Researchers Detail Linux-Based “Chaos” Backdoor

A Linux-targeting backdoor observed in live attacks in June last year was recently found to have been part of an older rootkit, GoSecure researchers reveal.

In a recent report detailing the threat, the security researchers explain that the backdoor was designed to spawn a fully encrypted and integrity checked reverse shell. Dubbed Chaos, the backdoor appears to have originally been part of the ‘sebd’ rootkit that emerged in 2013.

In the observed attack, the malware’s operator penetrated the targeted system by brute-forcing SSH credentials. The assault was launched from two IPs known to be part of the TOR network, the security researchers explain.

The attacker then disabled the logging history, checked the SSHD binary, and searched the system for certain files that would indicate that other malware has already infected the machine. These files are normally used by patched SSHDs to log stolen SSH credentials.

To finalize the infection, the attacker would then download and install the payload. A .tar archive containing two ELF executables (Chaos and Client) and two shell scripts (initrunlevels and install) and masquerading as a .jpg file would be fetched from a remote server.

While the Chaos executable in the archive is the backdoor itself, the Client executable is responsible for connecting to the installed backdoor. The install script would copy initrunlevels to /etc/init.d, thus ensuring it is executed at each system start.

The initrunlevels script was designed to open port 8338, check if certain files exist, and copy them to the paths it checked for. The script also copies the Client to /usr/include/cli.h and Chaos to /usr/include/stabd.h and /usr/sbin/smdb, to create backups of both of them.

As part of the attack, additional files were dropped and executed on the monitored system to make it part of an IRC botnet, the security researchers say.

Chaos first opens a raw TCP socket and monitors for a specific string in incoming packets in all open ports. When the string is identified, the malware connects back to the client listening on TCP port 8338. Next, the two exchange key material to derive two AES keys (which are used for sending and receiving data) and verify that the key negotiation was successful.

By using a raw socket, Chaos can bypass firewalls, as it can be triggered on ports running an existing legitimate service, the researchers point out.

The communication packets transmitted by the backdoor are not only encrypted but also checked for integrity using an HMAC.

The backdoor was previously part of the ‘sebd’ rootkit that first appeared in 2013, but became public after its source code was allegedly caught by a honeypot and the operator decided to release the source code on a forum to make it available for script kiddies.

The backdoor has a low infection rate, with most of its victims apparently located in the United States (the researchers performed an Internet-wide scan using the handshake extracted from the client in order to assess the spread of the malware).

“The Chaos backdoor is pretty interesting as it uses a stealthy raw socket to spawn a reverse-shell with full network encryption and integrity checks. However, the backdoor’s encryption can easily be broken if the pre-shared key is known, as it is transmitted in clear text,” GoSecure notes.

The researchers also point out that the opening of port 8338 for incoming packets suggests the attackers want to use the client binary on the infected machine. According to them, the compromised systems would be used as proxies to conduct further criminal actions, potentially crossing network boundaries in the process.

Related: Iranian Hackers Target IIS Web Servers With New Backdoor

Related: macOS Backdoor Uses Innovative Disguise Technique

Copyright 2010 Respective Author at Infosec Island via Infosec Island Latest Articles "http://ift.tt/2EVKrFY"