Hacker News new | ask | show | jobs
by sethg 4951 days ago
The article says the rootkit works by inserting a line into /etc/rc.local. If my /etc/rc.local file looks OK, can I assume I haven’t been infected, or does the rootkit use more sophisticated means to hide its presence?
4 comments

No, one of the earlier reports showed how the rootkit detects reads of /etc/rc.local and feeds you a file that looks like it doesn't contain the rootkit loading insmod calls.
Disclaimer: I don't have a copy of the rootkit to experiment with; all of this is pure speculation.

My guess is you could detect the rootkit by booting to a known-clean system -- for example a distro install CD -- and checking the contents of rc.local by mounting the questionable system's fs.

This examination could probably be performed without downtime by taking an LVM snapshot and downloading it to a known-clean machine. The rootkit could fake the contents of the LVM snapshot as well, but it seems like this would be much harder for the rootkit authors and they probably didn't bother.

You might also be able to disable it by modifying your startup scripts to ignore rc.local (perhaps you could put a replacement in a non-standard location if you need the functionality).

CrowdStrike says that it hooks vfs_read and if the data read contains the line it injects into /etc/rc.local, it is removed from the read buffer.

This means you could just read the file byte-by-byte (I guess runnin dd a couple of times would work), though I haven't tried myself.

In this article it shows a few ways to check. Apparently they did a poor job of covering their tracks and ps will show you a kernel thread of get_http_inj_fr

http://blog.crowdstrike.com/2012/11/http-iframe-injecting-li...

The best part about that is that it appends a startup call at the end of /etc/rc.local- which, by default, ends with 'exit 0'.

So its rc.local functionality is actually totally ineffectual.

According to http://seclists.org/fulldisclosure/2012/Nov/94 it would inject an iframe in each http response.