• Office Hours : 08:00 - 17:30

CronRat Magecart malware uses 31st February date to remain undetected

Security researchers have discovered a Linux-based remote access trojan (RAT) that uses an unusual stealth technique to remain out of sight from security products.

The malware, dubbed CronRat, hides in the calendar subsystem of Linux servers (“cron”) on a non-existent day, 31 February, according to a blog post by security researchers at Sansec.

The researchers said that CronRat “enables server-side Magecart data theft which bypasses browser-based security solutions”. The malware was discovered on several eCommerce websites injecting Magecart payment skimmers in server-side code.

Sansec director of threat research Willem de Groot said that digital skimming is moving from the browser to the server, and this is yet another example.

“Most online stores have only implemented browser-based defenses, and criminals capitalize on the unprotected back-end. Security professionals should really consider the full attack surface,” he added.

The malware uses Linux’s cron job scheduling utility to hide from discovery. It adds several tasks to crontab with a curious date specification: 52 23 31 2 3. These lines are syntactically valid but would generate a run time error when executed.

“However, this will never happen as they are scheduled to run on February 31st. Instead, the actual malware code is hidden in the task names and is constructed using several layers of compression and base64 decoding,” said researchers.

Related Resource

What to consider when choosing a next-generation firewall

How to choose a NGFW solution

Vector of an envelope with a padlock over it on a blue backgroundVector of an envelope with a padlock over it on a blue backgroundFree download

According to researchers, the malware is a sophisticated Bash program that features self-destruction, timing modulation, and a custom binary protocol to communicate with a foreign control server. Upon launch, it contacts the control server using an exotic feature of the Linux kernel that enables TCP communication via a file using a fake banner for the Dropbear SSH service. This also helps to keep the malware hidden.

It also contacts a server hosted on Alibaba in China, and uses a custom binary protocol with random checksums, to avoid detection by firewalls and packet inspectors.

Once contact with a C2 server is established, it drops its disguise and sends and receives numerous commands, and downloads a malicious dynamic library. Afterwards, the malware is ready to run any command on a compromised system.

While investigating this RAT, the researchers wrote another specially crafted RAT client to intercept commands. This led to the discovery of yet another RAT that researchers hope to study in-depth later.

Featured Resources

Shining light on new ‘cool’ cloud technologies and their drawbacks

IONOS Cloud Up! Summit, Cloud Technology Session with Russell Barley

Watch now

Build mobile and web apps faster

Three proven tips to accelerate modern app development

Free download

Reduce the carbon footprint of IT operations up to 88%

A carbon reduction opportunity

Free Download

Comparing serverless and server-based technologies

Determining the total cost of ownership

Free download

See the original article here: ITPro