Hacker News Reader

Comment by cyberpunk | Hacker News Reader

This is pretty cool, but I keep waiting until someone finds a horribly malicious version of bash that hides processes, directories and so on unless you have a specific env var set.. It could even detect when you do a update and just copy itself back over the new version, since almost all updates are being applied under a shell somewhere (may need a malicious python also then..)

View on HN

Back in my younger days... I’ve had boxes hacked through bugs in bind or sendmail. The hacker would cover their tracks with replacements of “ps”, “ls” and such that attempted to cover their tracks. Good times.

Back in my younger days I wrote a few such patches. Not a lot of people use tripwire anymore!

The old tripwire makes less sense in a world of cloudwalking cattle. Ephemeral containers and VMs everywhere. Machines go up, they go down.

Some of my containers run for weeks between deploys, I’d like to know what changes in ‘em just as much as thay oldskool iaas db server marketing uses ;)

Replacing coreutils used to be a semi-common persistence strategy on Linux, you either swapped out the actual tools or a common library with one that had a hook to start up your RAT or whatever other malicious payload. It had the advantage of almost certainly getting it started very quickly after boot without necessarily leaving anything in an "obvious" place (e.g. cron, profile scripts, etc). I haven't seen this in a while, I would guess the increasing use of antivirus/rootkit detection (these things would be pretty easy to signature) and auditing package managers are both factors.

Actually, last time I saw it the cracker (really a script) had replaced a couple of libraries with 32 bit versions on a 64 bit machine, which lead to most of the coreutils no longer working. Very subtle. 64-bit machines were becoming common by that point but maybe not so much on Linux servers, but still it was a clear sign of low effort!

I don't think anyone bothers to backdoor a shell in that way. Why not just target libc via LD? That tricks bash, sh, python, etc; but you can use setuid to check for the existence of malware that is evading through LD_PRELOAD.

Reply on news.ycombinator.com