The Amazon CEO reportedly told employees at an all-hands meeting that the company's five-day-a-week policy was aimed at improving company culture.

Luis Rodríguez, CTO of Xygeni.io, joins host Robert Blumen for a discussion of the recently thwarted attempt to insert a backdoor in the SSH (Secure Shell) daemon. OpenSSH is a popular implementation of the protocol used in major Linux distributions for authentication over a network. Luis describes how a backdoor in a supporting library was recently discovered and removed before the package was published to stable releases of the Linux distros. The conversation explores the mechanism of the attack through modifying a function table in the runtime; how the attack was inserted during the build; how the attack was carefully staged in a series of modifications to the lz compression library; the nature of “Jia Tan,” the entity who committed the changes to the open source project; social engineering that the entity used to gain the trust of the open source community; what forensics indicates about the location of the entity; hypotheses about whether criminal or state actors backed the entity; how the attack was detected; implications for other open source projects; why traditional methods for detecting exploits would not have helped find this; and lessons learned by the community.

Brought to you by IEEE Computer Society and IEEE Software magazine.

Apr 9, 2024

The xz Utils backdoor incident reveals that the security of the global internet depends on countless obscure pieces of software written and maintained by even more obscure unpaid, distractible, and sometimes vulnerable volunteers. It’s an untenable situation, and one that is being exploited by malicious actors. Yet precious little is being done to remedy it.

Threat type: Backdoor

Aliases: Trojan.Win32.Scar.sydj (KASPERSKY)

Platforms: Windows

Overall Risk Rating: Low

Damage Potential: High

Distribution Potential: Low

Reported Infection: Low

Information Exposure: High

Overview:

Cybercriminals take advantage of the popularity of the Zoom messaging app. This backdoor is found in a fake Zoom installer. This is probably hosted on malicious or suspicious sites.

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Threat type: Backdoor

Aliases: Backdoor:MSIL/Bladabindi.SBR!MSR (Microsoft), MSIL:Bladabindi-JK [Trj](AVAST)

Platforms: Windows

Overall Risk Rating: Low

Damage Potential: Medium

Distribution Potential: Low

Reported Infection: Low

Information Exposure: High

Overview:

Cybercriminals used this malware bundled with legitimate installation copies of the VPN software known as Windscribe. Note that these copies are hosted from fraudulent sources.

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It gathers certain information on the affected computer. It logs a user's keystrokes to steal information.

Threat type: Backdoor

Aliases: Trojan:MSIL/Solorigate.B!dha (Microsoft); Trj/Solorigate.A (Panda)

Platforms: Windows

Overall Risk Rating: Low

Damage Potential: High

Distribution Potential: Low

Reported Infection: Low

Information Exposure: Medium

Overview:

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Amazon CEO Andy Jassy said at an all-hands meeting on Tuesday that the plan to require employees to be in-office five days per week is not meant to force attrition

NICE Recording eXpress versions 6.0.x, 6.1.x, 6.2.x, 6.3.x, and 6.5.x suffer from cross site scripting, root backdoor, unauthenticated access, fail authorization, insecure cookie handling, and remote SQL injection vulnerabilities.

This Metasploit module exploits a backdoor in Webmin versions 1.890 through 1.920. Only the SourceForge downloads were backdoored, but they are listed as official downloads on the project's site. Unknown attacker(s) inserted Perl qx statements into the build server's source code on two separate occasions: once in April 2018, introducing the backdoor in the 1.890 release, and in July 2018, reintroducing the backdoor in releases 1.900 through 1.920. Only version 1.890 is exploitable in the default install. Later affected versions require the expired password changing feature to be enabled.

Netis E1+ version 1.2.32533 suffers from having a hardcoded backdoor root account.

OpenSSH 3.6.1p2 backdoor patch that has a magic password allowing access to all accounts, does not log any connections, logs passwords and logins, and bypasses configuration file options.

OpenSSH patch tested with versions 4.2p1 and 4.7p1 that allows for a hidden user to login with root permissions.

This patch is a backdoor to bash that will create a setuid backdoor shell in /tmp if run as root.

This patch for OpenSSH 6.0 Portable adds a hardcoded skeleton key, removes connection traces in the log files, usernames and passwords both in and out are logged, and more.

Swaparoo - Windows backdoor method for Windows Vista/7/8. This code sneaks a backdoor command shell in place of Sticky Keys prompt or Utilman assistant at login screen.

In recent years, there have been growing concerns over backdoor listings and shell activities in Hong Kong as a result of which new businesses have been able to be listed without going through the listing requirements contained in the Rules Gover...

Over All Risk Rating : Low


This backdoor comes bundled with a Monero miner, both spread by a botnet. The techniques employed are reminiscent of the Outlaw hacking group that Trend Micro reported in November 2018.

This Backdoor connects to Internet Relay Chat (IRC) servers. It joins an Internet Relay Chat (IRC) channel.

Read More

Over All Risk Rating : Low


IoT malware uses two different encryption routines for its strings and modified the magic number of UPX.

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Read More

Over All Risk Rating : Low


This backdoor is downloaded and installed in systems via malicious URL. It is installed with a miner.

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded by other malware/grayware from remote sites.

Read More