they did a poor job of covering their tracks and ps will show you a kernel thread of get_http_inj_fr http://blog.crowdstrike.com/2012/11/http-iframe-injecting-linux-rootkit.html http://blog.crowdstrike.com/2012/11/http-iframe-injecting-li...
krakensden 14y ago
The best part about that is that it appends a startup call at the end of /etc/rc.local- which, by default, ends with 'exit 0'. So its rc.local functionality is actually totally ineffectual.

by sethg 14y ago

deweerdt 14y ago

According to http://seclists.org/fulldisclosure/2012/Nov/94 http://seclists.org/fulldisclosure/2012/Nov/94 it would inject an iframe in each http response.

0x0 14y ago

No, one of the earlier reports showed how the rootkit detects reads of /etc/rc.local and feeds you a file that looks like it doesn't contain the rootkit loading insmod calls.

csense 14y ago
Disclaimer: I don't have a copy of the rootkit to experiment with; all of this is pure speculation. My guess is you could detect the rootkit by booting to a known-clean system -- for example a distro install CD -- and checking the contents of rc.local by mounting the questionable system's fs. This examination could probably be performed without downtime by taking an LVM snapshot and downloading it to a known-clean machine. The rootkit could fake the contents of the LVM snapshot as well, but it seems like this would be much harder for the rootkit authors and they probably didn't bother. You might also be able to disable it by modifying your startup scripts to ignore rc.local (perhaps you could put a replacement in a non-standard location if you need the functionality).
wulczer 14y ago
CrowdStrike says that it hooks vfs_read and if the data read contains the line it injects into /etc/rc.local, it is removed from the read buffer. This means you could just read the file byte-by-byte (I guess runnin dd a couple of times would work), though I haven't tried myself.

stusmall 14y ago

In this article it shows a few ways to check. Apparently they did a poor job of covering their tracks and ps will show you a kernel thread of get_http_inj_fr http://blog.crowdstrike.com/2012/11/http-iframe-injecting-linux-rootkit.html http://blog.crowdstrike.com/2012/11/http-iframe-injecting-li...

krakensden 14y ago

The best part about that is that it appends a startup call at the end of /etc/rc.local- which, by default, ends with 'exit 0'. So its rc.local functionality is actually totally ineffectual.