Linux Root Malware, Gallium’s PingPull RAT, Guzzle Drupal Patch, and more.

Infosec Overnights - Daily Security News

A daily look at the relevant information security news from overnight - 14 June, 2022
Episode 244 - 14 June 2022
Linux Root Malware- https://www.bleepingcomputer.com/news/security/new-syslogk-linux-rootkit-uses-magic-packets-to-trigger-backdoor/
Gallium’s PingPull RAT -
https://www.theregister.com/2022/06/14/gallium-pingpull-rat/
Metasploit Upgrades- https://www.bleepingcomputer.com/news/security/metasploit-620-improves-credential-theft-smb-support-features-more/
Reach Out and GhostTouch Someone -
https://portswigger.net/daily-swig/ghosttouch-hackers-can-reach-your-phones-touchscreen-without-even-touching-it
Guzzle Drupal Patch -
https://threatpost.com/bluetooth-signals-track-smartphones/179937/
Hi, I’m Paul Torgersen. It’s Tuesday June 14th, 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com
A new Linux rootkit malware named ‘Syslogk’ can force-load its modules into the Linux kernel, and hide directories and network traffic. It also loads a backdoor called Rekoobe, which lays dormant until specially crafted "magic packets" are used to wake it up. The malware is currently under heavy development.
From TheRegister.com:
The Gallium group, believed to be a Chinese state-sponsored team, has begun using an upgraded remote access trojan called PingPull, that is very difficult to detect. The group is also broadening its scope, adding financial service firms and government agencies to the telecoms companies it usually targets. Their geographic focus continues to be Asia, Southeast Asia, Europe and Africa,
From BleepingComputer.com:
​Metasploit 6.2.0 has been released with 138 new modules, 148 new improvements or features, and 156 bug fixes since version 6.1.0 was released almost a year ago. Great for the pen teasters. Unfortunately, also great for the threat actors that use it as well. Details in the article.
From PortSwigger.net:
Attacks on smartphones require physical access to the device and interactions with the touchscreen. Or at least they used to. According to new research an attack can execute taps and swipes on the phone’s screen from a distance of up to 40 millimeters. The attack, called GhostTouch, uses electromagnetic interference to manipulate the touchscreen and can initiate calls or even download malware.
And last today, from SecurityWeek.com
The Drupal team has released a moderately critical advisory for serious vulnerabilities in the third-party library Guzzle that handles HTTP requests and responses to external services, and can be exploited to remotely hijack Drupal-powered websites. The vulnerabilities do not affect Drupal core, but may affect some contributed projects or custom code on Drupal sites. Details and a link to the advisory in the article.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.