Listen to this Post
Introduction:
A compromised Linux server with persistent SSH access—undetected by logs, OS updates, or EDR solutions—is a nightmare scenario for cybersecurity teams. Attackers leveraging advanced techniques can maintain backdoor access even after security patches and credential rotations. This article explores how such attacks occur and provides actionable detection and mitigation steps.
Learning Objectives:
- Understand how attackers bypass logging and EDR solutions.
- Learn to detect stealthy SSH backdoors using THOR and THOR Lite.
- Implement hardening measures to prevent persistent access.
1. Detecting Hidden SSH Backdoors with THOR
Command:
sudo thor-lite --allhds --noprocscan --logfile /var/log/thor_scan.log
What It Does:
THOR Lite is a free version of the THOR malware scanner, designed to detect signs of compromise (IoCs) on Linux systems. This command scans all mounted disks (--allhds) while skipping process scanning (--noprocscan) and logs results to /var/log/thor_scan.log.
Steps:
- Download THOR Lite from Nextron Systems.
2. Run the scan with elevated privileges.
- Review the log for suspicious files, unauthorized keys, or modified binaries.
2. Checking for Unauthorized SSH Keys
Command:
grep -r "ssh-rsa" /home/ /root/.ssh/ /var/empty/
What It Does:
This command searches for SSH keys in common directories where attackers may stash backdoor keys.
Steps:
- Run the command to list all RSA keys.
2. Cross-check with authorized keys in `/home//.ssh/authorized_keys`.
3. Remove any unrecognized keys.
3. Auditing SSH Logs for Anomalies
Command:
journalctl -u sshd --since "1 day ago" | grep "Failed password|Accepted"
What It Does:
This checks SSH logs for failed and successful login attempts, helping identify brute-force attacks or unauthorized access.
Steps:
- Review the output for unusual IPs or repeated failed attempts.
2. Block suspicious IPs using `iptables` or `ufw`.
4. Hunting for Rootkit-Modified Binaries
Command:
rpm -Va | grep '^..5'
What It Does:
Checks for modified binaries by comparing checksums (RPM-based systems). Files with altered hashes may indicate rootkit tampering.
Steps:
1. Investigate flagged binaries.
2. Reinstall affected packages (`dnf reinstall `).
5. Disabling SSH Root Login
Command:
sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
What It Does:
Prevents direct root logins via SSH, reducing attack surface.
Steps:
1. Edit `/etc/ssh/sshd_config`.
2. Restart SSH: `systemctl restart sshd`.
6. Enforcing Fail2Ban for SSH Protection
Command:
sudo apt install fail2ban && sudo systemctl enable --now fail2ban
What It Does:
Automatically blocks IPs after repeated failed SSH attempts.
Steps:
1. Install Fail2Ban.
2. Configure `/etc/fail2ban/jail.local` for stricter rules.
7. Monitoring Open Ports & Processes
Command:
ss -tulnp | grep -E '22|ssh'
What It Does:
Lists active SSH connections and listening ports.
Steps:
1. Check for unexpected listeners.
2. Kill suspicious processes (`kill -9 `).
What Undercode Say:
- Key Takeaway 1: Attackers can maintain persistence via hidden SSH keys, modified binaries, or kernel-level rootkits.
- Key Takeaway 2: Proactive scanning with THOR, log auditing, and SSH hardening are critical for detection.
Analysis:
Stealthy SSH attacks exploit weak configurations and logging gaps. Organizations must adopt layered defenses, including file integrity monitoring (FIM), EDR solutions, and strict SSH policies.
Prediction:
As attackers refine evasion techniques, AI-driven anomaly detection and zero-trust SSH models will become essential. Future breaches may leverage AI-generated keys, making manual audits insufficient. Preemptive hardening and automated threat hunting will define next-gen server security.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Pierre Henri – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
