Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

When PAM Goes Rogue: Malware Uses Authentication Modules for Mischief

Summary: Unit 42 describes how malware abuses pluggable authentication module (PAM) APIs on Linux, the framework behind SSH, GNOME Display Manager and sudo authentication. It names four families that do this: Orbit (found in 2022), which hooks pam_open_session, pam_authenticate and pam_acct_mgmt to log SSH passwords to a file; Azazel, an open-source rootkit using LD_PRELOAD to allow remote entry; Derusbi, which loads a malicious shared object exporting PAM APIs; and Skidmap, first seen in 2019, which replaces pam_unix.so with a version that accepts a specific password for any user.

What's compelling: Skidmap's swapped pam_unix.so accepts one password for every account on the host, so a single credential defeats authentication across the machine. Orbit, Azazel and Derusbi all reach the same APIs through LD_PRELOAD, which means watching that environment variable and PAM API calls in a sandbox is where these intrusions surface.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related