{"id":104340,"date":"2022-06-10T09:36:51","date_gmt":"2022-06-10T07:36:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/simbiote-vredonosnoe-po-dlya-linux-ispolzuyushhee-ebpf-i-ld_preload-dlya-skrytiya"},"modified":"2022-06-10T09:36:51","modified_gmt":"2022-06-10T07:36:52","slug":"simbiote-vredonosnoe-po-dlya-linux-ispolzuyushhee-ebpf-i-ld_preload-dlya-skrytiya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/simbiote-vredonosnoe-po-dlya-linux-ispolzuyushhee-ebpf-i-ld_preload-dlya-skrytiya","title":{"rendered":"Simbiote \u2014 malware per Linux che utilizza eBPF e LD_PRELOAD per nascondersi.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I ricercatori delle aziende Intezer e BlackBerry hanno scoperto un malware con il nome in codice Simbiote, utilizzato per l'implementazione di backdoor e rootkit su server compromessi che eseguono Linux. Il malware \u00e8 stato identificato nei sistemi di istituti finanziari in diversi paesi dell'America Latina. Per installare Simbiote nel sistema, l'attaccante deve avere accesso root, che pu\u00f2 essere ottenuto, ad esempio, sfruttando vulnerabilit\u00e0 non corrette o tramite la compromissione di credenziali. Simbiote consente di mantenere la propria presenza nel sistema dopo una violazione, per effettuare ulteriori attacchi, nascondere le attivit\u00e0 di altri software malevoli e organizzare l'intercettazione di dati confidenziali. <\/p>\n

La caratteristica di Simbiote \u00e8 la sua distribuzione sotto forma di libreria condivisa, che viene caricata all'avvio di tutti i processi tramite il meccanismo LD_PRELOAD e sostituisce alcune chiamate alla libreria standard. I gestori delle chiamate sostituite nascondono l'attivit\u00e0 legata al backdoor, ad esempio escludendo elementi specifici dall'elenco dei processi, bloccando l'accesso a determinati file in \/proc, occultando file nelle directory, escludendo la libreria condivisa dannosa dall'output di ldd (eseguito intercettando la funzione execve e analizzando le chiamate con la variabile d'ambiente LD_TRACE_LOADED_OBJECTS), e non mostrando i socket di rete associati all'attivit\u00e0 malevola. <\/p>\n

Per proteggere dalle ispezioni del traffico, vengono sovrascritte le funzioni della libreria libpcap, filtrando la lettura di \/proc\/net\/tcp e caricando nel kernel programmi eBPF che impediscono il funzionamento degli analizzatori di traffico e scartano richieste esterne ai propri gestori di rete. Il programma eBPF viene avviato tra i primi gestori e viene eseguito al livello pi\u00f9 basso dello stack di rete, consentendo cos\u00ec di nascondere l'attivit\u00e0 di rete del backdoor anche dagli analizzatori avviati successivamente. <\/p>\n

Simbiote consente anche di eludere alcuni analizzatori di attivit\u00e0 nel file system, poich\u00e9 il furto di dati sensibili pu\u00f2 avvenire non a livello di apertura dei file, ma attraverso l'intercettazione delle operazioni di lettura da questi file in applicazioni legittime (ad esempio, la sostituzione di funzioni di libreria consente di intercettare l'input della password dell'utente o i dati caricati da file con una chiave di accesso). Per facilitare l'accesso remoto, Simbiote intercetta alcune chiamate PAM (Pluggable Authentication Module), consentendo di connettersi al sistema via SSH con determinate credenziali attaccanti. \u00c8 anche prevista una possibilit\u00e0 nascosta di elevare i propri privilegi a utente root tramite l'impostazione della variabile d'ambiente HTTP_SETTHIS.

\"Simbiote<\/center>
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Intezer \u0438 BlackBerry \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Simbiote \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0435 \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0438 rootkit-\u043e\u0432 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Linux. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0445 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0439 \u0440\u044f\u0434\u0430 \u0441\u0442\u0440\u0430\u043d \u041b\u0430\u0442\u0438\u043d\u0441\u043a\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0438. \u0414\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 Simbiote \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0435\u043d, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":104341,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104340","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Simbiote \u2014 malware per Linux che utilizza eBPF e LD_PRELOAD per nascondersi | ProHoster","description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Intezer \u0438 BlackBerry \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Simbiote \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0435 \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0438 rootkit-\u043e\u0432 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/simbiote-vredonosnoe-po-dlya-linux-ispolzuyushhee-ebpf-i-ld_preload-dlya-skrytiya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Simbiote \u2014 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0434\u043b\u044f Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0435 eBPF \u0438 LD_PRELOAD \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Intezer \u0438 BlackBerry \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Simbiote \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0435 \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0438 rootkit-\u043e\u0432 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/simbiote-vredonosnoe-po-dlya-linux-ispolzuyushhee-ebpf-i-ld_preload-dlya-skrytiya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-06-10T07:36:52+00:00","article:modified_time":"2022-06-10T07:36:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104340","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-25 11:41:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-06-10 07:38:08","updated":"2026-01-25 11:41:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/104340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=104340"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/104340\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/104341"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=104340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=104340"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=104340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}