Hunting payloads in Linux extended file attributes

Shabier Mer demonstrates how Linux extended file attributes (xattrs) can be abused to hide malware payloads and provides detection strategies for defenders 0:00.

Key Takeaways:
• Extended file attributes are key-value pairs in Linux filesystems that can store arbitrary data, functioning similarly to Windows Alternate Data Streams and creating a potential attack surface 0:00.
• Mer's proof-of-concept splits an XOR and base64-encoded reverse shell payload across multiple files' xattrs, demonstrating how attackers can store malicious code without creating suspicious files 0:23.
• Detection approaches include getfattr for recursive scanning, auditd with custom rules to monitor xattr activity, and custom tools that identify suspicious binary content within attributes 0:45.

Defenders should restrict file write permissions, implement SELinux controls, and verify how backup systems handle extended attributes to mitigate this hiding technique.

Sources:

• 0:00 Introduction of Shabier Mer and overview of Linux extended file attributes.
• 0:23 Demonstration of payload splitting and encoding within xattrs.
• 0:45 Detection tools and mitigation strategies for xattr-based attacks.