Menu
Linux users targeted by mystery drive-by rootkit

Linux users targeted by mystery drive-by rootkit

Debian Squeezy in the iFrame

Security researchers have discovered what appears to be an experimental Linux rootkit designed to infect its highly select victims during a classic drive-by website attack.

Posted anonymously to Full Disclosure on 13 November by an annoyed website owner, the rootkit has since been confirmed by CrowdStrike and Kaspersky Lab as being distributed to would-be victims via an unusual form of iFrame injection attack.

Aimed specifically at users of the latest 64-bit Debian Squeezy kernel (2.6.32-5), the rootkit has been dubbed 'Rootkit.Linux.Snakso.a' by Kaspersky Lab.

After trying to hook into important kernel functions and trying to hide its own threads, Snasko sets out to take over the target system. Exactly what purpose lies this general ambition is unclear although the researchers suspect a conventional rather than political or nuisance motive.

The good news is that the rootkit looks like a work in progress, and contains enough programming rough edges to mark it out as 'in development'.

The malware''s relatively large binary size of 500k, and the inclusion of debug code, is another giveaway that this might be a work in progress.

As significant as its design is where it might have come from. In the view of the CrowdStrike analyst, Russia is the most likely origin which would put it in the realm of the professional cybercriminals.

"Considering that this rootkit was used to non-selectively inject iframes into nginx webserver responses, it seems likely that this rootkit is part of a generic cybercrime operation and not a targeted attack," notes CrowdStrike.

"However, a Waterhole attack, where a site mostly visited from a certain target audience, would also be plausible."

It is at this point in any Linux malware story that we point out the complexity of targeting the platform not to mention the vanishingly small number of examples that have been documented.

The most recent was the 'Wirenet' Trojan in August, a browser password stealer discovered by Russian firm Dr Web. Other examples have been based on cross-platform Java malware.

What is apparent is that criminals now have more than a passing interest in the platform and its admin-dominated user base.

"This rootkit, though it's still in the development stage, shows a new approach to the drive-by download schema and we can certainly expect more such malware in the future," said Marta Janus of Kaspersky Lab.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags securityoperating systemssoftwarekaspersky lab

Featured

Slideshows

Meet the leading female front runners of the Kiwi channel

Meet the leading female front runners of the Kiwi channel

Reseller News honoured the leading female front runners of the New Zealand channel at the 2018 Women in ICT Awards (WIICTA) in Auckland. The awards honoured standout individuals across seven categories, spanning Entrepreneur; Innovation; Rising Star; Shining Star; Community; Technical and Achievement.

Meet the leading female front runners of the Kiwi channel
Meet the top performing customer-centric Microsoft channel partners

Meet the top performing customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the top performing customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments