Ubuntu Security Podcast

This week we take a deep dive into the latest Linux malware, GoblinRAT to look

https://rt-solar.ru/solar-4rays/blog/4861/

Solar 4RAYS team (Cyber Threat Research Center at SOLAR - Russian

Found this malware masquerading as a legitimate process which takes quite

Doesn’t include automatic persistence but instead appears to be manually

Automatically deletes itself off the system if does not get pinged by the C2

Has 2 versions - a “server” and “client” - the server uses port-knocking to

Client instead connects back to its specific C2 server

Logs collected by 4RAYS team appear to show the commands executed by the

Malware itself is implemented in Go and includes the ability to execute single

To try and frustrate reverse engineering Gobfuscate was used to obfuscate the

Encrypts its configuration using AES-GCM and the config contains details like

Uses the yamux Go connection multiplexing library then to multiplex the single

Can then be instructed to perform the various actions like running commands /

Other interesting part is the kill switch / self-destruct functionality - if

Overall 4 organisations were found to have been hacked with this and in each

But unlike other malware that we have covered, it does not appear to be a more

No clear evidence of origin - Solar 4RAYS asking for other cybersecurity

Interesting to see the evolution of malware mirrors that of normal software

For the third and final part in our series for Cybersecurity Awareness Month,

In the second part of our series for Cybersecurity Awareness Month, Luci is back

For the first in a 3-part series for Cybersecurity Awareness month, Luci

John and Maximé have been talking about Ubuntu’s AppArmor user namespace

613 unique CVEs addressed in the past fortnight

The long awaited preview of snapd-based AppArmor file prompting is finally

45 unique CVEs addressed

A recent Microsoft Windows update breaks Linux dual-boot - or does it? This week

135 unique CVEs addressed

only noble has a new-enough shim in the security/release pocket - both focal

until then, if affected, need to disable secure boot in BIOS then can either

then can re-enable Secure Boot in BIOS

Once new shim is released it will reinstall the new SBAT policy to revoke

One other thing, this also means the old ISOs won’t boot either

This week we take a deep dive behind-the-scenes look into how the team handled a

185 unique CVEs addressed

This week we take a look at the recent Crowdstrike outage and what we can learn

462 unique CVEs addressed

This week we deep-dive into one of the best vulnerabilities we’ve seen in a long

39 unique CVEs addressed