Curated Tumblr

3898 readers

15 users here now

For preserving the least toxic and most culturally relevant Tumblr heritage posts.

Image descriptions and plain text captions of written content are expected of all screenshots. Here are some image text extractors (I looked these up quick and will gladly take FOSS recommendations):

-web

-iOS

-android

Please begin copied raw text posts (lacking a screenshot that makes it apparent it is from Tumblr) with:

# This has been reposted here to Lemmy as part of the "Curated Tumblr Project."

I made the icon using multiple creative commons svg resources, the banner is this.

founded 1 year ago

MODERATORS

[email protected]

697

Did you sleep well? (lemmy.world)

submitted 2 months ago by [email protected] to c/[email protected]

34 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 2 months ago* (last edited 2 months ago) (1 children)

Undetectable unless infosec really knows what they're doing:

#!/bin/bash

## do random mouse movement with random sleep
( while :; do
    sleep ${RANDOM:1:1};   ## single digit sleep, double digit movement
    xdotool mousemove ${RANDOM:2:2} ${RANDOM:2:2}
) &

# obscure the process with another
pid=$!
mount -B /proc/${pid}/fd /proc/123/fd

[–] [email protected] 4 points 2 months ago (1 children)

I think if anything any command with pid (literally the word) will match a heuristic triggering an alert in EDR because disguising processor pid or manipulating pids in any way in bash doesn't have a lot of legitimate uses, similar to 'whoami' which just immediately alerts if run regardless of context because statistically it's a classic initial foothold step.

This will in fact alert security regardless of skill level. And most sec folks won't get this or understand what it means because tons and tons of people in the industry are just straight up non-technical, and those who are slightly technical will either:

Trust tools more
Disagree with the tool but defer to it to cover their ass

They might outsource this to IT, at which point you have an entire company up with IDR process activated in the dead of night.

You have to think a bit differently. You're not outsmarting hypothetical feds who are browsing your PC via a remote shell like it's an HtB CTF.

The point isn't to hide because hiding on a fully compromised machine is impossible, and outsmarting millions of dollars of R&D is too much of a long shot, the point is to do it in plain sight in a way no one can tell the difference between the legitimate and illegitimate.

An Arduino Leonardo will do the trick. A flipper zero, a phone app that lets you use it as a badusb to shake the mouse. You get the picture.

People use USB and Bluetooth mice all the time. You're just people. If someone says something, you say you just have a faulty mouse and stop.

[–] [email protected] 2 points 2 months ago (1 children)

If keywords are a trigger, then one could run the whole script through a bash obfuscator. I hear you though, I just think testing for hardware trickery would be easier to detect than software trickery. Running lsusb would give you the device id which could be mapped back to the product page.

[–] [email protected] 2 points 2 months ago* (last edited 2 months ago)

Or you can just base64 encode/decode it. But that too is a common technique of obfuscation and I would be impressed and surprised if it didn't also trigger an alert

Running lsusb

But that's the thing. Nobody is going to be remoting into your machine and running lsusb on your computer without significant cause. If you're that paranoid you can change the VID and PID and name ez pz.