{"id":104340,"date":"2022-06-10T09:36:51","date_gmt":"2022-06-10T07:36:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/simbiote-vredonosnoe-po-dlya-linux-ispolzuyushhee-ebpf-i-ld_preload-dlya-skrytiya"},"modified":"2022-06-10T09:36:51","modified_gmt":"2022-06-10T07:36:52","slug":"simbiote-vredonosnoe-po-dlya-linux-ispolzuyushhee-ebpf-i-ld_preload-dlya-skrytiya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/simbiote-vredonosnoe-po-dlya-linux-ispolzuyushhee-ebpf-i-ld_preload-dlya-skrytiya","title":{"rendered":"Simbiote \u2014 pahavara Linuxile, mis kasutab eBPF-i ja LD_PRELOAD-i peitmiseks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Intezeri ja BlackBerry ettev\u00f5tete teadlased avastasid pahavara, mille koodnimetus on Simbiote, mida kasutatakse tagauste ja rootkitide paigaldamiseks Linuxi operatsioonis\u00fcsteemiga kompromiteeritud serveritesse. Pahavara tuvastati mitme L\u00f5una-Ameerika riigi finantsasutuste s\u00fcsteemides. Simbiote s\u00fcsteemi paigaldamiseks peab r\u00fcndaja omama juurjuurdep\u00e4\u00e4su, mille v\u00f5ib saada n\u00e4iteks \u00e4ra kasutades plaasitud haavatavusi v\u00f5i kasutajakontode lekkeid. Simbiote v\u00f5imaldab p\u00e4rast sissetungi oma kohalolu s\u00fcsteemis kindlustada edasiste r\u00fcnnakute teostamiseks, varjates teiste pahavara rakenduste tegevust ja korraldades konfidentsiaalsete andmete pealtkuulamist. <\/p>\n

Simbiote erip\u00e4ra on levik jagatud teegina, mis laaditakse sisse k\u00f5igi protsesside k\u00e4ivitamise ajal LD_PRELOAD mehhanismi abil ja asendab m\u00f5ned standardteegi funktsioonikutsed. Asendatud funktsioonide t\u00f6\u00f6tlejate kaudu varjatakse tagaukse tegevust, n\u00e4iteks j\u00e4etakse v\u00e4lja teatud elemendid protsesside loendist, blokeeritakse juurdep\u00e4\u00e4s spetsiifilistele failidele kaustas \/proc, varjatakse faile kaustades, eemaldatakse pahavaraline jagatud teek ldd v\u00e4ljundist (rakendatakse execve funktsiooni \u00fclev\u00f5tmine ja ld_TRACE_LOADED_OBJECTS keskkonnamuutuja kutsete anal\u00fc\u00fcs), ei n\u00e4idata seotud pahavara tegevusega v\u00f5rgu sokette. <\/p>\n

Liiklusj\u00e4lgimise kaitsmiseks tehakse libpcap teegi funktsioonide \u00fclev\u00f5tmine, filtritakse \/proc\/net\/tcp lugemist ja laaditakse kerneli eBPF-programmid, mis takistavad liikluse anal\u00fcsaatorite t\u00f6\u00f6d ja blokeerivad kolmandate osapoolte p\u00e4ringud oma v\u00f5rgut\u00f6\u00f6tlejatele. eBPF-programm k\u00e4ivitub esimestena ja t\u00f6\u00f6tab v\u00f5rgu stack'i madalaimal tasemel, mis v\u00f5imaldab peita tagaukse v\u00f5rgu tegevust isegi hiljem k\u00e4ivituvatelt anal\u00fcsaatoritelt. <\/p>\n

Simbiote v\u00f5imaldab samuti m\u00f6\u00f6da minna m\u00f5nest failis\u00fcsteemi aktiivsuse anal\u00fcsaatorist, kuna konfidentsiaalsete andmete vargus v\u00f5ib toimuda mitte failide avamise tasemel, vaid nende failide lugemise operatsioonide haaramise kaudu seaduslike rakenduste kaudu (n\u00e4iteks raamatukogufunktsioonide asendamine v\u00f5imaldab haarata kasutaja sisestatud parooli v\u00f5i failist laaditud juurdep\u00e4\u00e4suv\u00f5tme andmeid). Kaugu sisselogimise korraldamiseks haarab Simbiote m\u00f5ned PAM-kutsed (Pluggable Authentication Module), mis v\u00f5imaldab s\u00fcsteemiga SSH kaudu \u00fchendust v\u00f5tta teatud r\u00fcnnakute kasutajate akrediteeringutega. Samuti on olemas varjatud v\u00f5imalus oma t\u00f5endite t\u00f5stmiseks root-kasutajaks HTTP_SETTHIS keskkonnamuutuja seadistamise kaudu.

\"Simbiote<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Intezer \u0438 BlackBerry \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Simbiote \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0435 \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0438 rootkit-\u043e\u0432 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Linux. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0445 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0439 \u0440\u044f\u0434\u0430 \u0441\u0442\u0440\u0430\u043d \u041b\u0430\u0442\u0438\u043d\u0441\u043a\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0438. \u0414\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 Simbiote \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0435\u043d, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":104341,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104340","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Simbiote \u2013 Linuxi pahavara, mis kasutab eBPF ja LD_PRELOAD varjamiseks | ProHoster","description":"Intezer ja BlackBerry teadlased avastasid pahavara, mille koodinimi on Simbiote ja mida kasutatakse tagaukse ja rootkitide paigaldamiseks kompromiteeritud serveritesse, mis t\u00f6\u00f6tavad.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/simbiote-vredonosnoe-po-dlya-linux-ispolzuyushhee-ebpf-i-ld_preload-dlya-skrytiya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Simbiote \u2014 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0434\u043b\u044f Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0435 eBPF \u0438 LD_PRELOAD \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Intezer \u0438 BlackBerry \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Simbiote \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0435 \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0438 rootkit-\u043e\u0432 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/simbiote-vredonosnoe-po-dlya-linux-ispolzuyushhee-ebpf-i-ld_preload-dlya-skrytiya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-06-10T07:36:52+00:00","article:modified_time":"2022-06-10T07:36:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104340","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-25 11:41:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-06-10 07:38:08","updated":"2026-01-25 11:41:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/104340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=104340"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/104340\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/104341"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=104340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=104340"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=104340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}