Showing posts with label Linux systems on ARM. Show all posts
Stealthy,
tricky to remove rootkit targets Linux systems on ARM and x86
Security
researchers have identified a new family of Linux rootkits that, despite
running from user mode, can be hard to detect and remove.
Called
Umbreon, after a Pokémon character that hides in the darkness, the rootkit has
been in development since early 2015 and is now being sold on the underground
markets. It targets Linux-based systems on the x86, x86-64 and ARM
architectures, including many embedded devices such as routers.
According
to malware researchers from antivirus firm Trend Micro, Umbreon is a so-called
ring 3 rootkit, meaning that it runs from user mode and doesn't need kernel
privileges. Despite this apparent limitation, it is quite capable of hiding
itself and persisting on the system.
The
rootkit uses a trick to hijack the standard C library (libc) functions without
actually installing any kernel objects. Libc provides system call functions
that other Linux programs can use for important operations like reading and
writing files, spawning processes or sending network packets.
Umbreon
hijacks these functions and forces other Linux executables to use its own
libc-like library. This puts the rootkit in a man-in-the-middle position,
capable of modifying system calls made by other programs and altering their
output.
The
rootkit also creates a hidden Linux account that can be accessed via any
authentication method supported by Linux, including SSH (Secure Shell). This
account does not appear in files like /etc/passwd because the rootkit can
modify the output of such files when read, the Trend Micro researchers said in
a blog post.
Umbreon
also has a backdoor component called Espeon, named after another Pokémon
character, that can establish a reverse shell to an attacker's machine when a
TCP packet with special field values are received on the monitored Ethernet
interface of an affected device. This means that attackers can open remote
shells by simply sending a specially crafted packet to the infected device over
the Internet.
It's
hard to detect Umbreon using standard Linux tools, because most of them are
written in C and rely on libc, whose output the rootkit hijacks, the Trend
Micro researchers said. "One way is to develop a small tool to list the
contents of the default Umbreon rootkit folder using Linux kernel syscalls
directly."
Removing
the rootkit from an infected system can also be tricky, especially for inexperienced
users and attempts to do so could render the system unusable, the researchers
said.
Trend
Micro provided indicators of compromise in the form of file names and hashes,
manual removal instructions and YARA detection rules for the new rootkit.
It
seems that the rootkit was designed for manual installation, which means that
attackers install it on systems manually after compromising them through other
vulnerabilities.
While
many desktop Linux systems receive automatic patches and are generally kept up
to date by users, embedded devices like consumer routers and IP-based cameras
are rarely updated.
As
a result, there are hundreds of thousands of embedded devices out there that
are vulnerable to known exploits and are routinely infected with malware. Just
last week, Web security firm Sucuri blocked a massive DDoS attack that
originated from two botnets, one made up of infected CCTV cameras and one made
up of hijacked home routers.
