Chinese hackers have unleashed a never-before-seen Linux backdoor

autotldr Bot , 10 months ago

This is the best summary I could come up with:

---

Researchers from NHS Digital in the UK have said Trochilus was developed by APT10, an advanced persistent threat group linked to the Chinese government that also goes by the names Stone Panda and MenuPass.

In June, researchers from security firm Trend Micro found an encrypted binary file on a server known to be used by a group they had been tracking since 2021.

The Linux malware ported several functions found in Trochilus and combined them with a new Socket Secure (SOCKS) implementation.

The Trend Micro researchers eventually named their discovery SprySOCKS, with “spry” denoting its swift behavior and the added SOCKS component.

Besides showing interest in espionage activities, Earth Lusca seems financially motivated, with sights set on gambling and cryptocurrency companies.

Monday’s Trend Micro report provides IP addresses, file hashes, and other evidence that people can use to determine if they’ve been compromised.

---

The original article contains 537 words, the summary contains 143 words. Saved 73%. I’m a bot and I’m open source!

MonkderZweite , 10 months ago

Ok, but what does it attack? Systemd, udev, fuse, …?

sirico , 10 months ago

link to another article with the cve’s: trendmicro.com/…/earth-lusca-employs-new-linux-ba…

MonkderZweite , 10 months ago

Thanks!

Zeth0s , 10 months ago

So it’s not general to every linux distro, is it?

sirico , 10 months ago

I could be wrong but this is a quick summary as I would look at it. As the Sysop for a small company running linux

<span style="color:#323232;">Fortinet FortiOS, FortiProxy, and FortiSwitchManager:
</span><span style="color:#323232;">    Type: Authentication bypass vulnerability
</span><span style="color:#323232;">    Impact: If you're using any of these Fortinet products, an attacker could bypass authentication mechanisms and potentially access or control the system.
</span><span style="color:#323232;">    Affect on Linux users: Only those Linux users who have these Fortinet products in their environments would be affected.
</span><span style="color:#323232;">
</span><span style="color:#323232;">CVE-2022-39952:
</span><span style="color:#323232;">    Product: Fortinet FortiNAC
</span><span style="color:#323232;">    Type: Unauthenticated remote code execution (RCE)
</span><span style="color:#323232;">    Impact: Attackers can remotely execute code without authentication.
</span><span style="color:#323232;">    Affect on Linux users: Relevant for Linux users/administrators who use Fortinet FortiNAC in their network.
</span><span style="color:#323232;">
</span><span style="color:#323232;">CVE-2021-22205:
</span><span style="color:#323232;">    Product: GitLab CE/EE
</span><span style="color:#323232;">    Type: Unauthenticated RCE
</span><span style="color:#323232;">    Impact: An attacker could remotely execute code without authentication on GitLab instances.
</span><span style="color:#323232;">    Affect on Linux users: This would affect Linux users who host or interact with GitLab CE/EE instances.
</span><span style="color:#323232;">
</span><span style="color:#323232;">CVE-2019-18935:
</span><span style="color:#323232;">    Product: Progress Telerik UI for ASP.NET AJAX
</span><span style="color:#323232;">    Type: Unauthenticated RCE
</span><span style="color:#323232;">    Impact: Allows remote code execution on affected servers using this UI component.
</span><span style="color:#323232;">    Affect on Linux users: Most Linux users would not be impacted unless they host ASP.NET applications using this specific UI component.
</span><span style="color:#323232;">
</span><span style="color:#323232;">CVE-2019-9670 / CVE-2019-9621:
</span><span style="color:#323232;">    Product: Zimbra Collaboration Suite
</span><span style="color:#323232;">    Type: Bundle of two vulnerabilities for unauthenticated RCE
</span><span style="color:#323232;">    Impact: Attackers can remotely execute code without authentication on systems using Zimbra.
</span><span style="color:#323232;">    Affect on Linux users: Linux users who use or host the Zimbra Collaboration Suite would be affected.
</span><span style="color:#323232;">
</span><span style="color:#323232;">ProxyShell (CVE-2021-34473, CVE-2021-34523v, CVE-2021-31207):
</span><span style="color:#323232;">    Product: Microsoft Exchange
</span><span style="color:#323232;">    Type: Set of three chained vulnerabilities for unauthenticated RCE
</span><span style="color:#323232;">    Impact: Attackers can exploit these vulnerabilities in sequence to remotely execute code on Exchange servers.
</span><span style="color:#323232;">    Affect on Linux users: This primarily impacts organizations that run Microsoft Exchange servers. Directly, Linux users wouldn't be affected unless they interact with or administer these servers.
</span>

Zeth0s , 10 months ago

Thanks, my understanding as well. A clickbait title…

epyon22 , 10 months ago

CVE-2022-40684 An authentication bypass vulnerability in Fortinet FortiOS, FortiProxy and FortiSwitchManager

CVE-2022-39952 An unauthenticated remote code execution (RCE) vulnerability in Fortinet FortiNAC

CVE-2021-22205 An unauthenticated RCE vulnerability in GitLab CE/EE

CVE-2019-18935 An unauthenticated remote code execution vulnerability in Progress Telerik UI for ASP.NET AJAX

CVE-2019-9670 / CVE-2019-9621 A bundle of two vulnerabilities for unauthenticated RCE in Zimbra Collaboration Suite

ProxyShell (CVE-2021-34473, CVE-2021-34523v, CVE-2021-31207) A set of three chained vulnerabilities that perform unauthenticated RCE in Microsoft Exchange

RaivoKulli , 10 months ago

Thanks. I read the article but (from my reading) they left out the most important part out: how it spreads and infects a machine. Sometimes they make a huge deal about a Linux backdoor and then it’s revealed right at the end (if at all) that it requires local access. Wah whaa. Now I have to scan every article to see what the actual method is.

Kecessa , 10 months ago

That just means your need your man on the inside and considering we just had a situation where a Chinese asset was employed for the local power corporation, I don’t think it’s that much of an issue…

RaivoKulli , 10 months ago

I’m not going to be as worried that my personal stuff is getting hacked if it requires someone to actually visit me at home lol

tabular , 10 months ago

At home having a “man on the inside” means the 3rd date went well.

Kecessa , 10 months ago

Your personal info is also stored in the bank’s computers, the government’s computers, your employer’s computers and so on…

That’s where the person on the inside comes into play.

RaivoKulli , 10 months ago

Right but I don’t have to worry about my own computer is what I mean. Can’t do anything about bank or government computers anyway.

Bitrot , 10 months ago

They’re doing some CYA, but still: “including (but not limited to)”.

PlexSheep , 10 months ago

What part of that is a never before seen backdoor?

Bitrot , 10 months ago

Since it’s a newly discovered virus, the entire thing. Doesn’t mean the tactics have never been seen before, just the specific implementation of Trochilus on Linux + SOCKS.

It’s poor writing to sound more dramatic while still being true.

photonic_sorcerer , 10 months ago

SprySOCKS Capabilities:

<span style="color:#323232;">   ID	     NOTES
</span>

• 0x09 Gets machine information
• 0x0a Starts interactive shell
• 0x0b Writes data to interactive shell
• 0x0d Stops interactive shell
• 0x0e Lists network connections (parameters: “ip”, “port”, “commName”, “connectType”)
• 0x0f Sends packet (parameter: “target”)
• 0x14, 0x19 Sends initialization packet
• 0x16 Generates and sets clientid
• 0x17 Lists network connections (parameters: “tcp_port”, “udp_port”, “http_port”, “listen_type”, “listen_port”)
• 0x23 Creates SOCKS proxy
• 0x24 Terminates SOCKS proxy
• 0x25 Forwards SOCKS proxy data
• 0x2a Uploads file (parameters: “transfer_id”, “size”)