OrBit: New Undetected Linux Threat Uses Unique Hijack of Execution Flow

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by badrabbit on Thursday July 07, 2022 @10:39PM (#32022410)

Avoid using Glibc or patch-out LD_PRELOAD unless you need it. I don't mean as a response to this one threat but in general it seems to be the go to hooking mechanism. With this measure and signed kernel module loading enforcement with secureboot you can make it more hostile for untargeted malware to succeed in persisting or installing a rootkit.

[ Parent | on HN ]

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by egberts1 on Friday July 08, 2022 @07:55AM (#32025955)

Yeah, I would love a list of “downsides” if one were to compile-out the LD_PRELOAD.

As far as I can gather, one cannot do GDB without recompiling with --gdb option if LD_PRELOAD were disabled at compile-time.

[ Parent | on HN ]

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by cstrahan on Friday July 08, 2022 @06:14PM (#32028188)

LD_PRELOAD is also useful for working around hard-coded file paths inside of closed source (often commercial) software. This is how we make some closed source software work on NixOS, where we need a way to redirect file IO to corresponding paths in the NixOS file system (when those paths aren't the same as on typical distros).

[ Parent | on HN ]

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by egberts1 on Saturday July 09, 2022 @10:16AM (#32035311)

That use of LD_PRELOAD by Nix is NOT a downside.

But it is not a good workaround for Nix thus making Nix a poor candidate for a reasonably secured production servers.

[ Parent | on HN ]

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by badrabbit on Friday July 08, 2022 @11:31PM (#32031321)

There are several others mentioned so it shouldn't be a default but none of those use cases apply to normal users otr prod servers.

[ Parent | on HN ]

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by egberts1 on Saturday July 09, 2022 @10:08AM (#32035222)

yeah, the following positive usages of LD_PRELOAD is enough to cobble together and hijack a system, from userland.

https://github.com/gaul/awesome-ld-preload

[ Parent | on HN ]

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by egberts1 on Friday July 08, 2022 @08:07AM (#32026076)

Also LD_PRELOAD gets used by Debian `fakeroot` for building packages.

So no can do disabling LD_PRELOAD on Debian (much less be able to use libmusl on a Debian)

[ Parent | on HN ]

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by tinus_hn on Friday July 08, 2022 @08:41PM (#32030077)

Most people though will not be building packages.

[ Parent | on HN ]

Re:OrBit: New Undetected Linux Threat Uses Unique Hijack of ... by egberts1 on Saturday July 09, 2022 @10:04AM (#32035182)

At least the Gentoo folks, not withstanding.

[ Parent | on HN ]