Hacker News Reader

Comment by voltagex_ | Hacker News Reader

>Azazel hooks ptrace() and returns -1, hence denying any debugging from occuring. The message displayed to the sysadmin is really more of a joke than anything and will definitely set off alarms that something is wrong.

Okay, that's interesting - how would you remove this hook?

View on HN

It's an LD_PRELOAD so it's likely either: 1. a environmental variable for the user, in which case you just need to clear their rc files. 2. In /etc for all users. In which case you'll just have to remove the file. To get around hiding you can use debugfs point to block device (/dev/sda1?). Navigate to find the offending file and mv it.

As someone else points out, all statically linked binaries are immune to this technique since they don't load preloads.

Another warning is don't muck around with /etc/ld.so.preload unless you know what you're doing. It's possible to get in a state that everything you executes segfaults.

Use statically-linked utilities compiled elsewhere.

Adding to that: Most Linux distributions will have a ready-compiled "busybox" in their repositories (which is a "swiss-army-knife" program incorporating the functionality of a lot of the common utilities). Of course taking it from a potentially infected machine doesn't makes sense, but you might want to copy it over with a usb-stick.

$ ldd /usr/bin/busybox not a dynamic executable

$ ls -l /usr/bin/busybox -rwxr-xr-x 1 root root 1795976 Jan 20 14:21 /usr/bin/busybox*

$ file /usr/bin/busybox /usr/bin/busybox: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=76e26ac5c916fc1e715c9a49c10db3405b26a22c, stripped

$ busybox BusyBox v1.22.1 (2014-01-20 17:20:52 MSK) multi-call binary. BusyBox is copyrighted by many authors between 1998-2012. Licensed under GPLv2. See source distribution for detailed copyright notices.

Usage: busybox [function [arguments]...] or: busybox --list[-full] or: busybox --install [-s] [DIR] or: function [arguments]...

		BusyBox is a multi-call binary that combines many common Unix
		utilities into a single executable.  Most people will create a
		link to busybox for each function they wish to use and BusyBox
		will act like whatever it was invoked as.

	Currently defined functions:
		[, [[, addgroup, adduser, adjtimex, ar, arp, arping, ash, awk, base64,
		basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat,
		bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd,
		chpst, chroot, chrt, chvt, cksum, clear, cmp, comm, cp, cpio, crond,
	(...)
		uudecode, uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog,
		wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip

Can you explain in a more newbie friendly language? How do you detect this? Then how do you remove this? This type of high level tools becoming more mainstream as time passes. Today there is not much generic anti-tools for this or the upcoming ones!

Firstly, this is not some virus or worm that works it's way onto your machine. It's a payload that someone puts there possibly among other things. This means that if you have this on your machine, or if you have reason to think you have this on your machine, simple removal is not an acceptable solution. Whoever put the rootkit on the machine could have done almost anything else while he did it, and you are not guaranteed to find it all. If you find this on your machine, you need to produce a data-only backup of the machine, kill the partitions, and set it up again.

As these rootkits are designed by rather smart people to overcome all existing tools, there simply cannot be generic tools that catch them all. If you get hit by a bunch of script kiddies using outdated tools, things like rkhunter and chkrootkit can help. Modern rootkits are almost by definition undetectable by them. If it's actually new, the way you find out about it is typically either a separate NID box between the machine and the wall that alerts, or the behaviour of the box changing.

So for a low traffic Web server like application, we might be running the OS itself (/) from a read only filesystem (e.g. making a 'live' CD-ROM or USB image) and having read/write only for user files and logs?

End user here: I just have a Linux laptop, interested in servers on the 'wild' web

Booting from an unchangeable image is the Joyent SmartOS approach, IIRC.

Typically when you're compromised, you don't bother trying to fix the problem. You wipe the device and start over from a believed-good backup.

Even wiping device might not be the solution. What if that softwate injected into boot or any other microcontroller of a hw part.

Or use dlopen, dlsym to get the real function.

Yes, as long as dlopen and dlsym aren't also hooked.

You could also use asm to directly invoke sys_ptrace, since this rootkit doesn't have any kernel components.

LD_PRELOAD perhaps? I wonder if that would run last, rather than the rootkit?

Reply on news.ycombinator.com