Connect with us

Hi, what are you looking for?

Technology

New Linux malware hides in cron jobs with invalid dates


New CronRAT Linux malware hides payloads in cron jobs for inexistent day

Security researchers have discovered a new remote access trojan (RAT) for Linux that keeps an almost invisible profile by hiding in tasks scheduled for execution on a non-existent day, February 31st.

Dubbed CronRAT, the malware is currently targeting web stores and enables attackers to steal credit card data by deploying online payment skimmers on Linux servers.

Characterized by both ingenuity and sophistication, as far as malware for online stores is concerned, CronRAT is undetected by many antivirus engines.

Clever hideout for payloads

CronRAT abuses the Linux task scheduling system, cron, which allows scheduling tasks to run on non-existent days of the calendar, such as February 31st.

The Linux cron system accepts date specifications as long as they have a valid format, even if the day does not exist in the calendar – which means that the scheduled task won’t execute.

This is what CronRAT relies on to achieve its stealth. A report today from Dutch cyber-security company Sansec explains that it hides a “sophisticated Bash program” in the names of the scheduled tasks.

“The CronRAT adds a number of tasks to crontab with a curious date specification: 52 23 31 2 3. These lines are syntactically valid, but would generate a run time error when executed. However, this will never happen as they are scheduled to run on February 31st,” Sansec Researchers explain.

Advertisement. Scroll to continue reading.

CronRAT payload hidden in cron task for non-existent  day

The payloads are obfuscated via multiple layers of compression and Base64 encoding. Cleaned up, the code includes commands for self-destruction, timing modulation, and a custom protocol that allows communication with a remote server.

The researchers note that the malware contacts a command and control (C2) server (47.115.46.167) using an “exotic feature of the Linux kernel that enables TCP communication via a file.”

Furthermore, the connection is done over TCP via port 443 using a fake banner for the Dropbear SSH service, which also helps the malware stay under the radar.

After contacting the C2 server, the disguise falls, sends and receives several commands, and gets a malicious dynamic library. At the end of these exchanges, the attackers behind CronRAT can run any command on the compromised system.

CronRAT has been found on multiple stores across the world, where it was used to inject on the server scripts that steal payment card data – the so-called Magecart attacks.

Sansec describes the new malware as “a serious threat to Linux eCommerce servers,” due to its capabilities:

  • Fileless execution
  • Timing modulation
  • Anti-tampering checksums
  • Controlled via binary, obfuscated protocol
  • Launches tandem RAT in separate Linux subsystem
  • Control server disguised as “Dropbear SSH” service
  • Payload hidden in legitimate CRON scheduled task names

All these features make CronRAT virtually undetectable. On VirusTotal scanning service, 12 antivirus engines were unable to process the malicious file and 58 of them did not detect it as a threat.

CronRAT undetected on VirusTotal

Sansec notes that CronRAT’s novel execution technique also bypassed its detection algorithm, eComscan, and the researchers had to rewrite it in order to catch the new threat.



Source link

Advertisement. Scroll to continue reading.
Click to comment

Leave a Reply

Advertisement

Latest

Social Media

Pinterest has shared a new research report into the shopping habits of Gen Z, which explores how brands can maximize their product appeal, and...

Technology

When the Nintendo Switch first launched, there were fewer than a dozen titles available for sale. But, as time goes by, and as game...

Top Stories

The White House is reportedly considering an Obama-era economic adviser and former Fed economist to fill the empty seats on the board of governors...

Social Media

As part of its ongoing effort to maximize Stories usage, and get more people posting more often in the app, Facebook has been pushing...

Technology

Editor’s take: Popcorn Time, once viewed as the Napster for movies, has reached the end of the road. The entertainment landscape has changed significantly...

Social Media

Don’t say we didn’t warn you. After announcing the return of its reverse chronological, algorithm-free post feed late last year, Instagram chief Adam Mosseri...

Technology

Hear from CIOs, CTOs, and other C-level and senior execs on data and AI strategies at the Future of Work Summit this January 12,...

Loan And Finance

Based on share-price performance, companies making M&A deals outperformed the World Index by +1.4pp (percentage points) on average. In APAC, dealmakers recorded their strongest...

Advertisement

You May Also Like

SEO Guide

How to index website on Google? Do you want to drive more organic traffic to your new website? I am sure your answer is...

SEO Guide

There are all kinds of pictures of the world on the internet, but to find one of these specific pictures that you want to...

Blogging

In this post, I will discuss the top ten profitable blogging niches ideas for Adsense approval and high traffic. whether you use Blogger or...

SEO Guide

Want to rank in Google image search? Images that you use as a featured images when writing a post actually appear on Google Images...

Advertisement