Intezer Blog
intezer.com · Company blog · on HN since 2017
Intezer, a security firm, publishes malware analyses, mostly of Linux threats, along with container escape research.
What HN saysHN links it for the Symbiote analysis; commenters say the malware is hard to find if unseen but find the 'nearly-impossible-to-detect' framing overblown.
33HN people shared it
7linked it in comments
27stories submitted
399story points
2 years agolast shared
2017people per year2026
Most-shared posts
- 1Symbiote Deep-Dive: Analysis of a New, Nearly-Impossible-to-Detect Linux Threat6 people · 5 points · first shared 2022 · 3 comments on HN
- 2EvilGnome: Rare Malware Spying on Linux Desktop Users2 people · 103 points · first shared 2019 · 50 comments on HN
- 3New Chinese Linux malware turning to Golang2 people · 2 points · first shared 2020 · discussion on HN
- 4How We Escaped Docker in Azure Functions2 people · 2 points · first shared 2021 · 1 comments on HN
- 5New SysJoker Backdoor Targets Windows, Linux, and macOS1 people · 134 points · first shared 2022 · 43 comments on HN
- 6HiddenWasp Malware Stings Targeted Linux Systems1 people · 67 points · first shared 2019 · 40 comments on HN
- 7OrBit: New Undetected Linux Threat Uses Unique Hijack of Execution Flow1 people · 55 points · first shared 2022 · 25 comments on HN
- 8MirageFox: APT15 Resurfaces with New Tools Based on Old Ones1 people · 6 points · first shared 2018 · discussion on HN
- 9We Hacked Azure Functions and Escaped Docker1 people · 3 points · first shared 2021 · discussion on HN
- 10ElectroRAT: Attacker Creates Fake Companies to Drain Crypto Wallets1 people · 3 points · first shared 2021 · 1 comments on HN
- 11Silence of the Moles: Code Reuse in Malware Loaders1 people · 2 points · first shared 2017 · discussion on HN
- 122018 Winter Cyber Olympics: Code Similarities with Cyber Attacks in Pyeongchang1 people · 2 points · first shared 2018 · discussion on HN
- 13Lightning Framework is a new undetected Swiss Army Knife-like Linux malware1 people · 2 points · first shared 2022 · discussion on HN
- 14China PLA who hacked Google 8 years ago, might be behind the CCleaner hack1 people · 2 points · first shared 2017 · discussion on HN
- 15Chainjacking Supply Chain Attack Explained. Low Probability but Nice Research1 people · 2 points · first shared 2021 · discussion on HN
What HN people wrote when they linked it
varenc · 2024-07-01
Agreed that it still seems decently hard to find if you aren't looking for it. Though the tone of the blog post made a lot more sense to me when I saw the over-top-top title of the article[0] it's responding to: 'Analysis of a New, Nearly-Impossible-to-Detect Linux Threat':
[0] https://intezer.com/blog/research/new-linux-threat-symbiote/
nixcraft · 2022-06-10
Direct link to the blog post with all details https://www.intezer.com/blog/research/new-linux-threat-symbiote/
elesiuta · 2022-06-10
And it isn't too difficult for something to elevate itself to root anyways. It could just include a basic key-logger which would work on most systems and wait for your password. Unless you're on Wayland, you can see for yourself by typing `xinput list` and `xinput test <id>` using the id of your keyboard.
edit: and another comment linked to a blog post which also explains how this specific malware gains root https://www.intezer.com/blog/research/new-linux-threat-symbiote/
rurban · 2022-06-09
original src: https://www.intezer.com/blog/research/new-linux-threat-symbiote/
an attack targetting brazilian linux users
jacquesm · 2022-01-12
What are the odds of some of these software peddlers being in the malware business directly or indirectly? The chances of them happening to want you to download an otherwise unknown piece of stuff and run it privileged seem to be more of a risk than that you have the malware on your system.
Does anybody know what came of this?
https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targe…
Did the threat materialize or was it a dud?
Symbiote · 2021-03-14
https://www.intezer.com/blog/malware-analysis/new-linux-backdoor-redxo…
This linked source article has much more detail.
csmpltn · 2022-04-04
> "Genuinely, would you be happy with just container isolation between you and other
customers of your cloud provider? Most people absolutely would not."
But that's exactly how VPS hosting works today - you don't get your own private blade unless you're ready to pay premium prices and have the competence needed to run them yourself. The technicalities of how private resources in a VPS are isolated from each other will differ, but the concept remains the same nonetheless.
People bite the bullet, only to be subject to things like rowhammer [1], or other container escape scenarios [2].
The top comment in this thread reflects the proper way of dealing with this: containers or sandboxes are may not be treated as a secure boundary.
[1] https://www.usenix.org/conference/usenixsecurity16/technical-sessions/…
[2] https://www.intezer.com/blog/research/how-we-escaped-docker-in-azure-f…