Home 零对冲(ZeroHedge)每日HackerNews

MakuluLinux (640万下载) 携带开发者自己的C2持久后门。
MakuluLinux (6.4M Downloads) Ships Persistent Backdoor from Developer's Own C2

原始链接: https://werai.ca/security-disclosure.html

## MakuluLinux 后门：严重安全漏洞 MakuluLinux 操作系统中发现了一个严重漏洞。该操作系统的安装程序包含一个后门——`check.bin` 二进制文件，它会建立与开发者 Jacque Montague Raymer 拥有的命令和控制服务器 (217.77.8.210:2006) 的持久、未加密的 TCP 连接。这*不是*第三方入侵，而是操作系统本身故意包含的。 该后门伪装成“系统健康检查”，允许远程控制并促成一种令人担忧的商业模式。MakuluLinux 不仅仅是一个操作系统，更是一个用于提供集中式“即服务 AI”平台的工具。其 40 多个 AI 功能是精简的 GUI，通过 Raymer 的服务器代理请求，使他成为未公开的中介。 进一步的安全缺陷包括不安全的 HTTP 更新，没有代码签名，允许以 root 权限执行任意代码。该系统还会通过其 AI 工具收集用户数据，包括地理位置。研究人员强烈建议用户立即终止后门进程，删除相关文件，阻止 C2 服务器，并迁移到受信任的 Linux 发行版。此事件凸显了信任操作系统供应商的风险以及对健全安全治理的需求。

## MakuluLinux发行版被发现存在后门 一个名为MakuluLinux的全新Linux发行版被发现包含与开发者命令控制服务器相关的持久后门。安全研究员Steven Stobo (WeRAI/Haven AI) 发现了这个问题，引发了对不太知名的发行版的信任担忧。 这一发现引发了Hacker News上的讨论，用户强调了使用Debian、Fedora或Arch等成熟发行版之外的发行版的风险。人们对MakuluLinux的GitHub上缺乏源代码以及大型ISO文件大小表示担忧。 一些人推测该后门可能是一个拙劣实现的更新检查，而另一些人则认为它是OS设计用于提供的更大规模的集中式AI即服务平台的一部分。这一事件凸显了AI驱动的安全测试日益重要，以及操作系统流程中对可信权威的需求。
相关文章
原文
← Back to WeRAI

Severity: CRITICAL  |  Disclosure Date: January 28, 2026  |  Discovered by Steven Stobo (WeRAI / Haven AI)

The MakuluLinux operating system installs a binary that establishes a persistent connection to a command-and-control server owned by the developer. This is not a third-party compromise. The backdoor is embedded in the OS installer itself.

The Evidence Chain

1

install-script.bin (the OS installer) copies /usr/share/MakuluSetup/files/check.bin to /usr/bin/check.bin

↓

2

Creates autostart entry disguised as "System Health Check" with 30-second delay

↓

3

check.bin (9.5MB stripped ELF) establishes persistent TCP connection to 217.77.8.210:2006

↓

4

That IP resolves to makulu.online — the developer's own domain

↓

5

Installer error handling: "One or more critical final file operations (startup/check.bin) failed" — it's a critical install component

Infrastructure

AssetIPHostingRegistrant
C2 Server217.77.8.210:2006Contabo GmbH, DEGermany
makulu.online217.77.8.210Contabo GmbHDa Nang, Vietnam
makululinux.eu207.180.233.66Contabo GmbHRedacted
makululinux.com64.20.42.243Trouble-free.netEastern Cape, South Africa

The C2 server and makulu.online are the same IP address (217.77.8.210). This definitively links the backdoor to the developer's own infrastructure.

Additional Insecure Practices

  • Update scripts download over plain HTTP (not HTTPS) with no code signing
  • Downloaded scripts are chmod +x and executed with sudo every 5 minutes
  • verification.bin phones home to makulu.online:7005 over HTTP
  • Any man-in-the-middle attacker could inject arbitrary code with root privileges

The Developer

★

Jacque Montague Raymer

Sole Developer & Owner — MakuluLinux (since 2009)

Location: Da Nang, Vietnam

Previously: Eastern Cape, South Africa

"Makulu" means "big chief" in Zulu

One person. Running an update system over HTTP with no signature verification
that auto-executes with sudo every 5 minutes on every installation worldwide.

If You Run MakuluLinux

# Kill the backdoor process
sudo kill $(pgrep -f check.bin)

# Delete the binary and staging copy
sudo rm -f /usr/bin/check.bin /usr/share/MakuluSetup/files/check.bin

# Delete the autostart
rm -f ~/.config/autostart/System-Health-Check.desktop

# Block the C2 server
sudo iptables -A OUTPUT -d 217.77.8.210 -j DROP

# Block domains in /etc/hosts
echo "0.0.0.0 makulu.online" | sudo tee -a /etc/hosts
echo "0.0.0.0 makululinux.eu" | sudo tee -a /etc/hosts

# Disable update scripts
sudo chmod -x /usr/share/MakuluSetup/check-patchlist
sudo chmod -x /usr/share/MakuluSetup/update-check
sudo chmod -x /usr/share/MakuluSetup/quick-patch

# Then: change ALL passwords, regenerate SSH keys,
# and migrate to a trusted Linux distribution.
Full Technical Disclosure on GitHub →

Why This Matters

The Real Game: A SaaS Trojan Horse

MakuluLinux is not just an OS with a backdoor. It's a delivery vehicle for a centralized AI-as-a-service platform. Every "AI feature" — all 40+ compiled Python binaries — proxies requests through the developer's single Contabo VPS. The free OS is the funnel. The AI features are the product. The backdoor is the control plane.

Server Port Map — 217.77.8.210 (makulu.online)

PortProtocolServiceUsed By
2006Raw TCPC2 Backdoorcheck.bin ONLY
2006HTTPSAI chat/ask APIcalculator, weather, editor, frames, image-gen
4002HTTPSImage processingimage2image
6003HTTPSAI chat APItext-image, video, video-gen, log, pie, update-manager
6004HTTPAI ask APIsong
7005HTTPLicense verificationverification.bin, frames, editor

The Scheme

1

Free Linux distro = the funnel. User acquisition through a "free OS with AI features."

↓

2

AI features = the product. 40+ tools are thin GUIs proxying to OpenAI, HuggingFace via Raymer's server. He's the undisclosed middleman.

↓

3

Pro vs Free = monetization. verification.bin enforces licensing. expired.bin redirects to token.html to buy access. video.bin has a paywall.

↓

4

check.bin = command channel. AI tools use HTTPS to port 2006. check.bin uses raw TCP to the same port. Different protocol, same port. The API is the front. The socket is the back door.

↓

5

HTTP updates = total control. Push any binary to any machine, anytime, with root execution. No consent, no verification.

Data Harvesting

  • weather.bin geolocates every user via ipinfo.io and ipapi.co before API calls
  • image2image.bin maintains persistent user sessions on the server
  • All AI requests route through Raymer's server — he can log every prompt, every image, every conversation

One guy in Da Nang, Vietnam, running a SaaS business disguised as a free Linux distro, with a persistent backdoor on every installation, off a single VPS in Germany.

This is exactly why the Human Router architecture exists. In a world where you cannot even trust your operating system vendor, every decision — every execution — needs a governance gate.

D = G × S. If G ≠ 1, D = 0. No action is routed without verified authority. No exceptions.

They sowed the wind. Let them reap the whirlwind.

联系我们 contact @ memedata.com