T1574.006 Dynamic Linker Hijacking
Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from environment variables and files, such as LD_PRELOAD
on Linux or DYLD_INSERT_LIBRARIES
on macOS. Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.123 These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions without changing the original library.4
On Linux and macOS, hijacking dynamic linker variables may grant access to the victim process’s memory, system/network resources, and possibly elevated privileges. This method may also evade detection from security products since the execution is masked under a legitimate process. Adversaries can set environment variables via the command line using the export
command, setenv
function, or putenv
function. Adversaries can also leverage Dynamic Linker Hijacking to export variables in a shell or set variables programmatically using higher level syntax such Python’s os.environ
.
On Linux, adversaries may set LD_PRELOAD
to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary’s malicious code upon execution of the victim program. LD_PRELOAD
can be set via the environment variable or /etc/ld.so.preload
file.12 Libraries specified by LD_PRELOAD
are loaded and mapped into memory by dlopen()
and mmap()
respectively.56 78
On macOS this behavior is conceptually the same as on Linux, differing only in how the macOS dynamic libraries (dyld) is implemented at a lower level. Adversaries can set the DYLD_INSERT_LIBRARIES
environment variable to point to malicious libraries containing names of legitimate libraries or functions requested by a victim program.91011
Item | Value |
---|---|
ID | T1574.006 |
Sub-techniques | T1574.001, T1574.002, T1574.004, T1574.005, T1574.006, T1574.007, T1574.008, T1574.009, T1574.010, T1574.011, T1574.012, T1574.013 |
Tactics | TA0003, TA0004, TA0005 |
Platforms | Linux, macOS |
Permissions required | User |
Version | 2.0 |
Created | 13 March 2020 |
Last Modified | 30 March 2023 |
Procedure Examples
ID | Name | Description |
---|---|---|
G0096 | APT41 | APT41 has configured payloads to load via LD_PRELOAD.18 |
S0377 | Ebury | Ebury has injected its dynamic library into descendent processes of sshd via LD_PRELOAD.13 |
S0394 | HiddenWasp | HiddenWasp adds itself as a shared object to the LD_PRELOAD environment variable.14 |
S0601 | Hildegard | Hildegard has modified /etc/ld.so.preload to intercept shared library import functions.16 |
G0106 | Rocke | Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.17 |
S0658 | XCSSET | XCSSET adds malicious file paths to the DYLD_FRAMEWORK_PATH and DYLD_LIBRARY_PATH environment variables to execute malicious code.15 |
Mitigations
ID | Mitigation | Description |
---|---|---|
M1038 | Execution Prevention | Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software. |
M1028 | Operating System Configuration | When System Integrity Protection (SIP) is enabled in macOS, the aforementioned environment variables are ignored when executing protected binaries. Third-party applications can also leverage Apple’s Hardened Runtime, ensuring these environment variables are subject to imposed restrictions.12 Admins can add restrictions to applications by setting the setuid and/or setgid bits, use entitlements, or have a __RESTRICT segment in the Mach-O binary. |
Detection
ID | Data Source | Data Component |
---|---|---|
DS0017 | Command | Command Execution |
DS0022 | File | File Creation |
DS0011 | Module | Module Load |
DS0009 | Process | Process Creation |
References
-
Kerrisk, M. (2020, June 13). Linux Programmer’s Manual. Retrieved June 15, 2020. ↩↩
-
Apple Inc.. (2012, July 23). Overview of Dynamic Libraries. Retrieved March 24, 2021. ↩
-
baeldung. (2020, August 9). What Is the LD_PRELOAD Trick?. Retrieved March 24, 2021. ↩
-
Itamar Turner-Trauring. (2017, April 18). “This will only hurt for a moment”: code injection on Linux and macOS with LD_PRELOAD. Retrieved December 20, 2017. ↩
-
skape. (2003, January 19). Linux x86 run-time process manipulation. Retrieved December 20, 2017. ↩
-
halflife. (1997, September 1). Shared Library Redirection Techniques. Retrieved December 20, 2017. ↩
-
Tim Brown. (2011, June 29). Breaking the links: Exploiting the linker. Retrieved March 29, 2021. ↩
-
Fitzl, C. (2019, July 9). DYLD_INSERT_LIBRARIES DYLIB injection in macOS / OSX. Retrieved March 26, 2020. ↩
-
Timac. (2012, December 18). Simple code injection using DYLD_INSERT_LIBRARIES. Retrieved March 26, 2020. ↩
-
Jon Gabilondo. (2019, September 22). How to Inject Code into Mach-O Apps. Part II.. Retrieved March 24, 2021. ↩
-
Apple Inc.. (2021, January 1). Hardened Runtime: Manage security protections and resource access for your macOS apps.. Retrieved March 24, 2021. ↩
-
Vachon, F. (2017, October 30). Windigo Still not Windigone: An Ebury Update . Retrieved February 10, 2021. ↩
-
Sanmillan, I. (2019, May 29). HiddenWasp Malware Stings Targeted Linux Systems. Retrieved June 24, 2019. ↩
-
Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021. ↩
-
Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021. ↩
-
Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019. ↩
-
Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020. ↩