SO that looks suspicious: leveraging process memory and kernel/usermode probes to detect Shared Object injection at scale on Linux

No ratings

Presented at Virus Bulletin 2024 by

Daniel Jary

Shared Object (SO) injection on Linux is the fundamental equivalent of DLL injection on Windows. It's an effective technique successfully leveraged by attackers and their runtime malware. Under normal circumstances a loaded SO provides additional capability to a process by supplying exported functions. However, attackers can modify, insert, or even execute their own SO(s) in memory to perform malicious activities. What's concerning is the availability of user mode rootkits that implement this functionality but the lack of endpoint monitoring and AV solutions that can detect the many variations of this technique. Even more worryingly, threat groups have leveraged this capability directly from source to great effect in order to remain undetected! In this talk I will dig into four techniques that can be used to maliciously load SOs and uncover unique ways to detect them. I will explain how to rebuild the ELF structure from process memory, enrich this with forensic metadata and then combine it with u/kprobes to facilitate targeted scanning and perform efficient detections at scale. The four techniques covered here are: DT_NEEDED infections. LD_PRELOAD injection, API hooking. Direct use of __libc_dlopen_mode(). Reflective SO injection. In addition, I will be demonstrating part of my own tool that not only identifies SO injection but also shellcode injection, process hollowing, entry point manipulation of running processes. Viewers of this talk, especially those working as sensor developers, incident responders or in a blue team, will come away with knowledge of how to spot such techniques and implement these capabilities into their own toolsets. They will gain an understanding of ELF internals, Linux process memory, uprobes and kprobes, and of how to combine them to detect evil. Coinciding with this talk is the release a two-part white paper on SO injection attack, defence for those who wish to dig a little deeper.