#daemontools — Public Fediverse posts

RE: https://infosec.exchange/@j91321/116538743903081567

Seen some people online speculating whether #DAEMONTools and #JDownloader were compromised by the same adversary. I guess because people associate both of these tools with piracy?

I would be surprised if this was the case. The DAEMONTools compromise had very competent tradecraft. There was proper enumeration, targeting with different minimalistic payloads. I've seen some of the hands-on activity from mcrypto.chiper payload. It was mostly living-off-the-land. Low noise enumeration, then louder attempts at credential dumping. Skedaddled when they noticed EDR.

JDownloader so far seem like pack a bunch of Python scripts, drop TOR and YOLO.

#DaemonTools: Mit #Malware verseuchte Downloads | Security https://www.heise.de/news/Daemon-Tools-Lite-Infizierte-Installer-durch-Supply-Chain-Attacke-11282006.html #SupplyChain

Headline: DAEMON TOOLS supply chain attack ongoing since April, thousands affected

Subtitle: Security researchers have identified an active supply chain compromise in #DAEMONTools installers impacting users globally since April 2026.

Source: https://www.neowin.net/news/daemon-tools-supply-chain-attack-ongoing-since-april-thousands-affected/

#Security

DAEMON Tools Lite wurde gehackt: Seit Anfang April verteilte die offizielle Website eine mit Trojanern infizierte Version. Betroffen sind Build 12.5.0.2421 bis 12.5.0.2434. #DAEMONTools #Malware https://winfuture.de/news,158542.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia

01net.com: #Cyberattaque #chinoise en cours sur le logiciel populaire #DaemonTools de #Windows : ce logiciel populaire a été #piraté, des milliers d' #ordinateurs #compromis

#pirate #hacker #cybersécurité #IPSec #blueteam #redteam

https://www.01net.com/actualites/cyberattaque-chinoise-cours-windows-logiciel-populaire-pirate-milliers-ordinateurs-compromis.html

Since I was visiting the 'daemontools' account on #GitHub, I took a look at what the people who mistakenly thought that it was someone actually involved, have done.

Not much, fortunately.

One wheel reinvention that didn't even look at Bruce Guenter's daemontools-encore.

Only one thing worth following up on, in 13 years:

https://github.com/daemontools/daemontools/issues/8

The bugfix will be in #djbwares version 13 when it comes out. As noted, neither @ska's nor my #nosh reimplementations have this bug.

#daemontools

For the record, and since we are on the subject of supply-chain attacks:

The person behind the 'daemontools' account on GitHub is unidentifiable, and certainly isn't Daniel J. Bernstein, me, @ska, Bruce Guenter, or anyone else well-known in the #daemontools world.

The account has been inactive since 2013. If that account suddenly wakes up, it's not unreasonable to suspect that it has been compromised/become malicious.

(M. Guenter is bruceg on #GitHub and is active there to this week.)

@arstechnica @dangoodin

Not to be confused with #daemontools, a different (and older) piece of software entirely that is approaching 30 years old, still going, and probably really hard to perform a supply chain attack on.

http://jdebp.info/FGA/daemontools-family.html
#djbwares

Widely used #DaemonTools disk app #backdoored in month long supply-chain attack

Daemon Tools, a widely used app for mounting disk images, has been backdoored in a monthlong compromise that has pushed #malicious updates from the servers of its developer, researchers said Tuesday.
#security #supplychain

https://arstechnica.com/security/2026/05/widely-used-daemon-tools-disk-app-backdoored-in-monthlong-supply-chain-attack/

DAEMON Tools software infected – supply chain attack ongoing since April 8, 2026
#DAEMONTools
https://securelist.com/tr/daemon-tools-backdoor/119654/

@peteorrall @glitzersachen @rl_dane I do like the bit of systemd that tries to auto-restart failed services, detects repeated failures and so on. That little bit is like #daemontools, only written a lot less carefully.

@joel

A very quick précis is that it's a set of software tools that I'm close to releasing version 1.41 of, after a *long* hiatus involving a worldwide pandemic, broken disc drives, crushed PSUs, and some fairly eventful other stuff.

http://jdebp.info/Softwares/nosh/

They do system management, service management, user-space virtual terminals directly on display/HID hardware, and some login session stuff.

For an #Illumos analogy, think the SMF, plus SAC, plus ttymon. But done the #daemontools way.

@fazalmajid @cstross

There are some updated versions of daemontools. I did a consolidated one that addressed some bugs and added the manual pages without making fundamental changes.

http://jdebp.info/Softwares/djbwares/

Bruce Guenter's daemontools-encore changed the fundamentals slightly. Its control/status API is compatible with Bernstein's original, and with nosh.

http://jdebp.info/FGA/daemontools-family.html

#daemontools #nosh

#TFW a small utility script you write to scratch an itch grows into a client-server asynchronous service provider with queuing, process management, proper #daemontools/#s6 integration, credential verification, ..., ..., ...

#script #itch #scratch #Python #software #evolve

Also see:
https://judecnelson.blogspot.com/2014/09/systemd-biggest-fallacies.html

#systemd #s6 #daemontools #runit

@mattl @AndyScott

#s6 is a service management system from @ska that is in the Bernstein #daemontools family.

#runit is a similar but less rounded out system from Gerrit Pape in the same family that is unfortunately not well maintained.

http://jdebp.uk/FGA/daemontools-family.html

In today's news, a long-known and long-solved problem bites users around the world yet again.

#ASUS routers are still, in 2023, using the old "newsyslog" log rotation mechanism from the 20th century, that was replaced by vastly better ones in the 1990s. ASUS's malware checker went mad and started logging the same message over and over really fast. This filled up the tmpfs holding the log files and broke the routers.

* https://news.ycombinator.com/item?id=35983866

#s6 #cyclog #multilog #daemontools @ska

@charadon @RL_Dane

van Smoorenburg #rc was never the thing to compare to. They realized this in the big Debian Hoo-Hah over systemd in ~2014, and almost everyone ruled it out as a reasonable option.

Mewburn rc pre-dated systemd by about a decade and a comparison to it would have ruined the whole "but-but-but look at the long shell scripts!" argument.

So too did comparison to the #daemontools family:

http://jdebp.info/FGA/run-scripts-and-service-units-side-by-side.html

#s6 #nosh #runit

@RL_Dane @charadon

Mewburn rc still uses PID files, a mechanism that people knew to be broken back in the middle 1980s. daemontools-family systems like runit do not.

There's no universal agreement on what a "service" is as opposed to a dæmon. But the concrete differences between the systems start with PID files, and continue with chain loading, logging, and composition.

http://jdebp.info/FGA/unix-daemon-design-mistakes-to-avoid.html#DoNotCreatePIDFiles

http://jdebp.info/FGA/daemontools-family.html

#runit #s6 #daemontools #nosh

@charadon

Is it your first encounter with a daemontools-family system?

#runit #s6 #daemontools

@senzilla Yes, one of the fundamental differences with such tools is that there is no language compiler or language interpreter involved. There's not even syntax analysis, just lexing. There aren't even keywords.

http://jdebp.info/Softwares/nosh/guide/commands/nosh.xml

Yet with a toolset with a decent range, one can arrange doing a lot of system tasks.

#nosh #daemontools

All diese Tools stammen mehr oder weniger von den #daemontools von #djb ab.

Ich persönlich konnte mich mit djb Software noch nie so richtig anfreunden.

Auch das Daemon Supervising Prinzip kann ich nicht ganz nachvollziehen. Wenn ein Daemon stirbt hat das einen Grund, und dafür hat man Monitoring.

Daemons vom Supervisor einfach immer wieder neu starten zu lassen finde ich falsch.