Showing posts with label mobile arm. Show all posts
Stealthy,
tricky to remove rootkit targets Linux systems on ARM and x86
Security
researchers have identified a new family of Linux rootkits that, despite
running from user mode, can be hard to detect and remove.
Called
Umbreon, after a Pokémon character that hides in the darkness, the rootkit has
been in development since early 2015 and is now being sold on the underground
markets. It targets Linux-based systems on the x86, x86-64 and ARM
architectures, including many embedded devices such as routers.
According
to malware researchers from antivirus firm Trend Micro, Umbreon is a so-called
ring 3 rootkit, meaning that it runs from user mode and doesn't need kernel
privileges. Despite this apparent limitation, it is quite capable of hiding
itself and persisting on the system.
The
rootkit uses a trick to hijack the standard C library (libc) functions without
actually installing any kernel objects. Libc provides system call functions
that other Linux programs can use for important operations like reading and
writing files, spawning processes or sending network packets.
Umbreon
hijacks these functions and forces other Linux executables to use its own
libc-like library. This puts the rootkit in a man-in-the-middle position,
capable of modifying system calls made by other programs and altering their
output.
The
rootkit also creates a hidden Linux account that can be accessed via any
authentication method supported by Linux, including SSH (Secure Shell). This
account does not appear in files like /etc/passwd because the rootkit can
modify the output of such files when read, the Trend Micro researchers said in
a blog post.
Umbreon
also has a backdoor component called Espeon, named after another Pokémon
character, that can establish a reverse shell to an attacker's machine when a
TCP packet with special field values are received on the monitored Ethernet
interface of an affected device. This means that attackers can open remote
shells by simply sending a specially crafted packet to the infected device over
the Internet.
It's
hard to detect Umbreon using standard Linux tools, because most of them are
written in C and rely on libc, whose output the rootkit hijacks, the Trend
Micro researchers said. "One way is to develop a small tool to list the
contents of the default Umbreon rootkit folder using Linux kernel syscalls
directly."
Removing
the rootkit from an infected system can also be tricky, especially for inexperienced
users and attempts to do so could render the system unusable, the researchers
said.
Trend
Micro provided indicators of compromise in the form of file names and hashes,
manual removal instructions and YARA detection rules for the new rootkit.
It
seems that the rootkit was designed for manual installation, which means that
attackers install it on systems manually after compromising them through other
vulnerabilities.
While
many desktop Linux systems receive automatic patches and are generally kept up
to date by users, embedded devices like consumer routers and IP-based cameras
are rarely updated.
As
a result, there are hundreds of thousands of embedded devices out there that
are vulnerable to known exploits and are routinely infected with malware. Just
last week, Web security firm Sucuri blocked a massive DDoS attack that
originated from two botnets, one made up of infected CCTV cameras and one made
up of hijacked home routers.
LG
Electronics Inc unveiled a premium smartphone on Wednesday that the South
Korean firm hopes will help revive its money-losing mobile business, a major
revenue contributor and key customer for components suppliers in the LG group.
LG
announced its V20 just hours before rival Apple Inc is due to launch its latest
iPhone. The V20 also comes about five months after LG launched its flagship G5,
which fell short of expectations due to production problems and competition
from Samsung Electronics Co Ltd's Galaxy S7 phones.
The
G5's disappointing performance pushed LG's mobile arm to its fifth consecutive
quarterly operating loss in April-June. The division made up almost a quarter
of LG's first-half revenue and buys parts from affiliates such as LG Display Co
Ltd and LG Innotek Co Ltd.
"We
hope the V20 will be a turning point," LG mobile division chief Cho Juno
said at a news conference.
LG's
new phone will face tough competition from Apple and Samsung, though the
latter's recall of the newly launched Galaxy Note 7 may work in LG's favor.
Cho
said he was not sure whether the Note 7 recall would help the V20, but would
not comment further on any competition including Samsung and Apple.
The
V20 offers a 5.7 inch display, metal body, replaceable battery and beefed-up
audio capabilities with new chipsets and through a partnership with audio
equipment maker Bang & Olufsen A/S.
It
also has improved photo and video capabilities through features such as dual
rear cameras and reduced blurring on pictures and videos, LG said.
LG
did not disclose pricing or sales targets. It said it would start selling the
phone in South Korea at the end of September, followed at undisclosed times by
markets such as the United States, Hong Kong and China.
