Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

A big takeaway here is that telemetry is a security threat. If your application is pushing opaque regular traffic out for not adequate reasons you are providing a good cover for malware activity.

Even a fresh Windows install these days has so much regular network activity for telemetry and other services, it's trivial to hide bad behavior.

View on HN

Many detection tools do leverage the fact that if there is spike in NXDOMAIN DNS responses, it could be a malware. However such signals are also exhibited by infra issues. This is sort of analogous to cancer detection. Cancers cells are really good at disguising themselves.

> spike in NXDOMAIN DNS responses

For those following at home, these are caused by Domain Generation Algorithms that try a ton of (deterministically generated) top level domains. The attacker need only register one of them, and if the domain gets frozen they can often just register another -- until the generator algorithm is integrated into the registrars' blocking system, which takes time and work.

Personally I'm surprised we don't see more malware using the various DNS replacements that sit on top of Ethereum. They were using Namecoin for a while.

probably harder to reliably get to Ethereum than to reliably get to any DNS server. for indiscriminately-targeted ransomware Namecoin etc. would make sense, but DNS is a better choice for internal networks.

Also, security conscious companies would flag a connection to Ethereum as suspicious in itself, so your effort to hide yourself could in fact draw more attention.

I know; it really depends on the kind of network the malware is deployed into. If it's some quant trading group on wall street, or the Treasury department, using EDNS for CNC would be outstanding camoflauge. If it's some single-purpose server farm then yeah, of course, stands out like a sore thumb.

What about Tor hidden websites? Or would the fact that the URL is a public key (essentially) prevent deterministic randomness without embedding the private key?

> spike in NXDOMAIN DNS responses

NXDOMAIN is watched because known malware has been observed to use it.

But I tell you: malware can just as easily utilize a valid DNS response.

Domain-generation algorithms work along the lines of: seed a random number generator with the current date. Spit out a handful of domain names, and try contacting each of those a couple times each day. This way, the malware isn't tied down to a specific domain or set of domains; the bot herder just has to register any one of the domains in the current day's set, and if they lose the domain, they can repeat the process the next day.

The downside is that all the bots will generate a lot of DNS traffic checking for those domains. That's what's being detected here -- the NXDOMAIN responses don't carry any desired data, but the malware can't avoid generating them while it's looking for its owner.

Good thing we will have DoH to secure malware from being detected, thanks Mozilla

Network security monitoring and encryption have always been at odds. One day, due to encryption, all that will be left to monitor will be metadata (to, from, date, time, src, dst, bytes, duration, etc.)

It is only a threat if it can be leveraged.

Deeper heuristics on the deviations in that telemetry from normal could also have provided a signal that something was off -- like the temporary file replacement activity.

Without telemetry that kind of activity could likely continue undetected for longer.

Even Ubuntu's pollinate client takes some liberties. See the article at [1] documenting the info it sends to the mothership.

[1] https://news.ycombinator.com/item?id=25346991

It seems you missed an opportunity (BTW, is that what they call "content marketing"?).

Had you left your VM running a little while longer, you might've noticed something else in your Netflow data: yet another service calling home to Canonical twice a day.

I wish I were joking about this but... the (likely) "primary" reason for this is so that they can show ads to users when they log in -- ads for things like TV shows or software for other operating systems or, sometimes, just a "fun fact".

I can't really say it's the only reason, however. With all of the system information they're getting off of each host, there's now several different things they can use it for and, of course, that provides them with even more motivation to keep doing it!

This isn't a new thing, though. In fact, people have been expressing their "unhappiness" about it to Canonical for a few years now [0,1,2].

Unfortunately:

- it's still installed by default

- it's still enabled by default

- they've actually increased the amount of system info that they're collecting [3]

- it's installed as part of the "base-files" package -- an "essential" package which cannot be removed!

- "it's a 'feature', not a bug" (so we absolutely should not expect it to get removed)

- apparently, a 42 line MOTD [4] is perfectly acceptable

I suppose there's one "positive" thing I can say about it: at least they're using TLS to encrypt the data over the wire. :/

If you want to disable this spyware on your Ubuntu hosts, change "ENABLED" to "0" in /etc/default/motd-news:

  $ sudo sed -i -e '/^ENABLED=1$/s/1/0/' /etc/default/motd-news

When executed, /etc/update-motd.d/50-motd-news checks if "ENABLED" is set to "1". If not, it exits without calling home.

50-motd-news gets launched by motd-news.service which itself is activated -- twice per day -- by motd-news.timer. Since I like to be thorough, I recommend running a few more commands (as it's impossible to know that Canonical won't change any of this in the future!):

  $ sudo systemctl mask --now motd-news.service
  $ sudo systemctl mask --now motd-news.timer
  $ sudo systemctl clean --what=state motd-news.timer
  $ sudo rm -f /var/cache/motd-news

That should do it. If you're rather not have to worry about something like this in the future, you may want to consider replacing Ubuntu Linux with Debian GNU/Linux.

[0]: https://news.ycombinator.com/item?id=14662088

[1]: https://old.reddit.com/r/linux/comments/98ctgu/ubuntu_server...

[2]: https://dev.to/fivnex/open-letter-to-canonical-ltd-a1k

[3]: https://bugs.launchpad.net/ubuntu/+source/base-files/+bug/18...

[4]: https://joe.schafer.dev/chatty-ubuntu-motd/

Thanks for the thorough post! I'm currently switching to debian but I have a few long-running cloud VMs still on Ubuntu. I'm finally gonna neuter the MOTD ads.

Reply on news.ycombinator.com