We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
78,797 News Articles

Linux users targeted by mystery drive-by rootkit

Debian Squeezy in the iFrame

Security researchers have discovered what appears to be an experimental Linux rootkit designed to infect its highly select victims during a classic drive-by website attack.

Posted anonymously to Full Disclosure on 13 November by an annoyed website owner, the rootkit has since been confirmed by CrowdStrike and Kaspersky Lab as being distributed to would-be victims via an unusual form of iFrame injection attack.

Aimed specifically at users of the latest 64-bit Debian Squeezy kernel (2.6.32-5), the rootkit has been dubbed 'Rootkit.Linux.Snakso.a' by Kaspersky Lab.

After trying to hook into important kernel functions and trying to hide its own threads, Snasko sets out to take over the target system. Exactly what purpose lies this general ambition is unclear although the researchers suspect a conventional rather than political or nuisance motive.

The good news is that the rootkit looks like a work in progress, and contains enough programming rough edges to mark it out as 'in development'.

The malware''s relatively large binary size of 500k, and the inclusion of debug code, is another giveaway that this might be a work in progress.

As significant as its design is where it might have come from. In the view of the CrowdStrike analyst, Russia is the most likely origin which would put it in the realm of the professional cybercriminals.

"Considering that this rootkit was used to non-selectively inject iframes into nginx webserver responses, it seems likely that this rootkit is part of a generic cybercrime operation and not a targeted attack," notes CrowdStrike.

"However, a Waterhole attack, where a site mostly visited from a certain target audience, would also be plausible."

It is at this point in any Linux malware story that we point out the complexity of targeting the platform not to mention the vanishingly small number of examples that have been documented.

The most recent was the 'Wirenet' Trojan in August, a browser password stealer discovered by Russian firm Dr Web. Other examples have been based on cross-platform Java malware.

What is apparent is that criminals now have more than a passing interest in the platform and its admin-dominated user base.

"This rootkit, though it's still in the development stage, shows a new approach to the drive-by download schema and we can certainly expect more such malware in the future," said Marta Janus of Kaspersky Lab.


IDG UK Sites

Android One vs Android Silver vs Google Nexus: What is the difference?

IDG UK Sites

2014 Mac mini release date, specs, rumours: When's the new Mac mini coming out?

IDG UK Sites

Long live the internet fridge: the Internet of Things is coming

IDG UK Sites

How Prometheus' colourist Juan Ignacio Cabrera gave a tense, edgy feel to Chosen