Pierluigi Paganini November 22, 2012

Yesterday I wrote about a new variant of malware able to use Google Docs function to hide communications to C&C servers, but daily we read about malicious agents that compromise  every OS, also the ones considered most secure from security community.

Recently security experts have detected a rootkit designed to infect Linux machines implementing an infection schema “drive-by website”. The news was posted on Full Disclosure last week and the existence of the rootkit has been confirmed also by Kaspersky Lab and CrowdStrike experts. The rootkit is able to infect victims with an iFrame injection attack, an iframe injection is an injection of iframe tags into a page allowing downloading of executable application that contains a malware in it.

The malware, named Rootkit.Linux.Snakso.a’ by Kaspersky Lab team, appears as an experimental agent that targets the latest 64-bit Debian Squeezy kernel (2.6.32-5), the experts of the famous security firm have discovered that many functions are incomplete and the binary still include debugging information.

The iFrame injection mechanism is considered by researchers very interesting, the rootkit is able to substitute the kernel function tcp_sendmsg that handles the preparation for sending of packets with its own code allowing to injected malicious iFrame directly to outgoing TCP packets. The injection payload is retrieved by the malware through a connection to the C&C server using an encrypted password for authentication.

“A kernel-mode binary component that uses advanced hooking techniques to ensure that the injection process is more transparent and low-level than ever before. This rootkit, though it’s still in the development stage, shows a new approach to the drive-by download schema and we can certainly expect more such malware in the future.” said Marta Janus form Kaspersky.

The malware appears as a product of state sponsored project still in progress or as a result of a professionals cybercriminal experiment, anayzing its design  CrowdStrike suggested that Russia is the most likely origin.

“Based on the Tools, Techniques, and Procedures employed and some background information we cannot publicly disclose, a Russia-based attacker is likely. It remains an open question regarding how the attackers have gained the root privileges to install the rootkit. However, considering the code quality, a custom privilege escalation exploit seems very unlikely.”

CrowdStrike observed that the HTTP and reverse proxy server used is nginx and that “rootkit was used to non-selectively inject iframes into webserver responses” suggesting that it is not a targeted attack. The experts not excluding also the possibility of a Waterhole attack to compromise web sites visited from a certain target audience such as happened for the Elderwood campaign.

“However, a Waterhole attack, where a site mostly visited from a certain target audience is infected, would also be plausible. Since no identifying strings yielded results in an Internet search (except for the ksocket library), it appears that this is not a modification of a publicly available rootkit.”

The researchers from Kaspersky Lab have discovered that the C&C server is still active and it hosts other *NIX based tools.

The finding would indicate that we may soon find similar agents, for this reason it is important not to underestimate the threat related to such rootkit, the battle is complex and the research of the groups involved in the analysis is a valuable contribute in the fight against new cyber threats.

Pierluigi Paganini