Malware.View on attack.mitre.org
BPFDoor is a Linux based passive long-term backdoor used by China-based threat actors. First seen in 2021, BPFDoor is named after its usage of Berkley Packet Filter (BPF) to execute single task instructions. BPFDoor supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP and can start local or reverse shells that bypass firewalls using iptables.
| Technique | Procedure example |
|---|---|
| T1027 Obfuscated Files or Information |
BPFDoor can require a password to activate the backdoor and uses RC4 encryption or static library encryption `libtomcrypt`. |
| T1036.009 Break Process Trees |
After initial execution, BPFDoor forks itself and runs the fork with the `--init` flag, which allows it to execute secondary clean up operations. The parent process terminates leaving the forked process to be inherited by the legitimate process init. |
| T1036.011 Overwrite Process Arguments |
BPFDoor overwrites the `argv[0]` value used by the Linux `/proc` filesystem to determine the command line and command name to display for each process. BPFDoor selects a name from 10 hardcoded names that resemble Linux system daemons, such as; `/sbin/udevd -d`, `dbus-daemon --system`, `avahi-daemon: chroot helper`, `/sbin/auditd -n`, and `/usr/lib/systemd/systemd-journald`. |
| T1059.004 Unix Shell |
BPFDoor can create a reverse shell and supports vt100 emulator formatting. |
| T1070 Indicator Removal |
BPFDoor clears the file location `/proc/<PID>/environ` removing all environment variables for the process. |
| T1070.004 File Deletion |
After initial setup, BPFDoor's original execution process deletes the dropped binary and exits. |
| T1070.006 Timestomp |
BPFDoor uses the `utimes()` function to change the executable's timestamp. |
| T1205.002 Socket Filters |
BPFDoor uses BPF bytecode to attach a filter to a network socket to view ICMP, UDP, or TCP packets coming through ports 22 (ssh), 80 (http), and 443 (https). When BPFDoor finds a packet containing its “magic” bytes, it parses out two fields and forks itself. The parent process continues to monitor filtered traffic while the child process executes the instructions from the parsed fields. |
| T1480 Execution Guardrails |
BPFDoor creates a zero byte PID file at `/var/run/haldrund.pid`. BPFDoor uses this file to determine if it is already running on a system to ensure only one instance is executing at a time. |
| T1480.002 Mutual Exclusion |
When executed, BPFDoor attempts to create and lock a runtime file, `/var/run/initd.lock`, and exits if it fails using the specified file, resulting in a makeshift mutex. |
| T1564.011 Ignore Process Interrupts |
BPFDoor sets its process to ignore the following signals; `SIGHUP`, `SIGINT`, `SIGQUIT`, `SIGPIPE`, `SIGCHLD`, `SIGTTIN`, and `SIGTTOU`. |
| T1686 Disable or Modify System Firewall |
BPFDoor starts a shell on a high TCP port starting at 42391 up to 43391, then changes the local `iptables` rules to redirect all packets from the attacker to the shell port. |
| T1690 Prevent Command History Logging |
BPFDoor sets the `MYSQL_HISTFILE` and `HISTFILE` to `/dev/null` preventing the shell and MySQL from logging history in `/proc/<PID>/environ`. |
None recorded.
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
