New ultra-stealthy Linux backdoor isn’t your everyday malware discovery
New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

          
          
With the help of LD_PRELOAD, Symbiote will load before any other shared objects. That allows the malware to tamper with other library files loaded for an application. The image below shows a summary of all of the malware’s evasion techniques.

    
              
                
              
            
                

BPF in the image refers to the Berkeley Packet Filter, which allows people to conceal malicious network traffic on an infected machine.
“When an administrator starts any packet capture tool on the infected machine, BPF bytecode is injected into the kernel that defines which packets should be captured,” the researchers wrote. “In this process, Symbiote adds its bytecode first so it can filter out network traffic that it doesn’t want the packet-capturing software to see.”
One of the stealth techniques Symbiote uses is known as libc function hooking. But the malware also uses hooking in its role as a data-theft tool. “The credential harvesting is performed by hooking the libc read function,” the researchers wrote. “If an ssh or scp process is calling the function, it captures the credentials.”
So far, there’s no evidence of infections in the wild, only malware samples found online. It’s unlikely this malware is widely active at the moment, but with stealth this robust, how can we be sure?


          
                  