2y ago

Chinese hackers have unleashed a never-before-seen Linux backdoor

Chinese hackers have unleashed a never-before-seen Linux backdoor::SprySOCKS borrows from open source Windows malware and adds new tricks.

Technology @lemmy.world

ZeroCool @feddit.ch

2y ago

arstechnica.com /security/2023/09/never-before-seen-linux-backdoor-is-a-windows-malware-knockoff/

Linux @lemmy.world

Leo @lemmy.linuxuserspace.show

2y ago

Never-before-seen Linux backdoor is a Windows malware knockoff

arstechnica.com /security/2023/09/never-before-seen-linux-backdoor-is-a-windows-malware-knockoff/

Linux @lemmy.ml

Leo @lemmy.linuxuserspace.show

2y ago

Never-before-seen Linux backdoor is a Windows malware knockoff

arstechnica.com /security/2023/09/never-before-seen-linux-backdoor-is-a-windows-malware-knockoff/

18 comments

CVE-2022-40684 An authentication bypass vulnerability in Fortinet FortiOS, FortiProxy and FortiSwitchManager
CVE-2022-39952 An unauthenticated remote code execution (RCE) vulnerability in Fortinet FortiNAC
CVE-2021-22205 An unauthenticated RCE vulnerability in GitLab CE/EE
CVE-2019-18935 An unauthenticated remote code execution vulnerability in Progress Telerik UI for ASP.NET AJAX
CVE-2019-9670 / CVE-2019-9621 A bundle of two vulnerabilities for unauthenticated RCE in Zimbra Collaboration Suite
ProxyShell (CVE-2021-34473, CVE-2021-34523v, CVE-2021-31207) A set of three chained vulnerabilities that perform unauthenticated RCE in Microsoft Exchange
- Thanks. I read the article but (from my reading) they left out the most important part out: how it spreads and infects a machine. Sometimes they make a huge deal about a Linux backdoor and then it's revealed right at the end (if at all) that it requires local access. Wah whaa. Now I have to scan every article to see what the actual method is.
  
  That just means your need your man on the inside and considering we just had a situation where a Chinese asset was employed for the local power corporation, I don't think it's that much of an issue...
- They’re doing some CYA, but still: “including (but not limited to)”.
SprySOCKS Capabilities:

ID NOTES
0x09 Gets machine information
0x0a Starts interactive shell
0x0b Writes data to interactive shell
0x0d Stops interactive shell
0x0e Lists network connections (parameters: “ip”, “port”, “commName”, “connectType”)
0x0f Sends packet (parameter: “target”)
0x14, 0x19 Sends initialization packet
0x16 Generates and sets clientid
0x17 Lists network connections (parameters: “tcp_port”, “udp_port”, “http_port”, “listen_type”, “listen_port”)
0x23 Creates SOCKS proxy
0x24 Terminates SOCKS proxy
0x25 Forwards SOCKS proxy data
0x2a Uploads file (parameters: “transfer_id”, “size”)
This is the best summary I could come up with:
Researchers from NHS Digital in the UK have said Trochilus was developed by APT10, an advanced persistent threat group linked to the Chinese government that also goes by the names Stone Panda and MenuPass.
In June, researchers from security firm Trend Micro found an encrypted binary file on a server known to be used by a group they had been tracking since 2021.
The Linux malware ported several functions found in Trochilus and combined them with a new Socket Secure (SOCKS) implementation.
The Trend Micro researchers eventually named their discovery SprySOCKS, with “spry” denoting its swift behavior and the added SOCKS component.
Besides showing interest in espionage activities, Earth Lusca seems financially motivated, with sights set on gambling and cryptocurrency companies.
Monday’s Trend Micro report provides IP addresses, file hashes, and other evidence that people can use to determine if they've been compromised.
The original article contains 537 words, the summary contains 143 words. Saved 73%. I'm a bot and I'm open source!
- Ok, but what does it attack? Systemd, udev, fuse, …?
  
  link to another article with the cve's: https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html
What part of that is a never before seen backdoor?
- Since it’s a newly discovered virus, the entire thing. Doesn’t mean the tactics have never been seen before, just the specific implementation of Trochilus on Linux + SOCKS.
  It’s poor writing to sound more dramatic while still being true.

18 comments