HiddenWasp Malware Stings Targeted Linux Systems

Re:HiddenWasp Malware Stings Targeted Linux Systems by newnewpdro on Friday May 31, 2019 @02:14AM (#20058619)

The article says to examine 'ld.so' files, but I don't remember the interpreter being named 'ld.so' in remotely recent history.

Perhaps it's a Debianism, but it's been '/lib/ld-linux.so.$ver' for ages:

  $ readelf -p .rodata /lib/ld-linux.so.2  | grep '/etc/ld\.so\.preload'
    [  2d9c]  /etc/ld.so.preload

[ Parent | on HN ]

Re:HiddenWasp Malware Stings Targeted Linux Systems by saagarjha on Friday May 31, 2019 @04:32AM (#20059193)

I don't think the article says this?

> The malware will attempt to find the dynamic linker binary within these paths. The dynamic linker filename is usually prefixed with ld-<version number>.

[ Parent | on HN ]

Re:HiddenWasp Malware Stings Targeted Linux Systems by newnewpdro on Friday May 31, 2019 @04:39AM (#20059218)

'In addition, in order to check if your system is infected, you can search for “ld.so” files — if any of the files do not contain the string ‘/etc/ld.so.preload’, your system may be compromised.'

[ Parent | on HN ]

Re:HiddenWasp Malware Stings Targeted Linux Systems by saagarjha on Friday May 31, 2019 @04:48AM (#20059266)

I think they're assuming that readers will excuse them for a bit of sloppiness for brevity's sake.

[ Parent | on HN ]