brent timothy saner on 9 Dec 2014 00:35:45 -0800


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] The 'Penquin' Turla 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 12/09/2014 12:49 AM, Keith C. Perry wrote:
> I'm not sure about this write up.  Regular users can launch network listeners on ports above 1024 so that has nothing to do with root access.  That's not an automatic flag for a problem.
> 

And there's perl magic out there that lets regular users run on <1024.
Even multiplex a socket a service would normally listen on so it's
harder to track down.

> Network c&c, although slick, probably would set off heuristic security devices that do higher layer protocol inspection.  Such devices tend to be easy to set off as well.  Manually inspecting traffic would reveal this as well.
> 

If it's SSL, have fun with that without trying to MitM. It'd have to
rely on target destination, which thankfully appears to be hard-coded
in- but heuristic NIDS/NIPS aren't that hard to fool if you know what
you're doing.

Honestly, I wouldn't be too worried- the article reports that the author
hasn't seen it in the wild yet, so I would take it with a grain of salt
for now.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBCgAGBQJUhrRKAAoJEIwATC+TSB9rQ54P/i0zufxzJXqhtnO0YExeRIfK
KdVlXcxE9T3wHdo/3nLJd5zEEQWy9VcqF47SraxjYrWCrWZxVWXot/+FYMAiK5QS
y1bPgK5fx7S7uJVXoQc2p5up0fYzbAPjZK8xODI0ReE77JCbVyrIWHkiljmY/mvA
otzz6dBl5sEibEHD/UHbT3rF85ySCMJdbOCQkdinD/CciMWzfo0jfPMKzSDzkqFL
3lA9SMQy9pBW8IJE0XVljymyCJTv+5eunzK1/ew3A/q3a52IcZU/+xSgUokkCHM9
fCgRLKqtFCnoYN1cY1LZpQgUq6jG9rdTfQhA5CcfPPgmuuz7G+51t7IrvpWRNOsS
NwgmAcEGOSNV77cEvOF4hUxZauZoTBrqX5Gmz384e1+4LzmR+lABy6E+0LmkOjIe
lMd1ISmXEsCGc+ny3nIg5FY2pm8Mb4VHxqNdG6ts3Ks8OXYhgbJBDPGLH4k+EVaQ
4n42rOOZgm28iUc/Ud8W0aSIywZ7fGIXncUQR7y17jDDTprG9ga5pHVXIr0NBKEa
rmo5Msgu1DgVNJud8TrSl5wsNMDQlqqYgam02SyvDcTIwFt+pKYC80R/79m5H0qV
U62wCSvrLskbesZfyFoRZ1f92VfGHvl42ES9Is/gswI8IYvObVnBqev6W42F5tEK
IPk/GSrbLmIfOjCtkRBO
=32qp
-----END PGP SIGNATURE-----
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug