News for hackers. Stuff that matters.

A comment on Stealthy Linux rootkit found in the wild after going undetected for 2 years. Parent comment

Re:Stealthy Linux rootkit found in the wild after going unde... by BLKNSLVR on Sunday December 10, 2023 @07:28AM (#38591082)
Outgoing, which I believe this would be, is generally far less restrictive than incoming.

I'm playing around with IP address level detecting and blocking using incoming ports as indicators. I'm going to set aside some time to think more about restrictions on outgoing ports as a result of this and your comment.

Do some logging of frequently used remote ports over a couple of weeks and create a baseline set of allowed ports, block everything else and see what breaks.

I already use the limited Feodo Tracker[0] lists to flag in my firewall logs whether any device on the network has attempted to contact a known C&C IP address.

Thanks for push.

[0]:https://feodotracker.abuse.ch

[ Parent | on HN ]
Re:Stealthy Linux rootkit found in the wild after going unde... by BLKNSLVR on Monday December 11, 2023 @05:04AM (#38599159)
First things first, found I've got a bunch of devices doing "internet check" pings to Google's DNS servers once per second! I feel dirty that that's been going on so long.

Devices reconfigured to NOT do that at all.

Now that's cleared, the log won't be quite so cluttered.

Edited to add: Also redirected a whole load of regular NTP queries to remain internal.

[ Parent | on HN ]
Re:Stealthy Linux rootkit found in the wild after going unde... by BLKNSLVR on Monday December 11, 2023 @08:40AM (#38600531)
Also: time of day restrictions.

There's sweet FA traffic that should be going out to the 'net when everyone's asleep. But make sure these rules can be switched on and off in case of emergencies.

I had to take my daughter to emergency late one night a few months ago (didn't end up being anything worthy of a story), but got home at 2:30am. My garage door opener gets smart-home-switched-off at 1:00am-ish. At 2:30am, just wanting to go to bed after the stress of an emergnecy room, waiting for that thing to boot up felt like 15 minutes.

[ Parent | on HN ]