BPFDoor is a Linux/Unix backdoor that allows threat actors to remotely connect to a Linux shell to gain complete access to a compromised device. It supports multiple protocols for communicating with a command & control server (C2) including TCP, UDP, and ICMP. It notably utilizes Berkeley Packet Filters (BPF) along with several other techniques to achieve these goals. BPF is a hooking function that allows a user-space program to attach a network filter onto any socket, and then allows or disallows certain types of data to come through that socket.BPFDoor has been attributed to a Chinese threat actor group named Red Menshen (aka DecisiveArchitect), where the attackers have used it to gain stealthy remote access to compromised devices starting back in 2018 to the present day. Systems have been compromised across the US, South Korea, Hong Kong, Turkey, India, Vietnam, and Myanmar. Targets have included telecommunications, government, education, and logistics organizations. The group has been seen sending commands to BPFDoor victims via Virtual Private Servers (VPS) hosted at a well-known provider. In turn, these VPSs are administered via compromised routers based in Taiwan that the threat actor uses as VPN tunnels.Target Geographies: Middle East, AsiaTarget Sectors: Logistics, Education, Government
The threat actor leverages a custom implant tracked by the name “JustForFun”. When executed, the implant overwrites the process command line within the process environment by randomly selecting a new binary name from one of ten hard-coded options (shown in Figure 1). This masquerading technique is used to evade security solutions.Figure 1: List of process names for MasqueradingThe attacker interacts with the implant through the bash process to establish an interactive shell on a system. The command indicates the usage of Postfix queue manager (shown in Fig. 2).qmgr -l -t fifo -uFigure 2: Encoded shell and qmgr commands
Masquerading (Rename the process)
Figure 3: Code uses prctl to rename the malware processThe malware will rename itself using the prctl function with the argument PR_SET_NAME, and a random legitimate-looking name (Fig. 3). These names are hardcoded in the binary and vary between the samples.
Timestomping
The implant sets a fake time to timestomp the binary before deletion. A function dubbed set_time was called to alter the access and modification timestamp of the binary using the utimes function (Fig. 4). The timestamp used was always set to Thursday, October 30, 2008 7:17:16 PM (GMT).
PID File
The implant creates a zero-byte PID file at /var/run/haldrund.pid (Fig. 5). The file has two conditions:
This file is deleted if the implant terminates normally,
The file is not deleted, if there is a problem like hard shutdown or crash.
The implant will not resume if this file is present as it describes the running state for the backdoor.
BPFDoor Detection using Qualys Custom Assessment & Remediation
Qualys Custom Assessment and Remediation can be leveraged to create and execute custom detection logics for zero-day threats. This cloud service supports multiple scripting languages including Perl, Shell, Python, Lua, PowerShell, and VBScript with no vendor-specific syntax or restrictions. Select the language of your choice and start by leveraging out-of-the-box scripts or creating your own scripts for custom detection, validation, and remediation. We created the Shell script as part of our detection logic via the Qualys scripting service and executed it across the network.Using this script, we are looking for packet sniffing processes under the entire process stack and checking if an existing process has opened a raw socket using the default Linux utility lsof. Refer the following screenshots of the script (Fig. 6) and its output (Fig. 7).
BPFDoor Detection using Qualys Multi-Vector EDR
Qualys Multi-Vector EDR, armed with YARA scanning techniques, detects the BPFdoor RAT with a threat score of 5/10 (Fig. 8).Figure 8: Qualys Multi-Vector EDR detection for BPFdoorAfter execution, the binary masquerades its name by selecting from one of 10 names randomly:
The highlighted name was used during the execution. The names are made to look like common Linux system daemons. The implant overwrites the argv[0] value which is used by the Linux /proc filesystem to determine the command line and command name to show for each process. By doing this, when a run command like ps is executed, it shows the fake name.The renamed binary is dropped to the /dev/shm directory and runs itself as /dev/shm/kdmtmpflush (Figs. 9 and 10). The masqueraded process with a “–init” flag tells itself to execute secondary clean-up operations and go resident.The implant creates a zero-byte PID file at /var/run/haldrund.pid (Fig. 11).As shown in figure 12, The original execution process deletes /dev/shm/kdmtmpflush with the following command:/bin/rm -f /dev/sfm/kdmtmpflush
Conclusion
As with most remote access tools, BPFDoor is visible during the post-exploitation phase of an attack. It is expected that the authors behind BPFdoor will be upgrading its functionality over time, including different commands, processes, or files. This malware has a vast arsenal at its disposal. Therefore, we recommend that organizations have a robust EDR solution to both detect its signatures and adequately respond to the threat.
MITRE ATT&CK Techniques
T1036.005- Masquerading: Match Legitimate Name or Location T1070.004- Indicator Removal on Host: File Deletion T1070.006- Indicator Removal on Host: Time Stomp T1059.004- Command and Scripting Interpreter: Unix Shell T1106- Native API T1548.001- Abuse Elevation Control Mechanism: Setuid and Setgid T1095- Non-Application Layer Protocol
We get a visit from Tanya Janca to discuss her latest book, Alice and Bob Learn Secure Coding!
Segment Resources:
Tanya's latest book on Amazon
Tanya's previous book, Alice and Bob Learn Application Security on Amazon
Tanya's website, She Hacks Purple
