Hacker News Reader

Comment by _hyn3 | Hacker News Reader

It's systemd-daemon. The authors knew that systemd was so huge and opaque that it'd go unnoticed. It even has its own systemd unit file.

It doesn't even do "normal" rootkit level of hiding that rootkit detectors might notice; it just hides in plain site as an innocent root process, right out in the open.

View on HN

Probably a good choice running as "systemd-whatever". People have lost track of all the systemd pieces as it's grown in scope, so it doesn't look immediately suspicious.

That's pretty much what I said.. ;)

Your comment was much shorter when I hit reply :)

The svchost.exe of Linux

Other malware has hidden itself as init, mysqld, php-fpm, etc. This is really nothing new.

This technique is really effective when the attacker does a little bit of homework on the system: if it’s a web server, a lot of people (even security analysts) will miss that the 147 httpd process are 146 /usr/sbin/httpd and one /usr/local/sbin/httpd — or they’ll assume that was where someone installed a custom build.

Right. It wouldn't be all that difficult to look at the process list and use heuristics to select a relevant process name.

You could set argv[0] too:

  $ perl -e '$0="/usr/sbin/httpd";fork or sleep 1000';ps

For me, it looks like:

17630 27 S 0:00.00 /usr/sbin/httpd (perl)

which stands out like a sore thumb, IMHO.

That's what I see on FreeBSD.

ps, top, and htop all show /usr/sbin/httpd on Ubuntu.

*BSD, I suppose, but the idea is that the binary itself would be named httpd. Like "cp /usr/bin/perl ./httpd" first.

What does it do?

The name of the program as it was invoked is stored in `argv[0]`. The perl script overwrites the value before continuing on.

Hides the startup command line of the program by masking it with another value. In this example you wouldn't see that the perl program was started, you'll see this httpd thing.

It's not completely reliable but most people wouldn't look that deep anyway.

Good point - I was thinking about persistence but I saw the argv trick in the wild in the early 2000s when someone hit a PHP script in one of our undergrad’s home directory and dropped something fun onto the system.

I think I used lsof back then but it’s been a while.

  $ readlink /proc/`pgrep /usr/sbin/httpd`/exe
  /usr/bin/perl

True, though systemd-* naming scheme provides a substantial amount of brush for mal-binaries/configs to use as persistent cover. Every system could be different, but distros are lazy it seems.

It's also piggybacking on dbus and gvfsd esque names for non root persistence.

They are common but small compared to systemd. there are lots of commonly installed deamons, most people can't keep track of all of their names through all revisions. Even if you did it's still going to be hard to spot with legitimate looking names like this.

This kind of thing is trivially detected with basic system integrity tools [0][1] but I think a lot of those kinds of sysadmin tools have gone out of vogue at this point.

[0] https://access.redhat.com/documentation/en-us/red_hat_enterp...

[1] https://www.redhat.com/sysadmin/security-monitoring-tripwire

rkhunter and samhain are two other similar tools. Both are available in the regular Debian repositories.

rkhunter is nothing but a false sense of security. The detection mechanisms are crude and trivially bypassed. Have a read of the code for yourself.

Yes, it's very simplistic. It does not claim otherwise.

However, it did manage to detect a rootkit on one of my system once (many years ago, when I used to phpMyAdmin, which had some kind of RCE). So it's better than nothing, and it would probably have detected the backdoor from the article (which does not even attempt to hide itself).

I don’t hate SystemD and even prefer writing unit files over init scripts, but it really has usurped the whole system. It’s even usurped fstab on Debian 10 / Ubuntu 20.04 and it’s awful.

If you lose a disk on a modern system, SystemD will refuse to boot. Instead, it’ll try to drop to an emergency console, BUT there’s no root password on those systems because they use sudo. So it just runs in a loop and you’re SOL.

Losing a data disk shouldn’t prevent my system from booting. WTF?

What options are available to avoid this from happening?

I don’t know. Set a root password so you can at least get into the emergency / recovery console.

That doesn't work so well via remote ssh. :(

Two options available : 1) don't use systemD. 2) don't lose a data disk.

Also oddly redundant, most daemons end in a "d" to denote daemon, so that name is a bit like the toe-curling "RAID array".

Reminds me of PAT Testing

This is called the "RAS Syndrome" (where "RAS" stands for "redundant acronym syndrome"): https://en.wikipedia.org/wiki/RAS_syndrome

As the President of the AAPoOAA[0] I'd like to point out that this is the #1 article in our charter.

[0] American Association of over Abused Acronyms </joke>

That is just to highlight the redundancy!

This. If I saw a *d-daemon in the process list, I would feel I must research the origin of the name.

also, "web blog"

Glad to know I'm unaffected since all my machines run openrc and herd.

I'm skeptical since you spelled it "herd" (or maybe auto-correct strikes again.) But yeah, keeping your system free from the systemd cancer has always been a good idea.

Maybe "herd" is an actual tool, separate from Hurd? Or "and herd" here is equivalent to "et al?" Impossible to search for though.

et armenta ?

Hurd/Hird you mean :)

In December 1991 the primary architect of the Hurd described the name as a mutually recursive acronym:

It's time [to] explain the meaning of "Hurd". "Hurd" stands for "Hird of Unix-Replacing Daemons". And, then, "Hird" stands for "Hurd of Interfaces Representing Depth". We have here, to my knowledge, the first software to be named by a pair of mutually recursive acronyms.

- Thomas (then Michael) Bushnell

https://en.wikipedia.org/wiki/GNU_Hurd#Name_and_logo

What deelowe said. Shepherd's cli tool is herd. For example you can run sudo herd status. In practice it means they are running GNU Guix

Pretty sure they are referring to herd and shepherd: https://www.gnu.org/software/shepherd/manual/html_node/herd-...

Ooh, thanks! I hadn't ever heard of that, and was for some reason assuming "Hurd" kernel. I'll give it a try.

Reply on news.ycombinator.com