Threat Overview

A recent threat report published by AlienVault provides insights into a malicious Linux rootkit malware that has been used to compromise CentOS systems.

The report, titled “Deep Dive Into a Linux Rootkit Malware”, highlights the potential dangers posed by this malware and its capabilities.

Malware Analysis

The analysis examines a Linux rootkit malware consisting of two components: a kernel module (sysinitd.ko) and a user-space binary (sysinitd). The kernel module hijacks inbound network traffic using Netfilter hooks, creates procfs entries for communication, and starts the user-space process. Meanwhile, the user-space component disguises itself as ‘bash’, enabling remote command execution with root privileges.

Initiation of Communication

Attackers initiate communication using a special ‘attack-init’ packet, allowing them to send encrypted commands to control the compromised system. The malware’s initialization process involves binding system calls and intercepting select network protocols.

Tactics Employed

The report sheds light on the tactics employed by attackers to deploy this malware:

* Remote compromise of systems to install malicious kernel modules.

* Disguising malware components to evade detection.

* Leveraging system privileges to execute arbitrary commands.

Recommendations

Based on the threat report, several recommendations can be made for enhancing cybersecurity measures:

1. Regular Patching and Updates: Ensure CentOS systems are up-to-date to protect against exploited vulnerabilities.

2. Network Intrusion Detection Systems (NIDS): Implementing NIDS can help detect unusual network activity and anomalies.

3. Endpoint Protection: Deploy robust endpoint protection solutions that can identify rootkit malware and prevent its installation.

4. Least Privilege Principle: Implement the principle of least privilege to minimize potential damage from compromised accounts.

5. Regular Backups: Maintain regular backups of critical data to facilitate swift recovery in case of an attack.

Resources

The full threat report can be accessed here:

https://www.fortinet.com/blog/threat-research/deep-dive-into-a-linux-rootkit-malware