OrBit: New Undetected Linux Threat Uses Unique Hijack of Execution Flow

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by netsec_burn on Thursday July 07, 2022 @04:39PM (#32019044)

This is the same company that wasn't aware that LD_PRELOAD has been in use since the 90's in their last post. Here is that unique method of hijacking execution flow using /etc/ld.so.preload, 20 years ago: https://seclists.org/incidents/2002/Jan/86. None of this is unique or novel, including replacing the loader. LD_PRELOAD rootkits have severe drawbacks (which are not an issue for eBPF rootkits).

[ Parent | on HN ]

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by rhexs on Thursday July 07, 2022 @05:02PM (#32019363)

It’s weird how there’s been a massive uptick in security “threat researchers” blogging about hello world style malware in the past few years. On the plus side, malware reverse engineering is a tough job that traditionally didn’t pay that well, so hopefully they’re doing better now with the rise of all these startups doing blog posts about LD_PRELOAD.

[ Parent | on HN ]

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by TechBro8615 on Thursday July 07, 2022 @06:42PM (#32020546)

There’s a wide gap between the majority of infosec bloggers and the top echelon of experts. I don’t see a problem with that, personally, and it’s not much different than the distribution of expertise in most other software domains. Surely the more the merrier, since at least some of those new entrants will grow into experts.

Also, there’s a reason the “hello world” malware posts are popular - the techniques they’re describing might have been known for years, but they’re practical and they work. Often their longevity is only due to their unfixable nature in exploiting a design flaw. So they’re useful not only from a practical standpoint but also an academic one of demonstrating a class of attack so pernicious that it can only be eliminated with a ground up redesign.

[ Parent | on HN ]

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by ewuhic on Thursday July 07, 2022 @05:26PM (#32019668)

To me all of the sec research still seems like some kind of secret wisdom bound only to the best hackers out there, am I wrong here?

[ Parent | on HN ]

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by rhexs on Thursday July 07, 2022 @05:52PM (#32019980)

That's just the culture of defcon/blackhat/"if you get any certs you're dumb".

If you can program, you can learn almost any concept in security with self study and a handful of good books. Marketing posts, such as these, often aren't very useful but sure look neat with all the basic blocks...

[ Parent | on HN ]

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by AlexSW on Thursday July 07, 2022 @05:26PM (#32019669)

It seems to me hard sometimes to know what all of the 'state-of-the-art' and historic techniques are; in practice there'll likely be far too many to enumerate on a variety of platforms. But I do wonder if there are good lists or compilations anywhere that would include these.

[ Parent | on HN ]

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by netsec_burn on Thursday July 07, 2022 @05:34PM (#32019765)

That is the purpose of resources like MITRE's ATT&CK. Here is the ATT&CK page on the technique which is portrayed to be novel in this post: https://attack.mitre.org/techniques/T1574/006/

[ Parent | on HN ]

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by badrabbit on Thursday July 07, 2022 @10:36PM (#32022384)

That was my first thought as well similar thing. They are right that it isn't being detected but malware detection for Linux has always been lagging.

[ Parent | on HN ]