Episode 161
Ubuntu Security Podcast
English - May 27, 2022 05:24 - 14 minutes - 10.9 MB - ★★★★★ - 10 ratingsTechnology Homepage Download Apple Podcasts Google Podcasts Overcast Castro Pocket Casts RSS feed
This week we take a look into BPFDoor, a newsworthy backdoor piece of
malware which has been targeting Linux machines, plus we cover security
updates for Bind, Vim, Firefox, PostgreSQL and more.
Overview
This week we take a look into BPFDoor, a newsworthy backdoor piece of
malware which has been targeting Linux machines, plus we cover security
updates for Bind, Vim, Firefox, PostgreSQL and more.
This week in Ubuntu Security Updates
32 unique CVEs addressed
[USN-5429-1] Bind vulnerability [00:38]
1 CVEs addressed in Jammy (22.04 LTS)
Only affects most recent releases
When using bind configured with DNS over HTTPS (DoH) possible for a
client to cause the server to terminate a TLS connection early and hence
trigger an assertion failure within Bind -> terminates -> DoS
[USN-5430-1] GNOME Settings vulnerability [01:18]
1 CVEs addressed in Jammy (22.04 LTS)
GNOME includes support for desktop sharing via RDP + VNC
By default in Ubuntu we have a no open ports policy)
However, GNOME settings daemon contained a logic flaw where when
disabling the remote desktop service via the gnome-control-center UI it
would then automatically get re-enabled on next login
[USN-5424-2] OpenLDAP vulnerability [01:57]
1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
Episode 160
SQL injection in the sql backend of slapd via an SQL statement within a LDAP query
[USN-5433-1] Vim vulnerabilities [02:20]
9 CVEs addressed in Xenial ESM (16.04 ESM)
CVE-2022-1154
CVE-2022-0318
CVE-2022-0261
CVE-2021-4192
CVE-2021-4069
CVE-2021-4019
CVE-2021-3984
CVE-2021-3974
CVE-2021-3973
All various instances of memory corruption vulnerabilities, where if a
user was tricked into opening a specially crafted file, could then either
crash Vim or possibly get code execution as the user
Whilst a lot of regular desktop users may not use Vim, is still often
used by sysadmins to edit config files / inspect other files which they
find on the machine - and in that case, this can then be a good privesc
target
[USN-5432-1] libpng vulnerabilities [03:01]
2 CVEs addressed in Xenial ESM (16.04 ESM)
Speaking of specially crafted files :) - same for libpng - is used by
many other higher level libraries / applications
[USN-5434-1] Firefox vulnerabilities [03:20]
2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Impish (21.10)
100.0.2
2 vulns courtesy of ZDIs Pwn2Own - Manfred Paul - achieved code execution
within the privileged component of Firefox thereby escaping Firefox’s
internal sandbox - awarded $100k USD
[USN-5435-1] Thunderbird vulnerabilities [03:57]
11 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Impish (21.10), Jammy (22.04 LTS)
CVE-2022-19916
CVE-2022-1802
CVE-2022-1529
CVE-2022-1520
CVE-2022-29917
CVE-2022-29916
CVE-2022-29914
CVE-2022-29913
CVE-2022-29912
CVE-2022-29911
CVE-2022-29909
91.9.1
Same as above plus a bunch of other recent vulns in Firefox which also
apply to TB as well as a TB specific issue where it would show the wrong
security status for a signed/encrypted attached message and hence could
allow an attacker to trick the user into thinking the message was
trustworthy
[USN-5436-1] libXrender vulnerabilities [04:28]
2 CVEs addressed in Xenial ESM (16.04 ESM)
Remote X server could trigger OOB write -> memory corruption -> code
execution
[USN-5437-1] libXfixes vulnerability
1 CVEs addressed in Xenial ESM (16.04 ESM)
32-bit platform specific issue - but roughly same as above
[USN-5438-1] HTMLDOC vulnerability [04:46]
1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
Used to covert HTML/Markdown files to generate EPUB/HTML/PS/PDF with ToC
etc
Crafted HTML file could trigger a heap buffer overflow -> crash/code
execution
[USN-5439-1] AccountsService vulnerability [05:06]
1 CVEs addressed in Jammy (22.04 LTS)
Old CVE-2020-16126 was inadvertently reintroduced as the patch which
fixed it got dropped accidentally
[USN-5440-1] PostgreSQL vulnerability [05:36]
1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Impish (21.10), Jammy (22.04 LTS)
Possible for an attacker who is able to create non-temp objects could
then achieve SQL code execution as the superuser
[USN-5404-2] Rsyslog vulnerability [05:51]
1 CVEs addressed in Xenial ESM (16.04 ESM)
Goings on in Linux Security Community
BPFDoor malware targeting Linux and Solaris [06:08]
https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896
https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
Malware that has been in the wild for a while (over 5 years)
Reported on by PwC in their Cyber Threats 2021: A year in Retrospect report
Attribute it to a Chinese threat actor which they call Red Menshen
Observed targeting telco providers and govt, education and logistics
via custom backdoor ‘BPFDoor’
Stealthy - allows to backdoor a system for RCE but without opening any
new network ports or firewall rules by piggy-backing on existing network
facing applications
Uses BPF filter to watching incoming packets and activate accordingly
Earlier versions are on VT - with lots of other variants too
Even source code too - https://pastebin.com/kmmJuuQP
As I said - stealthy
deletes itself from the filesystem and renames its processes to look
innocent so can hide in plain sight
loads BPF filter to sniff traffic
upon activation then will modify firewall to allow attacker direct
access
In more detail:
Copies itself to /dev/shm/kdmtmpflush and then forks to clean itself up
to alter timestamps (timestomp) to a specific timestamp (7:17pm
Thursday October 30th 2008)
Drops a file at /bar/run/haldrund.pid to prevent further copies of
itself from running
Deletes itself from the /dev/shm/ ramdisk and then exits to leave the
forked copy running resident in memory and then use BPF filter to watch
for incoming traffic to activate
Doesn’t appear to have any particular persistence mechanism but some
reports suggest use of crontab or rc/init scripts
By deleting itself from the ramdisk this avoids detection from filesystem
scanners (although processes running from since deleted binaries are a
suspicious sign themselves and can be easily detected since once the
binary is removed the kernel notes this in /proc/self/exe for the
process)
Renames its argv[0] so that it looks like other commonly found processes
like dbus-daemon / udevd / auditd etc
Also wipes its environ too to try and help hide it’s activities, however
this again is another suspicious activity and can easily be detected
(e.g. strings on /proc/$PID/environ will show as empty which is basically
never normally the case for normal processes)
BPF filter inspects either ICMP, TCP or UDP packets and then if it has a
special magic value in the first couple bytes it passes into the main
packet processing routine
This then looks for a couple specific passwords (encrypted via RC4) -
if found then sets up either a local bindshell for the attacker to
connect to OR connects back to the attacker via a reverse bindshell
Then sets up an iptables rule to redirect traffic from the original
port to the port of the bindshell on the localhost
bindshell masquerades its process name to look like postfix as well as
setting a specific environment too (including HISTFILE=/dev/null)
Then attacker has full access to the machine (as the user)
Reasonably advanced malware
What is not clear is what is the initial compromise vector and then how
to privesc from that to give privileges to load BPF filter on a raw socket
Crowdstrike blog post mentions that on Solaris CVE-2019-3010 is used to
privesc via xscreensaver but this vuln is specific to Solaris platforms
Why it is important to keep systems updated with latest patches etc.
Get in contact
[email protected]
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter