SUID root shell backdoor: /bin/sh copied to /usr/bin/dbus-authd (ARMORY CASTLE)

Arnold Chan@slaz

•updated 3 days ago•1•0•1

Detects a sequence of events on a single device where a shell (/bin/sh, /bin/bash, etc.) is copied to a path involving /usr/bin/dbus-authd using cp or busybox, followed by changing ownership to root, and subsequently setting the SUID permission bit within a 10-minute window.