this post was submitted on 19 Sep 2023
106 points (92.7% liked)

Technology

59472 readers
5324 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago
MODERATORS
L3s@lemmy.world
L3s@fry.gs
L4s@fry.gs
L4s@lemmy.world
enu@lemmy.world
106
Chinese hackers have unleashed a never-before-seen Linux backdoor (arstechnica.com)
submitted 1 year ago by L4s@lemmy.world to c/technology@lemmy.world
18 comments fedilink hide all child comments
 

Chinese hackers have unleashed a never-before-seen Linux backdoor::SprySOCKS borrows from open source Windows malware and adds new tricks.

you are viewing a single comment's thread
view the rest of the comments
[–] photonic_sorcerer@lemmy.dbzer0.com 24 points 1 year ago* (last edited 1 year ago)

SprySOCKS Capabilities:

   ID	     NOTES
  • 0x09 Gets machine information
  • 0x0a Starts interactive shell
  • 0x0b Writes data to interactive shell
  • 0x0d Stops interactive shell
  • 0x0e Lists network connections (parameters: “ip”, “port”, “commName”, “connectType”)
  • 0x0f Sends packet (parameter: “target”)
  • 0x14, 0x19 Sends initialization packet
  • 0x16 Generates and sets clientid
  • 0x17 Lists network connections (parameters: “tcp_port”, “udp_port”, “http_port”, “listen_type”, “listen_port”)
  • 0x23 Creates SOCKS proxy
  • 0x24 Terminates SOCKS proxy
  • 0x25 Forwards SOCKS proxy data
  • 0x2a Uploads file (parameters: “transfer_id”, “size”)