Full transcript
0:00A Linux backdoor is up for sale on the
0:03dark web with the price tag of 1600 US
0:07dollars. It's being sold by an actor
0:09with the alias dark worm. They say it's
0:12written in the C programming language
0:14and it has some anti-debugging
0:16techniques to evade detection and to
0:18steal usernames and passwords and enable
0:21[music] persistent access to a computer.
0:24They call the utility Pandora,
0:27presumably playing off the word Pandora,
0:30but referencing PAM, the pluggable
0:32authentication module on Linux, and
0:35sneaking in the suffix of the word for a
0:38backdoor. This listing is up for sale on
0:41the dark web forum called Rehub. Things
0:44like hacking tools, malware, data
0:46breaches, or access are always up for
0:49sale on cybercrime bulletin boards just
0:52like these. But Pandora is a
0:54post-exploitation backdoor, meaning that
0:57once a hacker has access on a target
1:00Linux system, they can keep their hooks
1:02and claws on the box. The way this works
1:05is by focusing on that Linux specific
1:08PAM stack, the pluggable authentication
1:11module, which is used for how just about
1:14all logins are processed on Linux. Think
1:17of SSH, the secure shell, or sudo to
1:21borrow the root user or administrator
1:23privileges, and natural logins and other
1:26PAM-aware services. You can see
1:28different modules that are used by PAM
1:31on your own Linux machine inside the
1:33/lib/security
1:35folder or others like the
1:37/lib/x86_64-linux-gnu/security
1:42folder. You can list out all the natural
1:45and native files that make up the
1:47system. These have a .so file extension
1:50for the file type that's called a shared
1:52object file. This Pandora backdoor
1:56utility and others like it will either
1:58modify or completely replace some
2:01already existing but critical shared
2:04object files like pam_unix.so
2:08or they will add in and load their own
2:11new malicious pam module and they can
2:15make these do really whatever they want.
2:18It can capture entered credentials or
2:21add a sort of skeleton key password that
2:23can be used in to any user account. For
2:27Pam Dora, we can see they do create
2:30their own new and separate pam_linux.so
2:34file to try and blend in with
2:37pam_unix.so.
2:39They can then specify in the pam
2:41configuration files to load this
2:44malicious module first listing it within
2:47things like /etc/pam.d/sshd
2:52for remote SSH access or
2:55/etc/pam.d/login
2:57for natural local access. These
2:59configuration files reference the .so
3:02shared object module files and they
3:04handle the authentication flow. So, with
3:07a hacker bringing their own, it can do
3:10anything and it's a bit stealthier than
3:13typical cron or systemd backdoors. Not
3:16only does Pam Dora use a magic password
3:19but according to the listing, it pairs
3:21that with a specific TCP port condition
3:24for even more controlled persistent
3:27access. The listing mentions some
3:29anti-debugging techniques and it even
3:32includes anti-forensic capabilities that
3:35scrub the logs like entry records and
3:38artifacts from the attacker's access.
3:40They manipulate files like lastlog,
3:43btmp, utmp and wtmp. Also, they don't
3:47leave behind their cybercriminal
3:49fingerprints. This means defenders and
3:52instant response teams may have trouble
3:55investigating a compromised server
3:57because the attacker can maintain
3:59access, erase traces from local login
4:02records, and potentially capture
4:04credentials from the very people logging
4:06in who are supposed to clean it up. Now,
4:09obviously, I have not purchased this off
4:11the dark web. So, I'm just seeing this
4:13through the lens of the advertisement
4:15listing and the screenshots they
4:17provided. And this is kind of cool. This
4:19finding was actually from our good
4:20friends over at Flare and their blog
4:23post write-up. If you aren't familiar
4:24with Flare, they are a threat exposure
4:27management solution that tracks down
4:29your own risk and threat intelligence
4:31based off real threat actor activity on
4:34the dark web and the clearnet. Their
4:37platform lets you create identifiers for
4:39your own organization and teams, even
4:42integrating with your Entra ID accounts,
4:44and you can set alerts and automatic
4:46remediation whenever any of your
4:48personnel has their information in a
4:50data breach or passwords or cookies and
4:53info-stealer malware logs. In their
4:55analysis of the Pandora Linux backdoor,
4:58they had some interesting insight. In
5:01fact, since they can trace all of the
5:03cybercrime chitchat on these forums,
5:06marketplaces, Telegram channels, and so
5:08much more, they noticed this backdoor
5:12isn't selling. So much so that the
5:15seller practically cut the price almost
5:17in half, bringing it down to 900 US
5:21dollars. It's worth mentioning that this
5:23HAM backdoor technique is pretty
5:26commonplace. There are a significant
5:28handful of hacker tools just like this
5:31that are already out on GitHub. Even one
5:34that I helped work on with the old
5:35PwnCat project from like almost eight
5:38years ago. It's a lot more primitive. It
5:40only adds a magic skeleton key password
5:44to log in to any account, but it goes to
5:46show this attack surface isn't really
5:49unexplored. Flare had done some research
5:52and found a good double digits of other
5:54open source projects that focus on a PAM
5:57backdoor. Some would specifically target
6:00the PAM_unix.so
6:03file to tamper with it and add malicious
6:05behavior. Others would insert their own
6:07new malicious module to allow any
6:10password to authenticate to any user.
6:13And some would even seed like a rolling
6:16password based off the current date or
6:18current time, which is kind of clever.
6:20The PAM-Dora backdoor seller, DarkWorm,
6:23opted to use the C programming language
6:26to build this thing. But looking beyond
6:28just PAM-Dora and this Linux backdoor
6:31across other tools just like this, you
6:34more often see a wrapper just written in
6:36pure bash or the Linux shell system
6:38scripting language. Maybe some are in
6:40Python or Golang or any other language,
6:43but from a dark web perspective, we
6:45might wonder, is this DarkWorm actor
6:49selling this on other forums? Have they
6:51shared more information elsewhere? If
6:54you key off of at least their username,
6:56you can see other DarkWorm accounts on
6:59sites like Spy Hackers, NulledBB,
7:03Anti-Chat, Cracked, and others. But
7:05those suggest they're probably separate
7:07individuals that just happen to have the
7:10same username. That's still one puzzle
7:12piece, though. And I think that's the
7:14most interesting tidbit here. Collecting
7:17puzzle pieces, data points, all the
7:20things that do add up to cyber threat
7:23intelligence. Because even still, just
7:26using an advertisement listing to go off
7:28of, it still points defenders in the
7:31right direction as to what is being
7:33targeted and how. Linux dominates
7:36enterprise infrastructure and cloud
7:38environments, and PAM is one of the most
7:41trusted layers of the operating system.
7:44So, as a defender, you can do more
7:47behavioral detection, ensure that there
7:49is visibility for PAM and SSH and kernel
7:52level hooks and library injections, or
7:54have audits into telemetry to know when
7:57file-backed logs are purged. But, the
8:00sneakiest thing is PAM-Dora, even as
8:03just one example, is collecting
8:06credentials. Something that you could be
8:09oblivious to from a single point in time
8:12moment when those secrets are spilled
8:15that could open the door for more
8:17damage. Like, using that potential
8:20password if it enables access to other
8:23systems. Think like lateral movement in
8:26a growing attack surface. You want to
8:28layer up your defense in depth to limit
8:31the blast radius if you're ever hit with
8:34a Linux backdoor like this PAM-Dora
8:37utility being sold on the dark web. But,
8:40you and your team probably aren't
8:42hanging out in cybercrime dark web
8:44forums to know what threats are on the
8:46horizon. So, I hope you're amping up
8:49your threat intelligence security
8:51posture. And hey, Flare could totally
8:53help out with that. They are the sponsor
8:55for today's video. So, please do give
8:57them some love with the link below in
8:58the video description, and check your
9:00PAMs, everybody. Thanks so much for
9:02watching.