Laboratorul de cercetare 360 Netlab a raportat descoperirea unui nou malware pentru Linux, denumit RotaJakiro, care include o implementare a unui backdoor ce permite controlul sistemului. Malware-ul ar fi putut fi instalat de atacatori prin exploatarea vulnerabilit\u0103\u021bilor necorectate \u00een sistem sau prin utilizarea unor parole nesigure. <\/p>\n
Backdoor-ul a fost descoperit \u00een timpul analizei unui trafic suspect provenind de la unul dintre procesele de sistem, identificat \u00een analiza structurii botnet-ului folosit pentru atacuri DDoS. P\u00e2n\u0103 acum, RotaJakiro a r\u0103mas intact timp de trei ani, prima tentativ\u0103 de verificare \u00een serviciul VirusTotal a fi\u0219ierelor cu hash-uri MD5 corespunz\u0103toare malware-ului identificat fiind datat\u0103 mai 2018. <\/p>\n
Una dintre caracteristicile RotaJakiro este utilizarea diferitelor tehnici de camuflaj la rularea cu privilegii de utilizator neprivilegiat \u0219i root. Pentru a-\u0219i ascunde prezen\u021ba, backdoor-ul a folosit nume de procese precum systemd-daemon, session-dbus \u0219i gvfsd-helper, care, av\u00e2nd \u00een vedere aglomerarea modernelor distribu\u021bii Linux cu diverse procese de sistem, p\u0103reau legale la prima vedere \u0219i nu ridicau suspiciuni. <\/p>\n
Atunci c\u00e2nd era rulat cu privilegii root, malware-ul crea scripturi \/etc\/init\/systemd-agent.conf \u0219i \/lib\/systemd\/system\/sys-temd-agent.service, iar fi\u0219ierul executabil malware era plasat ca \/bin\/systemd\/systemd-daemon \u0219i \/usr\/lib\/systemd\/systemd-daemon (func\u021bionalitatea era duplicat\u0103 \u00een cele dou\u0103 fi\u0219iere). La executarea cu privilegii de utilizator obi\u0219nuit, se folosea fi\u0219ierul de autostart $HOME\/.config\/auto-start\/gnomehelper.desktop, modific\u00e2ndu-se .bashrc, iar fi\u0219ierul executabil era salvat ca $HOME\/.gvfsd\/.profile\/gvfsd-helper \u0219i $HOME\/.dbus\/sessions\/session-dbus. Ambele fi\u0219iere executabile erau rulate simultan, fiecare supraveghind prezen\u021ba celuilalt \u0219i regener\u00e2ndu-l \u00een cazul \u00een care se \u00eencheia. <\/p>\n
Pentru a ascunde rezultatele activit\u0103\u021bii sale, backdoor-ul aplica mai multe algoritmi de criptare, de exemplu, pentru criptarea resurselor sale se folosea AES, iar pentru ascunderea canalului de comunicare cu serverul de comand\u0103 serverul<\/a> o combina\u021bie din AES, XOR \u0219i ROTATE \u00eempreun\u0103 cu comprimarea utiliz\u00e2nd ZLIB. <\/p>\n Pentru a ob\u021bine comenzi de control, software-ul malware a accesat 4 domenii prin portul de re\u021bea 443 (\u00een canalul de comunicare a fost utilizat un protocol propriu, nu HTTPS \u0219i TLS). Domeniile (cdn.mirror-codes.net, status.sublineover.net, blog.eduelects.com \u0219i news.thaprior.net) au fost \u00eenregistrate \u00een 2015 \u0219i g\u0103zduite de o companie din Kiev. furnizor de g\u0103zduire<\/a> Deltahost. \u00cen backdoor au fost integrate 12 func\u021bii de baz\u0103, care permiteau \u00eenc\u0103rcarea \u0219i executarea de pluginuri cu func\u021bionalitate extins\u0103, transmiterea datelor despre dispozitiv, interceptarea datelor confiden\u021biale \u0219i gestionarea fi\u0219ierelor locale. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f 360 Netlab \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f Linux, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0433\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f RotaJakiro \u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0431\u044d\u043a\u0434\u043e\u0440\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043c\u043e\u0433\u043b\u043e \u0431\u044b\u0442\u044c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c\u0438 \u043f\u043e\u0441\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u043f\u043e\u0434\u0431\u043e\u0440\u0430 \u043d\u0435\u043d\u0430\u0434\u0451\u0436\u043d\u044b\u0445 \u043f\u0430\u0440\u043e\u043b\u0435\u0439. \u0411\u044d\u043a\u0434\u043e\u0440 \u0431\u044b\u043b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0432 \u0445\u043e\u0434\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0442 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100066","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47RotaJakiro \u2014 noul malware pentru Linux, care se mascheaz\u0103 sub procesul systemd | ProHoster","description":"Laboratorul de cercetare 360 Netlab a raportat descoperirea unui nou malware pentru Linux, av\u00e2nd numele de cod RotaJakiro \u0219i incluz\u00e2nd o implementare de backdoor care permite controlul sistemului.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/rotajakiro-novoe-vredonosnoe-po-dlya-linux-maskiruyushheesya-pod-proczess-systemd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47RotaJakiro \u2014 \u043d\u043e\u0432\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0434\u043b\u044f Linux, \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u043e\u0434 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 systemd | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f 360 Netlab \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f Linux, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0433\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f RotaJakiro \u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0431\u044d\u043a\u0434\u043e\u0440\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/rotajakiro-novoe-vredonosnoe-po-dlya-linux-maskiruyushheesya-pod-proczess-systemd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-30T14:23:09+00:00","article:modified_time":"2021-04-30T14:23:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100066","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-30 14:30:04","updated":"2026-02-09 21:46:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100066","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=100066"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100066\/revisions"}],"predecessor-version":[{"id":160289,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100066\/revisions\/160289"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=100066"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=100066"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=100066"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"