Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking
New stealthy OrBit malware steals data from Linux devices

New stealthy OrBit malware steals data from Linux devicesPost Views: 21
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
A newly discovered Linux malware dubbed OrBit, is being used to stealthily steal information from backdoored Linux systems and infect all running processes on the machine.
Dubbed OrBit by Intezer Labs security researchers who first spotted it, this malware hijacks shared libraries to intercept function calls by modifying the LD_PRELOAD environment variable on compromised devices.

While it can gain persistence using two different methods to block removal attempts, OrBit can also be deployed as a volatile implant when copied in shim-memory.

It can also hook various functions to evade detection, control process behavior, maintain persistence by infecting new processes, and hide network activity that would reveal its presence.

For instance, once it injects into a running process, OrBit can manipulate its output to hide any traces of its existence by filtering out what gets logged.

“The malware implements advanced evasion techniques and gains persistence on the machine by hooking key functions, provides the threat actors with remote access capabilities over SSH, harvests credentials, and logs TTY commands,” Intezer Labs security researcher Nicole Fishbein explained.

“Once the malware is installed it will infect all of the running processes, including new processes, that are running on the machine.”

Although OrBit’s dropper and payload components were completely undetected by antivirus engines when the malware was first spotted, some anti-malware vendors have since updated their products to warn customers of its presence.
https://www.bleepstatic.com/images/news/u/1109292/2022/Linux-OrBit-payload-detection.png
Linux malware surge?OrBit is not the first highly-evasive Linux malware that has surfaced recently, capable of using similar approaches to fully compromise and backdoor devices. Symbiote also uses the LD_PRELOAD directive to load itself into running processes, acting as a system-wide parasite and leaving no signs of infection. BPFDoor, another recently spotted malware targeting Linux systems, camouflages itself by using the names of common Linux daemons, which helped it remain undetected for more than five years.

Both these strains use BPF (Berkeley Packet Filter) hooking functionality to monitor and manipulate network traffic which helps hide their communication channels from security tools.
Trending: CISA warns of hackers exploiting PwnKit Linux vulnerability A third Linux malware, a rootkit under heavy development dubbed Syslogk and unveiled by Avast researchers last month, can force-load its own modules into the Linux kernel, backdoor compromised machines, and hide directories and network traffic to evade detection.

Even though not the first or the most original malware strain targeting Linux lately, OrBit still comes with its share of capabilities that set it apart from other threats.

“This malware steals information from different commands and utilities and stores them in specific files on the machine. Besides, there is an extensive usage of files for storing data, something that was not seen before,” Fishbein added.

“What makes this malware especially interesting is the almost hermetic hooking of libraries on the victim machine, that allows [...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking

New stealthy OrBit malware steals data from Linux devices | Black Hat Ethical Hacking

A newly discovered Linux malware dubbed OrBit, is being used to stealthily steal information from backdoored Linux systems and infect all running processes on the machine.

14 viewsedited 09:41

Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking New stealthy OrBit malware steals data from Linux devices New stealthy OrBit malware steals data from Linux devicesPost Views: 21 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Patreon.png Subscribe…

the malware to gain persistence and evade detection while stealing information and setting SSH backdoor.”
Trending: Offensive Security Tool: Axiom Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Trending: How do QR Codes work and how criminal hackers use them to generate phishing attacks – Demo Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ezgif.com-gif-maker-2-1-90x90.jpg High severity OpenSSL bug could lead to remote code execution1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/hacker-alert-iStock-1330604319-580x358-1-90x90.jpg New RedAlert Ransomware targets Windows, Linux VMware ESXi servers2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/django-5-90x90.jpg Django fixes SQL Injection vulnerability in new releases3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ezgif.com-gif-maker-1-90x90.jpg Rogue HackerOne employee steals bug reports to sell on the side4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ezgif.com-gif-maker-2-90x90.jpg Microsoft Exchange servers worldwide backdoored with new malware1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ezgif.com-gif-maker-1-90x90.jpg CISA warns of hackers exploiting PwnKit Linux vulnerability1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/eba5863be05547fb146c9c8c0ed43c52-90x90.jpg Dozens of cryptography libraries vulnerable to private key theft1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ezgif.com-gif-maker-90x90.jpg Researchers crack MEGA’s ‘privacy by design’ storage, encryption1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/f9ed623c5c-90x90.jpg Google Warns Spyware Being Deployed Against Android, iOS Users2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/170720-poulsen-fancy-bear-tease_zzzwzw-90x90.jpg Fancy Bear Uses Nuke Threat Lure to Exploit 1-Click Bug2 weeks ago
The post New stealthy OrBit malware steals data from Linux devices first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

11 viewsedited 09:41

Hacking Articles Tips Tricks Videos Tutorials

Innovation in the Free World

Objective ReviewersContinue reading on Medium »
Read more...

8 views12:05

Hacking Articles Tips Tricks Videos Tutorials

7 views12:06

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
Koh - The Token Stealer

https://external-preview.redd.it/PNWEYgRQC6IewFKEsENleN3t0d1d9YIYdglUbMlVSw0.jpg?width=640&crop=smart&auto=webp&s=8d24f1f22cc5dd94f2b12d645b3bd687fcad7b25 submitted by /u/CyberMasterV
[link] [comments]

8 views12:06

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
what can be done with a phishing link

what's the most damage that we can do to someone who sends you a phishing page trying to get your password. Is there way to infect their pc through the page

submitted by /u/ball-sack-patato
[link] [comments]

what can be done with a phishing link

what's the most damage that we can do to someone who sends you a phishing page trying to get your password. Is there way to infect their pc...

8 views12:07

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Windows user password

Hope this is the right place. So, I have this old laptop at home and decided to check it out. The user account is my sisters, but she doesn't remember the password. How can I get around this? I saw some videos on youtube but it wasn't very helpful. Any ideas?

submitted by /u/rumblingThunder_
[link] [comments]

Windows user password

Hope this is the right place. So, I have this old laptop at home and decided to check it out. The user account is my sisters, but she doesn't...

8 views12:07

Hacking Articles Tips Tricks Videos Tutorials

7 views12:24

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
#3 Dancing — Starting Point — Hack The Box Write-Up

https://cdn-images-1.medium.com/max/940/1*XdXt5fD0a6g3LAsfUoXv_g.png
Introduction:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

#3 Dancing — Starting Point — Hack The Box Write-Up

Introduction:

7 viewsedited 12:24