{"id":104340,"date":"2022-06-10T09:36:51","date_gmt":"2022-06-10T07:36:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/simbiote-vredonosnoe-po-dlya-linux-ispolzuyushhee-ebpf-i-ld_preload-dlya-skrytiya"},"modified":"2022-06-10T09:36:51","modified_gmt":"2022-06-10T07:36:52","slug":"simbiote-vredonosnoe-po-dlya-linux-ispolzuyushhee-ebpf-i-ld_preload-dlya-skrytiya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/simbiote-vredonosnoe-po-dlya-linux-ispolzuyushhee-ebpf-i-ld_preload-dlya-skrytiya","title":{"rendered":"Simbiote \u2014 nj\u00eb malware p\u00ebr Linux q\u00eb p\u00ebrdor eBPF dhe LD_PRELOAD p\u00ebr t\u00eb u fshehur","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

K\u00ebrkuesit nga kompanit\u00eb Intezer dhe BlackBerry zbuluan malware-n me emrin kodor Simbiote, i p\u00ebrdorur p\u00ebr t\u00eb instaluar biek\u0161\u00eb dhe rootkit n\u00eb serverat e kompromentuar q\u00eb funksionojn\u00eb me Linux. Ky malware \u00ebsht\u00eb identifikuar n\u00eb sistemet e institucioneve financiare n\u00eb disa vende t\u00eb Amerik\u00ebs Latine. P\u00ebr t\u00eb instaluar Simbiote n\u00eb sistem, sulmuesi duhet t\u00eb ket\u00eb akses root, i cili mund t\u00eb merret, p\u00ebr shembull, si rezultat i shfryt\u00ebzimit t\u00eb dob\u00ebsive t\u00eb pap\u00ebrmir\u00ebsuara ose rrjedhjes s\u00eb llogarive. Simbiote lejon t\u00eb konsolidoj\u00eb pranin\u00eb e saj n\u00eb sistem pas hack-imit p\u00ebr t\u00eb kryer sulme t\u00eb tjera, p\u00ebr t\u00eb fshehur aktivitetin e aplikacioneve t\u00eb tjera t\u00eb keqe dhe p\u00ebr t\u00eb organizuar kapjen e t\u00eb dh\u00ebnave konfidenciale. <\/p>\n

Karakteristika e Simbiotit \u00ebsht\u00eb p\u00ebrhapja n\u00eb form\u00ebn e nj\u00eb biblioteke t\u00eb ndar\u00eb, e cila ngarkohet n\u00eb fillim t\u00eb t\u00eb gjitha proceseve p\u00ebrmes mekanizmit LD_PRELOAD dhe z\u00ebvend\u00ebson disa thirrje t\u00eb bibliotek\u00ebs standarde. Menaxher\u00ebt e thirrjeve t\u00eb z\u00ebvend\u00ebsuara fshehin aktivitetin e lidhur me backdoor-in, p\u00ebr shembull, p\u00ebrjashtojn\u00eb elemente t\u00eb ve\u00e7anta nga lista e proceseve, bllokojn\u00eb qasjen n\u00eb disa skedar\u00eb n\u00eb \/proc, fshehin skedar\u00eb n\u00eb katalogje, p\u00ebrjashtojn\u00eb bibliotek\u00ebn e ndar\u00eb t\u00eb keqe nga dalja e ldd (e cila realizohet p\u00ebrmes kapjes s\u00eb funksionit execve dhe analiz\u00ebs s\u00eb thirrjeve me variablin e ambientit LD_TRACE_LOADED_OBJECTS), nuk tregojn\u00eb soket rrjetesh t\u00eb lidhura me aktivitetin e d\u00ebmshme. <\/p>\n

P\u00ebr t\u00eb mbrojtur nga inspektimi i trafikut, realizohet.override e funksioneve t\u00eb bibliotek\u00ebs libpcap, filtrimi i leximit \/proc\/net\/tcp dhe ngarkimi n\u00eb kernel t\u00eb programeve eBPF, t\u00eb cilat parandalojn\u00eb funksionimin e analizator\u00ebve t\u00eb trafikut dhe hedhin posht\u00eb k\u00ebrkesat e jashtme p\u00ebr p\u00ebrpunuesit tan\u00eb t\u00eb rrjetit. Programi eBPF ekzekutohet nd\u00ebr t\u00eb parat n\u00eb p\u00ebrpunuesit dhe kryhet n\u00eb nivelin m\u00eb t\u00eb ul\u00ebt t\u00eb bunker\u00ebve t\u00eb rrjetit, duke lejuar q\u00eb t\u00eb fsheh\u00eb aktivitetin e rrjetit t\u00eb backdoor edhe nga analizator\u00ebt q\u00eb fillojn\u00eb m\u00eb von\u00eb. <\/p>\n

Simbiote lejon edhe mund\u00ebson anashkalimin e disa analizator\u00ebve t\u00eb aktiviteteve n\u00eb sistemin e skedar\u00ebve, pasi vjedhja e t\u00eb dh\u00ebnave sensitive mund t\u00eb ndodh\u00eb jo n\u00eb nivelin e hapjes s\u00eb skedareve, por p\u00ebrmes kapjes s\u00eb operacioneve t\u00eb leximit nga k\u00ebto skedare n\u00eb aplikacione legjitime (p\u00ebr shembull, z\u00ebvend\u00ebsimi i funksioneve t\u00eb bibliotekave lejon kapjen e inputit t\u00eb p\u00ebrdoruesit p\u00ebr fjal\u00ebkalimin ose t\u00eb dh\u00ebnat e ngarkuara nga skedari me \u00e7el\u00ebsin e qasjes). P\u00ebr t\u00eb organizuar hyrjen e larg\u00ebt, Simbiote kap disa thirrje PAM (Pluggable Authentication Module), duke lejuar k\u00ebshtu lidhjen n\u00eb sistem p\u00ebrmes SSH me kredenciale t\u00eb caktuara sulmuese. Gjithashtu \u00ebsht\u00eb parapar\u00eb edhe nj\u00eb mund\u00ebsi e fsheht\u00eb p\u00ebr t\u00eb rritur privilegjet e tij deri te p\u00ebrdoruesi root n\u00ebp\u00ebrmjet vendosjes s\u00eb nj\u00eb variabli mjedisor HTTP_SETTHIS.

\"Simbiote<\/center>
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Intezer \u0438 BlackBerry \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Simbiote \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0435 \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0438 rootkit-\u043e\u0432 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Linux. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0445 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0439 \u0440\u044f\u0434\u0430 \u0441\u0442\u0440\u0430\u043d \u041b\u0430\u0442\u0438\u043d\u0441\u043a\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0438. \u0414\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 Simbiote \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0435\u043d, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":104341,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104340","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Simbiote \u2014 malware p\u00ebr Linux, p\u00ebrdor eBPF dhe LD_PRELOAD p\u00ebr t'u fshehur | ProHoster","description":"K\u00ebrkuesit nga kompanit\u00eb Intezer dhe BlackBerry zbuluan nj\u00eb malware me emrin Simbiote q\u00eb p\u00ebrdoret p\u00ebr t\u00eb instaluar backdoora dhe rootkit n\u00eb server\u00ebt e komprometuar, q\u00eb funksionojn\u00eb me Linux. Malware-u u identifikua n\u00eb sistemet e institucioneve financiare n\u00eb disa vende t\u00eb Amerik\u00ebs Latine. P\u00ebr t\u00eb instaluar Simbiote n\u00eb sistem, sulmuesi duhet t\u00eb ket\u00eb akses root, i cili mund t\u00eb fitohet, p\u00ebr shembull, si rezultat i","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/simbiote-vredonosnoe-po-dlya-linux-ispolzuyushhee-ebpf-i-ld_preload-dlya-skrytiya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Simbiote \u2014 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0434\u043b\u044f Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0435 eBPF \u0438 LD_PRELOAD \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Intezer \u0438 BlackBerry \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Simbiote \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0435 \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0438 rootkit-\u043e\u0432 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Linux. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0445 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0439 \u0440\u044f\u0434\u0430 \u0441\u0442\u0440\u0430\u043d \u041b\u0430\u0442\u0438\u043d\u0441\u043a\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0438. \u0414\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 Simbiote \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0435\u043d, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/simbiote-vredonosnoe-po-dlya-linux-ispolzuyushhee-ebpf-i-ld_preload-dlya-skrytiya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-06-10T07:36:52+00:00","article:modified_time":"2022-06-10T07:36:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104340","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-25 11:41:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-06-10 07:38:08","updated":"2026-01-25 11:41:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/104340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=104340"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/104340\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/104341"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=104340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=104340"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=104340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}