Tag Info

New answers tagged

1

Bash re-written Turla knock-door In order to understand how this work, I wrote this: #!/bin/bash myIpSum=${1:-0a230673aeea81fba0e6e66aae22cb4c} printf -v bport %04X ${2:-22} # port to watch for incoming ``knock'' printf -v rport %d ${3:-80} # change this for greater then 1024 if not root! while :;do while IFS=': ' read seq loci locp remi remp ...


0

Given Turla is based upon cd00r, there should not be any privilege escalation involved. cd00r runs as normal user application, starting an inetd service on some predefined ports. Thus, removing execute permissions on inted should be enough to block it. sudo chmod o=r `which inetd`


0

Download and run Linux Exploit Suggester: $ perl ./Linux_Exploit_Suggester.pl -k 3.0.0 Kernel local: 3.0.0 Possible Exploits: [+] semtex CVE-2013-2094 Source: www.exploit-db.com/download/25444/‎ [+] memodipper CVE-2012-0056 Source: http://www.exploit-db.com/exploits/18411/


12

TURLA is the final stage of a large and sophisticated family of malware. There have been known Windows versions since at least 2010. This 40 page presentation is the most comprehensive resource I have seen, for either platform. TURLA - development & operations Some Windows Highlights Stage 0: attack stage - infection vector Stage 1: reconnaissance ...


0

Just an interjection from someone who has been living with this type of attack for quite a while now. Don't forget computers aren't the only devices with ROM/firmware! My prior generation Netgear firewall/router had it's firmware overwritten. Expensive mistake after a couple of new builds. Also the kit I was attacked with immediately disallowed BIOS reflash ...


2

I'm not a kernel hacker, but from what I read the technique is analogous to a function hook in user space. Premise User space code interacts with the kernel through system calls. There are system calls that reveal information about the state of the kernel, e. g. f returns list of loaded kernel modules. The kernel manages a table t of system calls and the ...



Top 50 recent answers are included