Full Report
Learn how attackers exploit Pluggable Authentication Modules (PAM) for credential harvesting—and discover defenses to harden Linux authentication.
Analysis Summary
# Tool/Technique: PAM Credential Harvesting & Backdooring
## Overview
Pluggable Authentication Modules (PAM) is a flexible framework used in Unix-like systems to authenticate users. Because PAM decouples authentication logic from applications (like SSH, FTP, or local login), it processes credentials in plaintext before they are hashed. Attackers exploit this by modifying or replacing legitimate PAM modules (specifically `pam_unix.so`) to intercept plaintext credentials or establish persistent backdoors via hardcoded "master passwords."
## Technical Details
- **Type:** Technique / Malware (Backdoored Library)
- **Platform:** Linux, Solaris, and other Unix-like systems.
- **Capabilities:** Credential logging, authentication bypass (backdoor), exfiltration, and lateral movement.
- **First Seen:** Historically used for decades; recently highlighted in campaigns by advanced persistent threat (APT) groups like UNC2891 and UNC1945.
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- [T1556 - Modify Authentication Process]
- [T1556.003 - Modify Authentication Process: Pluggable Authentication Modules]
- **[TA0003 - Persistence]**
- [T1543 - Create or Modify System Process]
- **[TA0008 - Lateral Movement]**
- [T1021.004 - Remote Services: SSH]
## Functionality
### Core Capabilities
- **Plaintext Interception:** By modifying the source code of `pam_unix_auth.c`, attackers can capture the `user` and `pass` variables in plaintext during the authentication handshake.
- **Credential Logging:** Harvester modules are configured to write captured usernames and passwords to local files (e.g., hidden files or masqueraded logs like `/var/log/secure`).
- **Authentication Bypass:** Attackers can insert a "magic password" or hardcoded hash into the module's logic. If this specific password is provided, the module returns a success status regardless of the actual user's password, granting the attacker access to any account.
### Advanced Features
- **Remote Exfiltration:** Highly sophisticated variants can be programmed to transmit captured credentials to an attacker-controlled C2 server via network sockets.
- **Stealth Integration:** The modified modules are recompiled and replace the legitimate `pam_unix.so` library, making the malicious activity appear as a standard system function.
## Indicators of Compromise
- **File Hashes:** Comparison of `sha256sum /lib/security/pam_unix.so` (or equivalent path) against a known-clean baseline from the distribution's package manager.
- **File Names:**
- `/lib/security/pam_unix.so` (Modified)
- `/usr/lib64/security/pam_unix.so` (Modified)
- **Network Indicators:** Unexpected outbound connections from processes performing authentication (e.g., `sshd` or `login` connecting to external IPs).
- **Behavioral Indicators:**
- Unauthorized modifications to files in `/etc/pam.d/`.
- Presence of hidden credential log files (e.g., `.tomb`, `.log`, or unusual entries in `/var/log/`).
- Unusual `mtime` (modification time) on system library files.
## Associated Threat Actors
- **UNC1945:** Known for targeting Solaris environments using modified PAM modules for lateral movement.
- **UNC2891:** Known for deploying PAM backdoors on Linux and Solaris to maintain long-term persistence in telecommunications and financial sectors.
## Detection Methods
- **Signature-based detection:** Using YARA to scan for hardcoded "magic passwords" or logging strings within shared object (.so) files.
- **Behavioral detection:** Monitoring for `write()` system calls by `pam_unix.so` to unauthorized file paths.
- **Integrity Checking:** Using `rpm -V` (RedHat) or `debsums` (Debian) to verify the integrity of the `libpam` or `pam` packages.
- **Auditd:** Configure Linux Audit Daemon to monitor changes to the `/lib/security/` directory and `/etc/pam.d/` configuration files.
## Mitigation Strategies
- **File Integrity Monitoring (FIM):** Implement tools like Tripwire or AIDE to alert on any changes to critical system libraries.
- **Hardening:** Use `noexec` mounts for directories where possible, though this is difficult for `/lib/`.
- **Centralized Logging:** Ship logs to a remote, read-only SIEM to prevent attackers from tampering with the evidence of their login or the logged credentials.
- **Strong SSH Policy:** Enforce Public Key Authentication and disable password-based authentication to render PAM-based password harvesting less effective.
- **Encryption:** Ensure private keys are encrypted at rest to prevent further lateral movement if a system is compromised.
## Related Tools/Techniques
- **SSH Backdoors:** Modifying `sshd` binaries directly (similar outcome, different target).
- **LKM Rootkits:** Loadable Kernel Modules that hook system calls to hide the modified PAM modules.
- **Mimikatz (Linux equivalent):** Tools like `mimipenguin` which seek to harvest credentials from memory.