this post was submitted on 19 Sep 2023
121 points (94.2% liked)

Technology

60101 readers
2022 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
121
Chinese hackers have unleashed a never-before-seen Linux backdoor (arstechnica.com)
submitted 1 year ago by [email protected] to c/[email protected]
18 comments fedilink hide all child comments
 

Chinese hackers have unleashed a never-before-seen Linux backdoor::SprySOCKS borrows from open source Windows malware and adds new tricks.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 24 points 1 year ago* (last edited 1 year ago)

SprySOCKS Capabilities:

   ID	     NOTES
  • 0x09 Gets machine information
  • 0x0a Starts interactive shell
  • 0x0b Writes data to interactive shell
  • 0x0d Stops interactive shell
  • 0x0e Lists network connections (parameters: “ip”, “port”, “commName”, “connectType”)
  • 0x0f Sends packet (parameter: “target”)
  • 0x14, 0x19 Sends initialization packet
  • 0x16 Generates and sets clientid
  • 0x17 Lists network connections (parameters: “tcp_port”, “udp_port”, “http_port”, “listen_type”, “listen_port”)
  • 0x23 Creates SOCKS proxy
  • 0x24 Terminates SOCKS proxy
  • 0x25 Forwards SOCKS proxy data
  • 0x2a Uploads file (parameters: “transfer_id”, “size”)