Linux Fokirtor Backdoor [New Linux Backdoor]

A few days ago, Symantec published a blog saying that in a security incident in May, it found a hacker intruded into a large Internet of Things hosting service provider, in addition, an interesting Linux BackDoor-Fokirtor is used in the internal management system.

Symantec research found that the backdoor can disguise its communication traffic and disguise it as a normal SSH communication traffic. This backdoor allows attackers to run common functions, such as executing remote commands and reversely linking to the C & C server. Fokirtor can monitor SSH network traffic, if the traffic is detected with a colon, exclamation point, semicolon, or full stop (":!;. "), Once these characters are detected, the Fokirtor code can parse the traffic beyond these characters and then extract the commands encrypted by Blowfish and base64.

When the server is infected with the backdoor, it collects the following information from the machine:

1. Host Name and IP address

2. Port

3. Password

4. SSH key

5. The information is encrypted after the user name is collected and sent to the attacker's C & C server.

Symantec analysts said that to identify whether the backdoor exists in the network, you can check whether the traffic contains an exclamation point character. Normal SSH traffic does not contain an exclamation point.

Linux Fokirtor Backdoor detection script

#! /Bin/sh
#
# A simple check to see if running ssh processes contain any string that have
# Been designated an indication of Fokirtor by Symantec.
#
# More info here:
# Http://www.symantec.com/connect/blogs/linux-back-door-uses-covert-communication-protocol
#
# (C) 2013, Kumina bv, info@kumina.nl
#
# You are free to use, modify and distribute this check in any way you see
# Fit. Just don't say you wrote it.
#
# This check is created for Debian Squeeze/Wheezy, no idea if it'll work in
# Other distros. You'll need gdb-minimal (for gcore) installed.
# We need to be root
If ['/usr/bin/id-U'-ne 0]; then
Echo "You need root for this script. Sorry ."
Exit 1
Fi
# For all pids of the ssh process, do the check
For pid in '/bin/pidof sshd'; do
T = $ (/bin/mktemp)
/Usr/bin/gdb </dev/null -- nx -- batch \
-Ex "set pagination off"-ex "set height 0"-ex "set width 0 "\
-Ex "attach $ pid"-ex "gcore $ t"-ex detach-ex quit
I = 0
For str in hbt = key = dhost = sp = sk = dip =; do
/Usr/bin/strings $ t |/bin/grep "$ {str} [[: digit:]"
If [$? -Eq 0]; then
I = $ ($ I + 1 ))
Fi
Done
/Bin/rm $ t
If [$ I-eq 6]; then
Echo "CRITICAL: Fokirtor strings found in sshd process $ {pid }! "
Exit 2
Fi
Done
Echo "OK: No indication of Fokirtor found ."
Exit 0