di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Applications

Prevention for Endpoints

Products

Prevent Ransomware

Prevent Zero-Day Attacks

Improve EPP Efficacy

Extend & Enhance EDR

Stop Fileless Attacks

Solutions

Deep Learning in Cybersecurity

Our Customers

+ MS Defender

VS Traditional Antivirus

Why Deep Instinct

About Deep Instinct

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Training

Resources

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Events & Webinars

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

blog-image-bpfdoor-malware.jpg

<h5>What is BPFdoor?</h5>BPFdoor is a Linux-specific, low-profile, passive backdoor intended to maintain a persistent, long-term foothold in already-breached networks and environments and functions primarily to ensure an attacker can re-enter an infected system over an extended period of time, post-compromise.The malware gets its name from its usage of a <a href="https://en.wikipedia.org/wiki/Berkeley_Packet_Filter" target="_blank">Berkley Packet Filter</a> – a fairly unique way of receiving its instructions and evading detection, which bypasses firewall restrictions on incoming traffic.The malware is associated with a Chinese threat actor, Red Menshen (AKA Red Dev 18), which has been observed targeting telecommunications providers across the Middle East and Asia, as well as entities in the government, education, and logistics sectors since 2021.When it was first discovered, approximately one year ago, BPFdoor was noted for its effective and elegant design and its high emphasis on stealth – an essential element in maintaining undetected long-term persistence.Recently, Deep Instinct’s threat lab observed and analyzed a previously undocumented and fully undetected new variant of BPFdoor.<h5>New, Stealthier Variant</h5>Several key differences that make this new variant even stealthier compared to the previous version include the following:<table class="text-center"><thead class="bg-grey"><tr><th style="width: 24%;">&nbsp;</th><th style="width: 38%;">“New stealthy” 2023 variant</th><th>“Old” 2022 variant</th></tr></thead><tbody><tr><td>Encryption</td><td>Static library encryption</td><td>RC4 Encryption</td></tr><tr><td>Communication</td><td>Reverse-Shell</td><td>Bind shell and iptables</td></tr><tr><td>Commands</td><td>No hardcoded commands – all commands are sent through the reverse-shell</td><td>Hardcoded commands</td></tr><tr><td>Filenames</td><td>Not hardcoded</td><td>Hardcoded</td></tr></tbody></table>One of the most significant differences compared to the previous variant lies in the removal of many of its hardcoded indicators, making the newer version more difficult to detect. Since first seen on VirusTotal in February 2023, the new variant remained undetected and is still undetected as of this writing.<h5>BPFdoor Technical Analysis</h5>When executed, the BPFdoor sample will attempt to create and get a lock on a runtime file at “/var/run/initd.lock” and will exit if it fails using that file as a makeshift mutex.<figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt6b1f7a605acf0d71" alt="Figure 1 - BPFdoor " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6b1f7a605acf0d71/645bce382f97ad6087afc2a7/fig01-lock-mutex.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 1 - BPFdoor "mutex" check</figcaption></figure></figure>If successful, BPFdoor will fork itself and continue to run as a child process and in this context will close its stdin, stdout, and stderr streams, and set itself to ignore the following operating system signals:<table class="text-center"><thead class="bg-grey"><tr><th style="width: 16%;">Signal Number</th><th style="width: 21%;">Signal Name</th><th>Signal Description</th></tr></thead><tbody><tr><td>1</td><td>SIGHUP</td><td>SIGHUP ("signal hang-up") is a signal sent to a process when its controlling terminal session is closed.</td></tr><tr><td>2</td><td>SIGINT</td><td>SIGINT (“signal interrupt”) is a signal sent when a user interrupts a program (Ctrl + C)</td></tr><tr><td>3</td><td>SIGQUIT</td><td>SIGQUIT is a signal sent to terminate a process.</td></tr><tr><td>13</td><td>SIGPIPE</td><td>SIGPIPE is a signal sent when a pipe breaks.</td></tr><tr><td>17</td><td>SIGCHLD</td><td>SIGCHLD is a signal sent when a child process exits.</td></tr><tr><td>21</td><td>SIGTTIN</td><td>SIGTTIN is a signal sent to a process attempting to read from the same terminal session and is blocked.</td></tr><tr><td>23</td><td>SIGTTOU</td><td>SIGTTOU is a signal sent to a process attempting to write to the same terminal session and is blocked.</td></tr></tbody></table>Ignoring these signals hardens BPFdoor against tampering with its processes.Having set up the above, BPFdoor then allocates a memory buffer and creates a socket as follows:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltb66f26dd618af2fe" alt="Figure 2 - Socket arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb66f26dd618af2fe/645bce386d595aca93fa2ebf/fig02-socket-args.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 2 - Socket arguments</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blte9215556a7459197" alt="Figure 3 - Socket creation" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte9215556a7459197/645bce388a8445ca97101283/fig03-call-socket.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 3 - Socket creation</figcaption></figure>It will proceed to specify the following socket options using setsockopt:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltff07360ec7be9930" alt="Figure 4 - Setsockopt options" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltff07360ec7be9930/645bce388dbb82c3c233f5f4/fig04-setsockopts.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 4 - Setsockopt options</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt0e81a161934c6431" alt="Figure 5 - Call to setsockopt" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0e81a161934c6431/645bce38e4e69e5cbc037449/fig05-call-setsockopts.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 5 - Call to setsockopt</figcaption></figure>And will read from it in a loop (further described below) using recvfrom:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt7a59c922701ee083" alt="Figure 6 - Recvfrom arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7a59c922701ee083/645bce38065c95739056107a/fig06-recvfrom.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 6 - Recvfrom arguments</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt811bbcab6a1bb954" alt="Figure 7 - Recvfrom call" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt811bbcab6a1bb954/645bce38367cefb5428f68a2/fig07-loop-call-recvfrom.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 7 - Recvfrom call</figcaption></figure>An interesting point in the above-described flow is that the “addr” parameter is zeroed out in the call to recvfrom; it should point to a specific address from which to read data. The socket is not connected and no bind or listen calls have been made. So, what exactly is going on here?Interpreting the exact arguments that are used to create the socket reveals that the call is structured as follows:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt36f6534323294019" alt="Figure 8 - Socket call" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt36f6534323294019/645bce38367cefe17b8f689e/fig08-socket_eth.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 8 - Socket call</figcaption></figure>This creates the socket as a special packet sniffing socket which is able to read every packet that is sent to the machine from the ethernet layer and above without being bound to any specific protocol.BPFdoor employs this type of packet sniffing socket to read data with recvfrom, even without an “addr” parameter, by using the loop below to search for a specific “magic” byte sequence:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltf3c3312b0751a812" alt="Figure 9 - Looped search for " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf3c3312b0751a812/645bce388929af83080777c5/fig09-read-loop.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 9 - Looped search for "magic" byte sequence (highlighted)</figcaption></figure>“Magic” byte sequence: \x44\x30\xCD\x9F\x5E\x14\x27\x66Once found, the loop will break and BPFdoor will continue to Its next phase of operation.But, that creates quite a lot of traffic that BPFdoor will need to go through.Let’s examine the usage of setsockopt a bit further. When parsing its arguments, we arrive at the following code:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt734c1601420f27c9" alt="Figure 10 - Setsockopt attaches BPF" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt734c1601420f27c9/645bce4b7e7e7b9bafe70a08/fig10-setsockopt-args.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 10 - Setsockopt attaches BPF</figcaption></figure>This is where BPFdoor gets its name from. The above code that attaches a <a href="https://en.wikipedia.org/wiki/Berkeley_Packet_Filter" target="_blank">Berkley Packet Filter</a> to the socket; this is the very same mechanism that underpins infosec staples such as libpcap and allows BPFdoor to filter out “uninteresting” types of data coming through its socket.A Berkley Packet Filter can be defined as in the example below, which allows TCP over IPv4:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt89210974b140db77" alt="Figure 11 - BPF example" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt89210974b140db77/645bce4b065c95264056107e/fig11-bpf-example.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 11 - BPF example</figcaption></figure>By setting the socket option SO_ATTACH_FILTER and pointing filter to the following sock_filter_code:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt3a9b0cf5b5fbc758" alt="Figure 12 - BPF sock_filter_code" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3a9b0cf5b5fbc758/645bce4b1f0a4c5876e36beb/fig12-sock-filter-codev3.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 12 - BPF sock_filter_code</figcaption></figure>BPFdoor guides the kernel to set up its socket to only read UDP, TCP, and SCTP traffic coming through ports 22 (ssh), 80 (http), and 443 (https).Because of its positioning at such a low level, BPFdoor does not abide by any firewall rules, and can bypass any firewall restrictions on incoming traffic and listen for packets that otherwise wouldn't have surfaced to the machine's user mode.When BPFdoor finds a packet containing its “magic” bytes in the filtered traffic it will treat it as a message from its operator and will parse out two fields and will again fork itself.The parent process will continue and monitor the filtered traffic coming through the socket while the child will treat the previously parsed fields as a Command & Control IP-Port combination and will attempt to contact it.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt59a3decfdb9a8b40" alt="Figure 13 - Connect to Command & Control" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt59a3decfdb9a8b40/645bce4b8a84453a7a101287/fig13-connect-c2.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 13 - Connect to Command & Control</figcaption></figure>An interesting point to note, this variant of BPFdoor contains a pre-compiled version of <a href="https://github.com/libtom/libtomcrypt" target="_blank">libtomcrypt</a>, an open-source encryption library, as can be seen in the sample’s contained strings, which also offer a few additional insights:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt8e6c0a33246bf7b3" alt="Figure 14 - Contained strings" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8e6c0a33246bf7b3/645bce4b291ca448ab7458bf/fig14-libtom-strings.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 14 - Contained strings</figcaption></figure>We can see that the library was compiled at the beginning of October 2022 using GCC on a system running Red Hat Linux. This may suggest that this variant has been operational significantly earlier than its first appearance on VirusTotal.By compiling our own version of the library in similar fashion and using bindiff to compare against BPFdoor we can see its statically linked exports:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt816a0cb45cfa1a28" alt="Figure 15 - Libtomcrypt bindiff snippet" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt816a0cb45cfa1a28/645bce4b2f97ad7a76afc2ab/fig15-libtom-bindiff.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 15 - Libtomcrypt bindiff snippet</figcaption></figure>Having made the comparison, we determined that BPFdoor is using libtomcrypt functionality to set up a secure and encrypted “reverse-shell” session with its Command & Control. This replaced its previous mechanism.After this session is established, BPFdoor will begin a loop that can be described by the following:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltb2ff1c169f93cb84" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb2ff1c169f93cb84/645bce3822f9986ff5c5974b/BPFDOORv2Flow.png" style="text-align: center;"/></figure><h5>Conclusion</h5>BPFdoor retains its reputation as an extremely stealthy and difficult-to-detect malware with this latest iteration.Regardless of whether one considers the encryption library compilation time (October 2022) or its initial submission to VirusTotal (February 2023) as indicative of when this sample was first put into use, it is truly amazing how long it has remained fully undetected.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt93ffef0dee975742" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt93ffef0dee975742/645d25159c40aa50cb074137/fig16-vt-0detectionv3.png" style="text-align: center;"/></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt940800074dbf8141" alt="Figure 16 & 17 - 0 VirusTotal detections, 7 different scans." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt940800074dbf8141/645bce4b32acc8af715ee19b/fig17-vt-many-scans.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 16 & 17 - 0 VirusTotal detections, 7 different scans.</figcaption></figure><h5>IOCs</h5>afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7 – BPFDoor ELF SHA256 /var/run/initd.lock – BPFDoor "mutex”<h5>MITRE ATT&CK:</h5><table class="text-center"><thead class="bg-grey"><tr><th style="width: 20%;">Tactic</th><th>Technique</th><th>Description</th><th style="width: 20%;">Observable</th></tr></thead><tbody><tr><td>Command and Control Defense Evasion Persistence</td><td>T1205 - Traffic Signaling</td><td>Attacker employs “magic” values to trigger response.</td><td>“Magic” byte sequence</td></tr><tr><td>Command and Control Defense Evasion Persistence</td><td>T1205.002 - Traffic Signaling: Socket Filters</td><td>Attacker attaches filter to a network socket.</td><td>Usage of Berkley Packet Filter</td></tr><tr><td>Command and Control</td><td>T1573 - Encrypted Channel</td><td>Attacker employs encrypted Command & Control communication.</td><td>Usage of libtomcrypt</td></tr><tr><td>Execution</td><td>T1106 – Native API</td><td>Attacker calls upon native OS APIs in order to execute behaviors.</td><td>Usage of popen</td></tr></tbody></table>Earlier variant analysis: <a href="https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor" target="_blank">https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor</a>Deep Instinct takes a prevention-first approach to stopping ransomware and other malware using the world’s first and only purpose-built, deep learning cybersecurity framework. We prevent ransomware, zero-day threats, and previously unknown malware in &lt;20 milliseconds, 750x faster than the fastest ransomware can encrypt. Deep Instinct has &gt;99% zero-day accuracy and promises a &lt;0.1% false positive rate. The Deep Instinct Prevention Platform is an essential addition to every security stack – providing complete, multi-layered protection against threats across hybrid environments.

dirty-vanity-blog.jpg

Dirty Vanity: A New Approach to Code Injection & EDR Bypass

Deep Instinct Included in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms (EPP)