|
|
|
Backdoor.Gates Also Works for Windows |
Si vous voulez bloquer ce service sur vos fils RSS
Si vous voulez nous contacter ou nous proposer un fil RSS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Présentation : We have received reports about a Linux malware known as Backdoor.Gates. Analysis showed that this malware has the following features Collects information on the compromised system, such as OS version, hard disk size etc. Connects to a C C server for further information. The server address and port are RSA-encrypted. Can perform a host of different DDoS attacks TCP-SYN flood UDP flood DNS flood ICMP flood HTTP flood DNS Amplification It's notable that this backdoor makes use of this file for its installation etc init.d DbSecuritySpt Interestingly, the string DbSecuritySpt is a service name also used by another, a Windows malware. After a closer look, we found out that they are more alike than we initially thought. Both of them use the same names for the main file and the dropped components. For example, the main component is named as gates in the Linux version, and Gates.exe in the Windows version. The attack tool is called bill in the Linux version and Bill.exe in the Windows version. The DNS amplification library is libamplify.so or libamplify.dll , and so on. This was too much of a coincidence, so it turned out pretty quickly that they are actually recompiled ports of the same malware. The malware is written in C and the compiled code, by a quick glance, looks quite different, but closer investigation reveals that they must share the some code base. There are some OS-centric portions of the code, such as thread handling, service installation on Windows, it is installed as a service DbSecuritySpt , while on Linux it is a startup script in etc init.d DbSecuritySpt . However, there are other similar parts, such as a simple file handling which uses fopen and fread among others. Using those standard C-functions is quite uncommon for a Windows programmer. It is then most likely that both variants are compiled from the same code base, with some heavy platform-specific ifdef's. Screenshot of Windows code windows 139k image Screenshot of Linux code linux 141k image With a multi-platform malware like Backdoor.Gates, it is always interesting to find out how it is installed. We don't fully understand this yet. Based on initial analysis, there seems to be no automatic propagation or exploit functionality in the malware. The reports that we have received indicate that the malware was installed using weak SSH-server passwords, at least on Linux boxes. More analysis on the Linux part of Backdoor.Gates have also been published by Kaspersky and DrWeb. -- Post by Jarkko On 01 08 14 At 08 47 AM
Les mots clés de la revue de presse pour cet article : windows
Les videos sur SecuObs pour les mots clés : windows
Les mots clés pour les articles publiés sur SecuObs : windows
Les éléments de la revue Twitter pour les mots clé : windows
Les derniers articles du site "F Secure Antivirus Research Weblog" :
- OnionDuke APT Attacks Via the Tor Network
- What grade does your favorite app get
- Remember, Remember the Fifth of November
- Vote For Freedome Beta
- Multi-language support Not your everyday spam
- It's Not a Game - It's a Violation of Human Dignity
- 101 Bad Android Apps
- A Tale of Two Powerpoint Vulnerabilities
- Wanted Testers For The Greatest Android App Ever
- RATs threatening democracy activists in Hong Kong
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Si vous voulez bloquer ce service sur vos fils RSS :
- avec iptables "iptables -A INPUT -s 88.190.17.190 --dport 80 -j DROP"
- avec ipfw et wipfw "ipfw add deny from 88.190.17.190 to any 80"
- Nous contacter par mail
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
