Our team detected a BPFDoor using deception techniques, and we recently hosted a webinar talking through our findings. BPFDoor uses a variety of techniques, including particularly clever ones that allow it to enable backdoors without opening ports. This makes detecting it uniquely challenging. It seems that this particular backdoor has been in use for more than five years (affecting Linux and Solaris hosts), affecting principally Asian organizations and telco providers. Find out more about the compromise at our previous blogpost.
In this webinar, we discussed this compromise step-by-step with Nicole Carignan, CounterCraft Customer Success Manager, and David Barroso, CEO. Watch it and stay tuned for any updates on the intel gathered.
BPFDoor and So Much More
An Analysis of Linux Network Passive Backdoors
If you missed the webinar, you can register to watch it on-demand by clicking here.
The IoCs from the attack were the following:
IOCs
Hashes
07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d
1925e3cd8a1b0bba0d297830636cdb9ebf002698c8fa71e0063581204f4e8345
4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d
591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78
599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683
5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9
5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3
76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925
93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c
96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9
97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc
c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276
c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c
f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72
f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27
fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73
fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a
144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3
fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73
76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925
96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9
c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c
f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72
07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d
4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d
599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683
5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9
5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3
93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c
97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc
c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276
f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27
fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a
Filenames
/dev/shm/kdmtmpflush
/dev/shm/kdumpflush
/dev/shm/kdumpdb
/var/run/xinetd.lock
/var/run/kdevrund.pid
/var/run/haldrund.pid
/var/run/syslogd.reboot
Process names
/sbin/udevd -d
/sbin/mingetty /dev/tty7
/usr/sbin/console-kit-daemon –no-daemon
hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event
dbus-daemon –system
hald-runner
pickup -l -t fifo -u
avahi-daemon: chroot helper
/sbin/auditd -n
/usr/lib/systemd/systemd-journald
/usr/libexec/postfix/master
qmgr -l -t fifo -u
The TTPs from the attack were the following:
TTPs
T1059.004: Command and Scripting Interpreter: Unix Shell
T1070.004: Indicator Removal on Host: File Deletion
T1036/004: Masquerading: Masquerade Task or Service
T1070/006: Indicator Removal on Host: Timestomp
T1205: Traffic Signaling
Additional Reading
If you want to know more about BPFDoor, we recommend the following resources:
- – ‘CyberThreats 2021: A Year in Retrospect’ by PwC
- – Tricephalic Hellkeeper: a tale of a passive backdoor by Exatrack
- – BPFDoor – An Evasive Linux Backdoor Technical Analysis by Sandfly Security
- – BPFDoor — An active Chinese global surveillance tool by Kevin Beaumont
- – A peek behind the BPFDoor by Elastic
If you register for the webinar, you will automatically receive any new intel we pick up regarding this situation as well as detection opportunities and even more intel. You can also follow our LinkedIn for updates.