LinkPro Rootkit Attacking GNU/Linux Systems Using eBPF Module to Hide Malicious Activities
A newly identified rootkit, named LinkPro, targets GNU/Linux systems by utilizing eBPF (Extended Berkeley Packet Filter) technology to hide its malicious operations and avoid detection by traditional monitoring tools.
A newly identified rootkit, named LinkPro, targets GNU/Linux systems by utilizing eBPF (Extended Berkeley Packet Filter) technology to hide its malicious operations and avoid detection by traditional monitoring tools.
LinkPro was uncovered during a forensic investigation of a compromised AWS infrastructure. It acts as a covert backdoor with features such as process concealment and remote activation through magic packets. The infection commenced on a public-facing Jenkins server (CVE-2024-23897).
Attackers deployed a malicious Docker image, kvlnt/vv, across Amazon EKS Kubernetes clusters, containing a VPN proxy, downloader malware vGet, and the LinkPro rootkit. This setup allowed full filesystem access with root privileges, facilitating container escape and credential harvesting.
SynAcktiv researchers analyzed LinkPro as a clandestine backdoor developed using Golang. The rootkit operates in two modes: passive reverse mode, activated by a magic TCP packet, and active forward mode, which initiates command-and-control communication.
LinkPro utilizes two eBPF modules for stealth, defaulting to dynamic linker hijacking via /etc/ld.so.preload if CONFIG_BPF_KPROBE_OVERRIDE is unavailable in the kernel. It achieves persistence by mimicking the system-resolved service, creating a deceptive unit file at /etc/system/system/systemd-resolveld.service. The binary is stored at /usr/lib/.system/.tmp~data.resolveld, with timestamps adjusted to blend with legitimate files.
LinkPro was uncovered during a forensic investigation of a compromised AWS infrastructure.
The Hide eBPF module intercepts system calls such as getdents and sys_bpf using tracepoints and kernel return probes, effectively hiding files, processes, and eBPF programs from enumeration tools.
Network Manipulation and Remote Access
The Knock eBPF module implements advanced network manipulation using XDP (eXpress Data Path) and TC (Traffic Control) programs. It monitors for a magic packet, a TCP SYN packet with a window size of 54321, and upon detection, updates a knock_map with the source IP for a one-hour duration, redirecting traffic to LinkPro's internal port 2233.
if (tcph->syn && tcph->window == bpf_htons(MAGIC_WIN)) { __u64 exp = bpf_ktime_get_ns() + WIN_NS; bpf_map_update_elem(&knock_map, &sip_h, &exp, BPF_ANY); return XDP_DROP; }
The tc_egress program modifies outgoing packets to maintain original port values, creating a covert tunnel bypassing firewall rules. LinkPro provides extensive remote access capabilities, including interactive shell sessions, file management, SOCKS5 proxy tunneling, and Base64-encoded file exfiltration. It supports multiple protocols like HTTP, WebSocket, TCP, UDP, and DNS tunneling, with XOR encryption for exchanges.
For detection, organizations should monitor for unusual systemd service files and suspicious eBPF activity.
Based on reporting by Cyber Security News.