Researchers from Intezer and BlackBerry have discovered malware codenamed Simbiote, used for deploying backdoors and rootkits on compromised servers running Linux. The malware has been identified on the systems of financial institutions in several Latin American countries. To install Simbiote on a system, the attacker must have root access, which can be obtained, for example, by exploiting unpatched vulnerabilities or credential leaks. Simbiote allows an attacker to maintain a presence in the system after a breach for conducting further attacks, hiding the activities of other malicious applications, and intercepting sensitive data.
A key feature of Simbiote is its distribution as a shared library that is loaded during the startup of all processes using the LD_PRELOAD mechanism, replacing certain calls to the standard library. Handlers for these replaced calls hide backdoor-related activities, such as excluding specific items from the process list, blocking access to certain files in /proc, hiding files in directories, excluding the malicious shared library from the output of ldd (by intercepting the execve function and analyzing calls with the LD_TRACE_LOADED_OBJECTS environment variable), and not displaying network sockets associated with the malicious activity.
To protect against traffic inspection, the functions of the libpcap library are overridden, along with filtering of reads from /proc/net/tcp and loading eBPF programs into the kernel that hinder traffic analyzers and drop external requests to the internal network handlers. The eBPF program is executed as one of the first handlers and runs at the lowest level of the network stack, making it possible to conceal the network activity of the backdoor from analyzers launched later.
Simbiote also allows bypassing certain file system activity analyzers, as the theft of sensitive data can occur not at the file opening level but through intercepting read operations from these files in legitimate applications (for example, replacing library functions allows intercepting user-entered passwords or data loaded from files with access keys). To facilitate remote access, Simbiote intercepts some PAM (Pluggable Authentication Module) calls, enabling a connection to the system via SSH with specific attacking credentials. There is also a hidden opportunity for privilege escalation to the root user by setting the HTTP_SETTHIS environment variable.
Source: opennet.ru
