Re:Show HN: TripleCross – A Linux eBPF rootkit with a C2 sys...
by h3xduck on Wednesday July 06, 2022 @12:50PM
(#32003565)
eBPF is a Linux technology (now coming to Windows and Android) that allows running code in the kernel without loading kernel modules. Although useful, it has recently been found to be at the heart of the development of an infamous class of malware: rootkits. Bvp47, BPFDoor, Symbiote, these are all rootkits found in 2021 and 2022 that have used eBPF to infect telecommunication, military and financial systems worldwide.
eBPF is mostly available by default in Linux and presents an attack vector to which system administrators are usually unfamiliar with. Following the latest research on the matter by Jeff Dileo at DEFCON27 in 2019, Guillaume Fournier and Sylvain Afchain at DEFCON29 and Patrick H. at DEFCON29 in 2021, our rootkit TripleCross reuses and extends these techniques to build a rootkit that features:
- A library injection module to execute malicious code by writing at a process' virtual memory via a GOT hijacking technique.
- An execution hijacking module that modifies data passed to the kernel to execute malicious programs.
- A local privilege escalation module that allows for running malicious programs with root privileges.
- A backdoor with Command and Control (C2) capabilities that can monitor the network and execute commands sent from a remote rootkit client. It incorporates multiple activation triggers so that these actions are transmitted stealthily.
- A rootkit client that allows an attacker to establish 3 different types of shell-like connections to send commands and actions that control the rootkit state remotely.
- A persistence module that ensures the rootkit remains installed maintaining full privileges even after a reboot event.
- A stealth module that hides rootkit-related files and directories from the user.
This project was part of bachelor's thesis, I am the student that developed the project and I am here to answer any questions if needed!
eBPF is mostly available by default in Linux and presents an attack vector to which system administrators are usually unfamiliar with. Following the latest research on the matter by Jeff Dileo at DEFCON27 in 2019, Guillaume Fournier and Sylvain Afchain at DEFCON29 and Patrick H. at DEFCON29 in 2021, our rootkit TripleCross reuses and extends these techniques to build a rootkit that features:
- A library injection module to execute malicious code by writing at a process' virtual memory via a GOT hijacking technique.
- An execution hijacking module that modifies data passed to the kernel to execute malicious programs.
- A local privilege escalation module that allows for running malicious programs with root privileges.
- A backdoor with Command and Control (C2) capabilities that can monitor the network and execute commands sent from a remote rootkit client. It incorporates multiple activation triggers so that these actions are transmitted stealthily.
- A rootkit client that allows an attacker to establish 3 different types of shell-like connections to send commands and actions that control the rootkit state remotely.
- A persistence module that ensures the rootkit remains installed maintaining full privileges even after a reboot event.
- A stealth module that hides rootkit-related files and directories from the user.
This project was part of bachelor's thesis, I am the student that developed the project and I am here to answer any questions if needed!