Attack via xattr: how malware hides in Linux

Attacks using NTFS streams in Windows have long been a classic. In Linux environments, extended attributes (xattr) are mentioned less often, although the idea is similar: thanks to this feature, an attacker can hide malicious code in a completely legitimate and trusted file, which helps bypass detections by security solutions. The technique is not new, but it still works because Linux EDRs rarely look into this area.

The essence of the attack:

Extended attributes allow you to attach a “key-value” pair to any file. The value size can up to 64 KB. Importantly, this feature is supported in all major file systems. Any file can be used as a carrier, for example, .bash_history. The algorithm is as follows:

— a regular reverse shell is created (for example, using msfvenom),

— the resulting shellcode is stored in the user.ATTRIBUTE attribute of the .bash_history file, this can be done with the following command:

setfattr --name=user.ATTRIBUTE --value="$buf" .bash_history

— a loader written in C is also needed; it will read this attribute using the getxattr function and transfer control to the retrieved byte array,

— all that remains is to deliver the files to the target host and run the loader.

In practice, the payload can be anything: a back-connect, crontab modification, persistence through systemd timers - anything that fits in a line.

However, the technique has its limitations: most utilities do not preserve xattr by default. To solve this problem, i.e., to deliver a file with a payload stored in an extended attribute to the victim host, an attacker can use:

• tar with the --xattrs argument
• rsync with the -X or --xattrs argument

How to catch the attack:

To detect attempts to hide payloads in extended file attributes, monitor system calls for getxattr/setxattr and analyze their contents. The simplest auditd rules may look like this:

-a always,exit -F arch=b64 -S getxattr -k xattr_read
-a always,exit -F arch=b64 -S setxattr -k xattr_write

Additionally, considering the above-mentioned limitations of this technique, you can also monitor the execution of tar and rsync utilities with the corresponding command-line arguments responsible for preserving extended attributes.