BPFDoor
BPFDoor is a Linux based passive long-term backdoor used by China-based threat actors. First seen in 2021, BPFDoor is named after its usage of Berkley Packet Filter (BPF) to execute single task instructions. BPFDoor supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP and can start local or reverse shells that bypass firewalls using iptables.[1][2]
Associated Software Descriptions
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1059 | .004 | Command and Scripting Interpreter: Unix Shell |
BPFDoor can create a reverse shell and supports vt100 emulator formatting.[1] |
| Enterprise | T1480 | Execution Guardrails |
BPFDoor creates a zero byte PID file at |
|
| Enterprise | T1564 | .011 | Hide Artifacts: Ignore Process Interrupts |
BPFDoor set's it's process to ignore the following signals; |
| Enterprise | T1562 | .003 | Impair Defenses: Impair Command History Logging |
BPFDoor sets the |
| .004 | Impair Defenses: Disable or Modify System Firewall |
BPFDoor starts a shell on a high TCP port starting at 42391 up to 43391, then changes the local |
||
| Enterprise | T1070 | Indicator Removal |
BPFDoor clears the file location |
|
| .004 | File Deletion |
After initial setup, BPFDoor's original execution process deletes the dropped binary and exits.[1] |
||
| .006 | Timestomp |
BPFDoor uses the |
||
| Enterprise | T1036 | .004 | Masquerading: Masquerade Task or Service |
BPFDoor overwrites the |
| .009 | Masquerading: Break Process Trees |
After initial execution, BPFDoor forks itself and runs the fork with the |
||
| Enterprise | T1027 | Obfuscated Files or Information |
BPFDoor can require a password to activate the backdoor and uses RC4 encryption or static library encryption |
|
| Enterprise | T1205 | .002 | Traffic Signaling: Socket Filters |
BPFDoor uses BPF bytecode to attach a filter to a network socket to view ICMP, UDP, or TCP packets coming through ports 22 (ssh), 80 (http), and 443 (https). When BPFDoor finds a packet containing its "magic" bytes, it parses out two fields and forks itself. The parent process continues to monitor filtered traffic while the child process executes the instructions from the parsed fields.[1][2] |