Researchers have spotted a new Linux rootkit, dubbed ‘Syslogk,’ which uses specially crafted “magic packets” to activate a dormant backdoor on the device.
According to the experts from antivirus firm Avast, the Syslogk rootkit is heavily based on an open-source, well-known kernel rootkit for Linux, dubbed Adore-Ng.
The kernel rootkit is hard to detect, it enables hiding processes, files, and even the kernel module. The experts pointed out that it also allows authenticated user-mode processes to interact with the rootkit to control it.
Linux rootkits are malware installed as kernel modules in the operating system. Once installed, they intercept legitimate Linux commands to filter out information that they do not want to be displayed, such as the presence of files, folders, or processes.
The rootkit has a hide_module function which uses the list_del function of the kernel API to remove the module from the linked list of kernel modules. Next, it also accordingly updates its internal module_hidden flag.
The researchers explained that the rootkit has a functionality implemented in the proc_write function that exposes an interface in the /proc file system which could be used as an indicator of compromise when the value 1 is written into the file /proc/syslogk.
Upon discovering the rootkit, it is possible to remove it from memory using the rmmod Linux command.
Syslogk can hide the malicious payload by taking the following actions:
- The hk_proc_readdir function of the rootkit hides directories containing malicious files, effectively hiding them from the operating system.
- The malicious processes are hidden via hk_getpr – a mix of Adore-Ng functions for hiding processes.
- The malicious payload is hidden from tools like Netstat; when running, it will not appear in the list of services. For this purpose, the rootkit uses the function hk_t4_seq_show.
- The malicious payload is not continuously running. The attacker remotely executes it on demand when a specially crafted TCP packet is sent to the infected machine, which inspects the traffic by installing a netfilter hook.
- The attacker can also remotely stop the payload. This requires using a hardcoded key in the rootkit and knowledge of some fields of the magic packet used for remotely starting the payload.
Avast researchers observed the Syslogk rootkit loading a Linux backdoor named Rekoobe, which will be activated on the compromised system when the rootkit receives a “magic packet” from the operators.
The researchers stated that the Syslogk rootkit (and Rekoobe payload) perfectly align when used covertly in conjunction with a fake SMTP server. A backdoor that does not load until some magic packets are sent to the machine. When queried, it appears to be a legitimate service hidden in memory, hidden on disk, remotely ‘magically’ executed, hidden on the network. Even if it is found during a network port scan, it still seems to be a legitimate SMTP server.
Syslogk listens for specially crafted TCP packets that include special “Reserved” field values, “Source Port” numbering between 63400 and 63411 inclusive, “Destination Port” and “Source Address” matches, and a hardcoded key.
According to the experts the Syslogk rootkit is under development and it might implement new features in the next versions.
The researchers warn that it is essential for system administrators and security companies to be aware of this kind of malware and write protections for their users as soon as possible.
Image Credit : IT-Connect
Comments