Sign up to save your podcasts
Or
Share Episode 176
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 176
Overview
On this week’s episode we dive into the Shikitega Linux malware report from AT&T
Alien Labs, plus we cover security updates for the Linux kernel, curl and
Zstandard as well as some open positions on the team. Join us!
This week in Ubuntu Security Updates
13 unique CVEs addressed
[USN-5591-1, USN-5591-2, USN-5591-3, USN-5591-4, USN-5597-1, USN-5598-1] Linux kernel (+ HWE, AWS, Oracle) vulnerability [00:47]
back in USN-5580-1 - Linux kernel (AWS) vulnerabilities - in Episode 175
[USN-5592-1, USN-5595-1, USN-5596-1, USN-5600-1] Linux kernel (+ OEM, HWE) vulnerabilities [01:04]
[USN-5594-1, USN-5599-1] Linux kernel (+ Oracle) vulnerabilities [01:28]
[USN-5587-1] curl vulnerability [02:12]
plus a bunch of control codes - NUL, BEL, LF, CR, HT (\t) and more
returning a HTTP 400 response code (Bad Request)
inside it, this then would get sent by curl to other sites in the same domain,
which would then reject the request and effectively DoS the user
[USN-5593-1] Zstandard vulnerability [04:34]
vulnerability
to get OOB write IF the caller had provided a smaller output buffer than
the recommended size
should always follow best practice
Goings on in Ubuntu Security Community
AT&T Alien Labs teardown of Shikitega Linux malware [05:40]
of the process
exploits as well as scan environments etc
standard Metasploit encoders to help it evade detection from AV scanners etc
additional shellcode to run plus the mettle interpreter so that it can make
use of off-the-shelf components from Metasploit in further stages
shellcode to spawn a shell via /bin/sh - from this shell it then attempts to
run commands to exploit two known privesc vulns - CVE-2021-4034
([USN-5252-1, USN-5252-2] PolicyKit vulnerability from Episode 147) and
CVE-2021-3493 ([USN-4916-2] Linux kernel vulnerability in Episode 113)
persistence and execute the primary payload - cryptominer
C2 on boot - and then another cron job to execute the cryptominer - and this
is done for both the standard user and root
privesc vulns - both of these were patched in Ubuntu quite a while ago - and
we released a Livepatch for the kernel privesc too - shows the value in such
services - can still stay protected against the kind of vulnerabilities that
attackers are actually exploiting without the need to reboot
in it from organisations like AT&T) but also the value in ensuring systems are
kept updated
systemd/open-vm-tools regression for Ubuntu 18.04 LTS [10:56]
work-in-progress so hopefully next week 🤞
Hiring [11:30]
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
On this week’s episode we dive into the Shikitega Linux malware report from AT&T
Alien Labs, plus we cover security updates for the Linux kernel, curl and
Zstandard as well as some open positions on the team. Join us!
This week in Ubuntu Security Updates
13 unique CVEs addressed
[USN-5591-1, USN-5591-2, USN-5591-3, USN-5591-4, USN-5597-1, USN-5598-1] Linux kernel (+ HWE, AWS, Oracle) vulnerability [00:47]
back in USN-5580-1 - Linux kernel (AWS) vulnerabilities - in Episode 175
[USN-5592-1, USN-5595-1, USN-5596-1, USN-5600-1] Linux kernel (+ OEM, HWE) vulnerabilities [01:04]
[USN-5594-1, USN-5599-1] Linux kernel (+ Oracle) vulnerabilities [01:28]
[USN-5587-1] curl vulnerability [02:12]
plus a bunch of control codes - NUL, BEL, LF, CR, HT (\t) and more
returning a HTTP 400 response code (Bad Request)
inside it, this then would get sent by curl to other sites in the same domain,
which would then reject the request and effectively DoS the user
[USN-5593-1] Zstandard vulnerability [04:34]
vulnerability
to get OOB write IF the caller had provided a smaller output buffer than
the recommended size
should always follow best practice
Goings on in Ubuntu Security Community
AT&T Alien Labs teardown of Shikitega Linux malware [05:40]
of the process
exploits as well as scan environments etc
standard Metasploit encoders to help it evade detection from AV scanners etc
additional shellcode to run plus the mettle interpreter so that it can make
use of off-the-shelf components from Metasploit in further stages
shellcode to spawn a shell via /bin/sh - from this shell it then attempts to
run commands to exploit two known privesc vulns - CVE-2021-4034
([USN-5252-1, USN-5252-2] PolicyKit vulnerability from Episode 147) and
CVE-2021-3493 ([USN-4916-2] Linux kernel vulnerability in Episode 113)
persistence and execute the primary payload - cryptominer
C2 on boot - and then another cron job to execute the cryptominer - and this
is done for both the standard user and root
privesc vulns - both of these were patched in Ubuntu quite a while ago - and
we released a Livepatch for the kernel privesc too - shows the value in such
services - can still stay protected against the kind of vulnerabilities that
attackers are actually exploiting without the need to reboot
in it from organisations like AT&T) but also the value in ensuring systems are
kept updated
systemd/open-vm-tools regression for Ubuntu 18.04 LTS [10:56]
work-in-progress so hopefully next week 🤞
Hiring [11:30]
Get in contact