Linux systems, critical to many servers and infrastructures, are frequently targeted by malicious actors exploiting vulnerabilities to seize control and conduct harmful operations. These attacks often involve deploying malware and establishing botnets.
Recently, AON’s Stroz Friedberg uncovered a particularly elusive piece of Linux malware named ‘Sedexp,’ which has evaded detection since 2022.
The Sedexp Malware
Sedexp cleverly uses Linux’s udev rules for persistence and evades detection through sophisticated techniques. Udev rules, integral to the Linux OS kernel, manage device nodes within the /dev directory, handle hotplug events, and load necessary drivers.
The udev rules are stored in /etc/udev/rules.d/ or /lib/udev/rules.d/ and specify actions triggered by device changes. For instance, a rule might look like this:
ACTION=="add"
KERNEL=="sdb1"
RUN+="/path/to/script"This example triggers a script when a device with the name sdb1 is added. Sedexp manipulates these rules to ensure its continued presence on the system.
The malware relies on udev rules to maintain its foothold, specifically by executing /dev/random (major=1, minor=8) after a system restart. It uses the rule:
ACTION=="add", ENV{MAJOR}=="1", ENV{MINOR}=="8", RUN+="/asedexpb run:+"This rule triggers the execution of Sedexp.
Key features of Sedexp include:
- Reverse Shell Capability: Allows remote control.
- Memory Modification: Hides files related to Sedexp from standard commands like
lsandfind.
Sedexp disguises itself as “kdevtmpfs” by using the prctl(PR_SET_NAME, "kdevtmpfs", 0, 0, 0) function, blending in with legitimate processes. It achieves persistence by copying itself to /lib/udev/ and creating a udev rule in /etc/udev/rules.d/.
The malware’s reverse shell functionality is implemented using socket programming (AF_INET, SOCK_STREAM), redirecting STDIN, STDOUT, and STDERR to the socket before launching /bin/sh.
Sedexp’s code includes:
- Memory Allocation:
calloc - Argument Handling:
strdup,memset - File Operations:
readlink,fopen,fprintf - System Calls:
system,execl - Network Programming:
socket,connect,htons,inet_addr
These features make Sedexp particularly stealthy and persistent, complicating detection efforts.
Discovered through OSINT analysis, Sedexp has been used by financially motivated actors and remains undetected by many online sandboxes. It includes code for credit card scraping on web servers, as noted by Stroz Friedberg.
To combat such advanced threats, organizations must implement a thorough security strategy.
Indicators of Compromise (IoCs)
- SHA256: 43f72f4cdab8ed40b2f913be4a55b17e7fd8a7946a636adb4452f685c1ffea02
- SHA256: 94ef35124a5ce923818d01b2d47b872abd5840c4f4f2178f50f918855e0e5ca2
- SHA256: b981948d51e344972d920722385f2370caf1e4fac0781d508bc1f088f477b648
