Re: [PLUG] 'Plague' PAM Backdoor Exposes Critical Linux Systems to Silent Credential Theft

[Rich Freeman via plug <plug@lists.phillylinux.org>]

On 8/4/2025 4:11 PM, Martin Cracauer via plug wrote:
> jeffv via plug wrote on Mon, Aug 04, 2025 at 09:44:46AM -0400:
> > New 'Plague' PAM Backdoor Exposes Critical Linux Systems to Silent
> > Credential Theft
> >
> > https://thehackernews.com/2025/08/new-plague-pam-backdoor-exposes.html
> >
> > "The implant is built as a malicious PAM (Pluggable Authentication Module),
> > enabling attackers to silently bypass system authentication and gain
> > persistent SSH access," Nextron Systems researcher Pierre-Henri Pezier said.
> That sounds like something easily detected by a rkhunter type of scan.
> Pretty lame.

Looks like it could be used as a component of a complete rootkit, but 
you're right that this seems like nothing new. Is this some security 
firm or academic group trying to get some attention?

I think any effective rootkit needs to be a holistic solution since the 
various components all need to help hide each other. They should also be 
installed in a polymorphic manner to at least make offline detection 
more difficult - I'm not sure how effective that actually is these days 
(I'm guessing not very since that has been around for decades).

--
Rich

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug