29

After a recent break in on a machine running Linux, I found an executable file in the home folder of a user with a weak password. I have cleaned up what appears to be all the damage, but am preparing a full wipe to be sure.

What can malware run by a NON-sudo or unprivileged user do? Is it just looking for files marked with world writable permission to infect? What threatening things can a non-admin user do on most Linux systems? Can you provide some examples of real world problems this kind of security breach can cause?

ezgoodnight
  • 441
  • 4
  • 9
  • 14
    It can do whatever you could do as an unprivileged user, which could be a whole lot of things. – Faheem Mitha Feb 29 '16 at 16:15
  • 1
    It depends on your setup and if the machine is well maintained. It can range from just sending malware or being part of a botnet, from escalating privileges, doing all those things, and further compromise the machine and the security of your network. – Rui F Ribeiro Feb 29 '16 at 16:21
  • 9
    If the malware is sophisticated enough it can exploit vulnerabilities to gain root access. A breached system is always to be considered utterly broken and should be taken offline immediately. – Runium Feb 29 '16 at 16:56
  • 2
    Note: Usually the exploits are inactive for months. The exploiter will sell the ability to do bad things to others. – Giacomo Catenazzi Feb 29 '16 at 17:18
  • 5
    Local privilege escalation https://access.redhat.com/security/cve/CVE-2016-0728 – Jeff Schaller Feb 29 '16 at 17:35
  • Well, it could e.g. clean out your bank account. – vonbrand Feb 29 '16 at 20:52
  • In **OSX**, the most invasive user-level thing I have found was a ***LaunchAgent*** that would run it's own code whenever you opened an app. – user4437749 Mar 01 '16 at 01:20

8 Answers8

29

Most normal users can send mail, execute system utilities, and create network sockets listening on higher ports. This means an attacker could

  • send spam or phishing mails,
  • exploit any system misconfiguration only visible from within the system (think private key files with permissive read permissions),
  • setup a service to distribute arbitrary contents (e.g. porn torrent).

What exactly this means depends on your setup. E.g. the attacker could send mail looking like it came from your company and abuse your servers mail reputation; even more so if mail authentication features like DKIM have been set up. This works till your server's rep is tainting and other mail servers start to blacklist the IP/domain.

Either way, restoring from backup is the right choice.

tarleb
  • 2,047
  • 11
  • 21
  • 17
    The attacker can encrypt all the users data and require a payment to get the private key for it – Ferrybig Feb 29 '16 at 20:14
  • 1
    @Ferrybig They can only encrypt the current version, not back ups. The question then becomes this: is the set of back ups nonempty? – PyRulez Mar 01 '16 at 02:11
  • We all know the usual answer to that question, @PyRulez :O – TheBlastOne Mar 01 '16 at 06:51
  • Does sending emails from a server imply you can use email addresses @ your domain, in a more distinguishable way than using a completely irrelevant server? – user23013 Mar 01 '16 at 07:35
  • 1
    @user23013 Not necessarily, but with many systems, it does. Postmasters can setup technologies like [SPF](https://en.wikipedia.org/wiki/Sender_Policy_Framework), [DKIM](https://en.wikipedia.org/wiki/DKIM), and [DMARC](https://en.wikipedia.org/wiki/DMARC) which enables remote servers to validate the legitimacy of incoming mail. Some mailers (e.g. Gmail) offer an option to highlight mails validated that way. An attacker could abuse this to send seemingly trustworthy phishing mails. – tarleb Mar 01 '16 at 07:44
19

Most of the answers are missing the two key words: privilege escalation.

One an attacker has access to an unprivileged account, it's much easier for them to exploit bugs in the operating system and libraries to obtain privileged access to the system. You shouldn't assume that the attacker used only the unprivileged access they originally obtained.

David Richerby
  • 330
  • 1
  • 9
  • 2
    I was waiting to post to see if anyone noted this particular real risk. Buffer overflows, the perpetual friend of all malcreants, lol. You should have had more than plus 1 because this is the actual real risk, not some user level spyware, which is annoying but that's about it. Privilege escalation, leading to rootkit installation, leading to a totally owned machine, with essentially undetectable exploits running happily behind the scenes. – Lizardx Mar 01 '16 at 03:38
15

A rm -rf ~ or something alike would be pretty catastrophic, and you don't need root privileges.

joH1
  • 898
  • 1
  • 11
  • 23
  • 15
    Dear UNIX newcomers, don't try this! (it will erase your personal files) – A.L Feb 29 '16 at 22:30
  • 1
    Exactly as A.L. says. `rm -rf /` is much safer (j.k. don't do it. It kills everything: http://www.urbandictionary.com/define.php?term=rm+-rf+%2F.) – PyRulez Mar 01 '16 at 02:12
12

Ransomware

It doesn't apply to your situation, since you would have noticed it, but for the nowadays somewhat popular attacks of ransomware (encrypting all your documents and offering to sell the decryption key) it is completely sufficient to have unprivileged access.

It can't modify system files, but generally rebuilding a system from scratch is simple compared to recovery of valuable user data (business documents, family pictures, etc) from backups that often are obsolete or nonexistent.

200_success
  • 5,496
  • 1
  • 26
  • 34
Peteris
  • 310
  • 1
  • 6
11

Most common (in my POV, from my experience):

  • Sending spam

  • Sending more spam

  • Infecting other computers

  • Setup phishing sites

  • ...

Giacomo Catenazzi
  • 2,630
  • 9
  • 15
4

A virus can infect all the machines in your LAN network and elevate the privilege to get the root access wiki-Privilege_escalation

Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. The result is that an application with more privileges than intended by the application developer or system administrator can perform unauthorized actions.

GAD3R
  • 63,407
  • 31
  • 131
  • 192
0

A lots of potential possibilities come to my mind:

  • Denial of service: it could be on your machine or more probable, use your machine to attack a second one at the cost of your own resources.
  • Mine bitcoins. Using your CPU for getting money seems atractive enough
  • If the browser is vulnerable they will try to redirect you to every kind of sites, install bars or show pop-ups that will give them revenue. Fortutately this seems harder in Linux or the spammers are not as good at this.
  • Get private data for comercial use and sell it to others. Only for the compromised user: date of birth, telephone, if it is in the browser caché.
  • Access other files in the server that are readable.
  • Create malicious scripts that might ask for the root password. For example, in your bash they may try to redirect sudo to other things to get your password.
  • Getting your stored passwords in the browser or try to keylog your bank credencials. This might be harder but certainly will be dangerous. With gmail they may get facebook, stole your steam acount, amazon, etc.
  • Install malicious certificates as valid for your user

Of course this is a worse case scenario so do not panic. Some of this might be blocked by other security measures and won't be trivial at all.

borjab
  • 101
  • 2
0

Information [1]

IMHO one of the most scaring thing that an exploit can do is to gather information and remain hidden to come back and strike when your attention will be less (each night or holiday period will be suitable).
The following are only the first reasons that come up in my mind, you can add others and others...

  • Information about the services you are running, their version and their weaknesses, with special attention to the obsolete one that you may need to keep alive for compatibility reasons.
  • Periodicity with which you update them and the security patches. To sit in front a bulletin and wait the right moment to try to come back.
  • The habits of your users, to rise less suspects when it will be.
  • The defences you set up.
  • If gained even a partial root access the ssh-keys, authorized hosts and the passwords on this and other machines for each user (let's suppose someone executed a command with the password passed as a parameter it is not even needed the root privilege). It was possible to scan the memory and extract it. I say again: in both ways, to your machine and from your machine. With 2 sided ssh authorization between two machines they can continue to bounce in and out from the compromised account.

So flatten that machine and monitor the future passwords and keys, for these reasons above and all the other ones that you can read from the other answers.

[1] Quoting not literally Hitchcock: "A shot of a gun lasts a moment but an hand wielding a weapon can last a full movie"

Community
  • 1
Hastur
  • 2,325
  • 16
  • 32