$type=slider$show=home$snippet=hide$cate=0$h=500$va=0$rm=0

A nasty new malware strain is stealing data from Linux devices

A new Linux malware has been discovered that is capable of avoiding detection by antivirus programs, steals sensitive data from compromise...

A new Linux malware has been discovered that is capable of avoiding detection by antivirus programs, steals sensitive data from compromised endpoints and infects all processes running on a device.

Cybersecurity researchers from Intezer Labs say the malware, dubbed OrBit, modifies the LD_PRELOAD environment variable, allowing it to hijack shared libraries and, consequently, intercept function calls. 

"The malware implements advanced evasion techniques and gains persistence on the machine by hooking key functions, provides the threat actors with remote access capabilities over SSH, harvests credentials, and logs TTY commands," Intezer Labs researcher Nicole Fishbein explained.

Hiding in plain sight

"Once the malware is installed it will infect all of the running processes, including new processes, that are running on the machine."

Up until only recently, most antivirus solutions did not treat OrBit dropper, or payload, as malicious, the researchers said but added that now, some anti-malware service providers do identify OrBit as malicious. 

"This malware steals information from different commands and utilities and stores them in specific files on the machine. Besides, there is an extensive usage of files for storing data, something that was not seen before," Fishbein concluded.

"What makes this malware especially interesting is the almost hermetic hooking of libraries on the victim machine, that allows the malware to gain persistence and evade detection while stealing information and setting SSH backdoor."

Threat actors have been quite active on the Linux platform lately, BleepingComputer has found. Besides OrBit, the recently discovered Symbiote malware also uses the LD_PRELOAD directive to load itself into running processes. It acts as a system-wide parasite, the publication claims, adding that it leaves no sign of infection.

BPFDoor is a similar malware strain, as well. It targets Linux systems and hides by using the names of common Linux daemons. This helped it stay under antivirus radars for five years. 

Besides these two, there is also Syslogk, capable of both loading, and hiding, malicious programs. As revealed by cybersecurity researchers from Avast, the rootkit malware is based on an old, open-sourced rootkit called Adore-Ng. It’s also in a relatively early stage of (active) development, so whether or not it evolves into a full-blown threat, remains to be seen.

Via: BleepingComputer



from TechRadar - All the latest technology news https://ift.tt/K64ylk1
via IFTTT

COMMENTS

BLOGGER
Name

Apps,3856,Business,149,Camera,1155,Earn $$$,2,Gadgets,1740,Games,926,GTA,1,Innovations,2,Mobile,1696,Paid Promotions,4,Promotions,4,Technology,7935,Trailers,796,Travel,37,Trendly News,24180,Video,5,XIAOMI,13,
ltr
item
Trendly News | #ListenNow #Everyday #100ShortNews #TopTrendings #PopularNews #Reviews #TrendlyNews: A nasty new malware strain is stealing data from Linux devices
A nasty new malware strain is stealing data from Linux devices
Trendly News | #ListenNow #Everyday #100ShortNews #TopTrendings #PopularNews #Reviews #TrendlyNews
http://www.trendlynews.in/2022/07/a-nasty-new-malware-strain-is-stealing.html
http://www.trendlynews.in/
http://www.trendlynews.in/
http://www.trendlynews.in/2022/07/a-nasty-new-malware-strain-is-stealing.html
true
3372890392287038985
UTF-8
Loaded All Posts Not found any posts VIEW ALL Readmore Reply Cancel reply Delete By Home PAGES POSTS View All RECOMMENDED FOR YOU LABEL ARCHIVE SEARCH ALL POSTS Not found any post match with your request Back Home Sunday Monday Tuesday Wednesday Thursday Friday Saturday Sun Mon Tue Wed Thu Fri Sat January February March April May June July August September October November December Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec just now 1 minute ago $$1$$ minutes ago 1 hour ago $$1$$ hours ago Yesterday $$1$$ days ago $$1$$ weeks ago more than 5 weeks ago Followers Follow THIS PREMIUM CONTENT IS LOCKED STEP 1: Share. STEP 2: Click the link you shared to unlock Copy All Code Select All Code All codes were copied to your clipboard Can not copy the codes / texts, please press [CTRL]+[C] (or CMD+C with Mac) to copy