{"id":100066,"date":"2021-04-30T16:23:09","date_gmt":"2021-04-30T14:23:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/rotajakiro-novoe-vredonosnoe-po-dlya-linux-maskiruyushheesya-pod-proczess-systemd"},"modified":"2021-04-30T16:23:09","modified_gmt":"2021-04-30T14:23:09","slug":"rotajakiro-novoe-vredonosnoe-po-dlya-linux-maskiruyushheesya-pod-proczess-systemd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/rotajakiro-novoe-vredonosnoe-po-dlya-linux-maskiruyushheesya-pod-proczess-systemd","title":{"rendered":"RotaJakiro \u2014 uus pahavara Linuxile, mis maskeerib end systemd protsessina","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Uurimist\u00f6\u00f6de labor 360 Netlab teatas Linuxile suunatud uue pahavara avastamisest, mille koodnimi on RotaJakiro. See sisaldab tagaukse rakendust, mis v\u00f5imaldab s\u00fcsteemi kaaperdamist. Pahavara v\u00f5is olla r\u00fcnnakute korraldajate poolt installitud s\u00fcsteemi parandamata haavatavuste \u00e4rakasutamise v\u00f5i ebaturvaliste paroolide abil. <\/p>\n

Tagauks tuvastati kahtlase liikluse anal\u00fc\u00fcsi k\u00e4igus, mis tuli \u00fchest s\u00fcsteemimisest, olles osa DDoS-r\u00fcnnaku struktuurist. Enne seda oli RotaJakiro olnud kolme aasta jooksul m\u00e4rkamata, sealhulgas esimesed proovikatsed kontrollida VirusTotalis faile, mille MD5-kontrollsummad kattusid avastatud pahavaraga, olid dateeritud 2018. aasta maiga. <\/p>\n

RotaJakiro \u00fcheks tunnuseks on erinevate maskeerimistehnikate kasutamine, k\u00e4ivitades nii tavalise kasutaja kui ka root'i \u00f5igustes. Oma kohaloleku varjamiseks kasutas tagauks protsesside nimesid systemd-daemon, session-dbus ja gvfsd-helper, mis, arvestades kaasaegsete Linuxi distributiivide koormust erinevate teenusprotsesside poolt, tundusid esmapilgul legitiimsed ja ei tekitanud kahtlusi. <\/p>\n

Root'i \u00f5igustega k\u00e4ivitamisel luuakse pahavara aktiveerimiseks skriptid \/etc\/init\/systemd-agent.conf ja \/lib\/systemd\/system\/sys-temd-agent.service, samas kui pahavara k\u00e4ivitatav fail paigutati kui \/bin\/systemd\/systemd-daemon ja \/usr\/lib\/systemd\/systemd-daemon (funktsionaalsus duplitseeriti kahes failis). Tavalise kasutaja \u00f5igustes t\u00f6\u00f6tamisel kasutati autostart faili $HOME\/.config\/au-tostart\/gnomehelper.desktop ning muudeti .bashrc, k\u00e4ivitatav fail salvestati kui $HOME\/.gvfsd\/.profile\/gvfsd-helper ja $HOME\/.dbus\/sessions\/session-dbus. Samal ajal k\u00e4ivitati m\u00f5lemad k\u00e4ivitatavad failid, millest iga\u00fcks j\u00e4lgis teise olemasolu ja taastamisv\u00f5imet l\u00f5petamise korral. <\/p>\n

Oma tegevuse tulemuste varjamiseks kasutas tagauks mitmeid kr\u00fcpteerimisalgoritme, n\u00e4iteks AES ressurside kr\u00fcpteerimiseks ja sidekanali varjamiseks juhtimisega. serveriga<\/a> AES, XOR ja ROTATE kombinatsioon koos ZLIB\u2019i tihendamisega. <\/p>\n

Kontrollk\u00e4skude saamiseks p\u00f6\u00f6rdus pahavara nelja domeeni kaudu v\u00f5rguporti 443 (sidekanalis kasutati oma protokolli, mitte HTTPS-i ega TLS-i). Domeenid (cdn.mirror-codes.net, status.sublineover.net, blog.eduelects.com ja news.thaprior.net) registreeriti 2015. aastal ja majutati Kiievi Deltahostis. hostimisettev\u00f5ttest<\/a> Tagaukses oli integreeritud 12 p\u00f5hifunktsiooni, mis v\u00f5imaldasid pluginate allalaadimist ja k\u00e4ivitamist, seadme andmete edastamist, konfidentsiaalsete andmete pealtkuulamist ja kohalike failide haldamist.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f 360 Netlab \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f Linux, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0433\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f RotaJakiro \u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0431\u044d\u043a\u0434\u043e\u0440\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043c\u043e\u0433\u043b\u043e \u0431\u044b\u0442\u044c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c\u0438 \u043f\u043e\u0441\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u043f\u043e\u0434\u0431\u043e\u0440\u0430 \u043d\u0435\u043d\u0430\u0434\u0451\u0436\u043d\u044b\u0445 \u043f\u0430\u0440\u043e\u043b\u0435\u0439. \u0411\u044d\u043a\u0434\u043e\u0440 \u0431\u044b\u043b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0432 \u0445\u043e\u0434\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0442 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100066","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47RotaJakiro \u2014 uus Linuxi pahavara, mis maskeerib end systemd protsessina | ProHoster","description":"Uurimist\u00f6\u00f6de labor 360 Netlab teatas uue Linuxi pahavara avastamisest, mille koodnimi on RotaJakiro, ja mis sisaldab tagaukse teostatust, mis v\u00f5imaldab s\u00fcsteemi juhtida.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/rotajakiro-novoe-vredonosnoe-po-dlya-linux-maskiruyushheesya-pod-proczess-systemd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47RotaJakiro \u2014 \u043d\u043e\u0432\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0434\u043b\u044f Linux, \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u043e\u0434 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 systemd | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f 360 Netlab \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f Linux, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0433\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f RotaJakiro \u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0431\u044d\u043a\u0434\u043e\u0440\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/rotajakiro-novoe-vredonosnoe-po-dlya-linux-maskiruyushheesya-pod-proczess-systemd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-30T14:23:09+00:00","article:modified_time":"2021-04-30T14:23:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100066","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-30 14:30:04","updated":"2026-02-09 21:46:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100066","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=100066"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100066\/revisions"}],"predecessor-version":[{"id":160289,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100066\/revisions\/160289"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=100066"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=100066"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=100066"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}