New Whitepaper: BPFDoor Variants Hide in Plain Sight

Summary

Rapid7 Labs identified seven new BPFDoor variants abusing kernel-level Berkeley Packet Filters to maintain stealthy backdoor access in telecom environments. The new families, httpShell and icmpShell, use stateless ICMP and HTTP tunneling with “magic” packet formats and concealed IP fields to establish command-and-control with minimal observable footprint. The report explains how the implants aim to stay nearly invisible through process masquerading, file-descriptor cleanup, timestomping, and encrypted ICMP communications.

Investigation

Researchers analyzed nearly 300 samples and extracted new BPF bytecode traits, fresh “magic byte” markers, and variant-specific process names such as hpasmlited and cmathreshd. Lab validation in Docker reproduced ICMP-driven PTY tunneling, RC4-encrypted payload exchange, and a routing behavior where a –1 flag returns traffic back to the packet’s source address. The team also uncovered supporting infrastructure, including domains posing as NTP-over-SSL services used to blend staging and control traffic.

Mitigation

Prioritize telemetry that exposes kernel-adjacent abuse: monitor AF_PACKET socket creation, detect BPF filter attachment, and hunt for protocol anomalies tied to these variants, including ICMP sequence 1234 and an invalid ICMP code 1. Alert on suspicious daemons with missing executable paths, spoofed service names, or runtime characteristics inconsistent with legitimate system processes. Rapid7 recommends running the rapid7_bpfdoor_check.sh triage script and updating YARA/Suricata detections with the newly documented magic-byte signatures.

Response

If indicators are found, isolate the system, stop the suspected implant process, and block the associated domains and IP ranges. Capture memory and disk artifacts to preserve BPF state and runtime evidence, then use rapid7_bpfdoor_check.sh to identify active BPF filters and related zero-byte mutex artifacts. Finally, refresh detections with the published signatures and continue monitoring for reappearance of the same packet markers, process names, and filter-attachment behaviors.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Attack Narrative & Commands

1. Create a malicious Bash script in the rarely‑monitored path /var/run/user/0.
2. Make the script executable and then delete the file while keeping it open, resulting in a deleted inode that the kernel logs as part of the command line when the process continues to run.
3. Execute the dangling file descriptor, causing the process to run from a deleted inode and generating the exact telemetry the Sigma rule looks for.
4. Verify that the process command line in audit logs contains the string “deleted inode”, satisfying selection3.
5. Avoid the excluded masquerading strings (hpasmlited, cmathreshd) to ensure the rule fires.

Regression Test Script

#!/usr/bin/env bash
# -------------------------------------------------
# BPFDoor‑style execution-from‑deleted‑inode test
# -------------------------------------------------

# 1. Prepare a malicious (harmless) payload
PAYLOAD="/var/run/user/0/malicious.sh"
echo -e "#!/usr/bin/env bashnsleep 60" > "$PAYLOAD"
chmod +x "$PAYLOAD"

# 2. Open the file descriptor (keep the file open)
exec 3<"$PAYLOAD"

# 3. Delete the file from the filesystem – inode remains open via FD 3
rm -f "$PAYLOAD"

# 4. Execute the script via its dangling file descriptor.
#    The /proc/self/fd/3 symlink points to the now‑deleted inode.
bash /proc/self/fd/3 &

# 5. Give the process a moment to start and be logged
sleep 5

# 6. Clean up: close the file descriptor
exec 3<&-
echo "Simulation completed – check SIEM for alerts."

Cleanup Commands

#!/usr/bin/env bash
# -------------------------------------------------
# Cleanup after BPFDoor simulation
# -------------------------------------------------

# Kill any lingering sleep processes started by the script
pkill -f "sleep 60"

# Ensure no leftover files in the target directory
rm -f /var/run/user/0/malicious.sh

echo "Cleanup finished."

End of Report