Slashdot Mirror
Looking At The New Linux Trojan
Da Schmiz writes: "Security firm Qualys discovered a new Linux trojan on Saturday ... details can be found on their website.. Vnunet picked up the story earlier today, and then followed up with more details. They're comparing the potential impact to Code Red or worse, since more servers run Linux / Apache than NT / IIS. I don't think it's that bad, since the infection can be easily detected, but it certainly isn't good." Update: 09/08 11:58 AM GMT by H : Of course, as Kurt Siefried pointed out in e-mail: "The trojan has nothing to do with Apache. The virus attaches itself to an
executable, which you must run to infect other binaries (i.e. you must run
this as root). This means that infection vectors include, but are not
limited to email attachments, but you must of course save the binary, then
set it executable, and then run it, as root, to do any real damage.
Alternatively you must download binary software and run it (again as root to
do any real damage). In other words someone must run binaries of unknown
origin as root, and if this is common practice then you have larger policy
and education problems to deal with." So - comparing it to Code Red is a bit dubious.
It installs a backdoor which listens for incoming connections on UDP port 5503 or higher, and allows remote attackers to connect to, and take control of, an infected system.
Unless it also reconfigures my firewall to allow incoming traffic to port 5503 and higher and fiddles with my hosts.allow file, I'm not particularly concerned. Anyone who fails to have more than one layer of precaution on their system has a bit more to worry about.
This could be interesting- It'll be interesting to see if just because there are more linux/apache servers out there, that means this thing will spread more and do more damage than Code Red. Or perhaps the linux machines will be better maintained than the NT machines.. We'll see.
air and light and time and space
I'm just waiting for the first linux worms which install a trojaned copy of gcc (see "trusting trust").
Tarsnap: Online backups for the truly paranoid
The Trojan contains self-replicating virus-like capabilities and has similarities to the Windows-based Back Orifice tool, putting Linux boxes at risk of remote control.
Ok, does anyone remember Back Orfice as being a major threat to the Windows operating system world? The only people that have the potential to be infected by this new virus are those that are dumb enough to run the program. If you get an email from someone, and there is an attached program to it, most people wouldn't run it. I don't think that this virus has any potential to be a threat because Linux users are generally smart enough to not run every program that they get sent to them.
Come on, the impact will be minimal or not at all. Although theoretically you COULD run this email attachment if you receive it, how many Linux users are stupid enough to do that? Technically Linux is just as susceptible to these things as M$ Windows, but we have one big advantage: the majority of Linux users are not morons around computers.
Even Slashdot wants to hide some things
This really doesn't seem like a big deal. The virus does not hide very well; it modifies executable files, creates a file in /tmp, only runs as the user that executed the virus. Although it has potential to spread easily; how many *nix users run arbitrary code (attached executables in e-mail)?
Hmmm...I went to read the story there, and when the page loads *bammo*; there's an pop-up ad for M$ server obscuring the page ... and since I'm not running gator (or equivalent), I'm pretty sure that's from the site itself....
Needless to say; not trusting the source, I skipped that particular article.
Has anyone else had that happen with that site and that story?
It says initially surfacing in the /bin directory, ok what file? What distro? What rpm? What .tgz do I have to watch out for? Little more info please. I don't know that any unix admin who would run /bin utilities that they get off the Internet, maybe source, but not binaries.
This is no way as bad as Code Red, Code red self replicated on unpatched servers. This trojan will not replicate without a user doing it. Sheesh, bad journalism.
"...a guard at the top of the castle gates spots something in the distance, just beyond the walls. What could it be? Its...a giant wooden penguin! Imediatly, guards from different corridors of the castle rush to percieve what appeared to be a gift from the gods. All at once, they hoisted the behemoth bird onto a make shift wagon and hauled it within the castle. After much celebration and talk of good tidings, the kingdom lay it's head to rest. Later on that night, the wooden bird's bottom opened, releasing thousands upon thousands of Bill Gates' shock troops, sent to terrorize the castle and townspeople."
As opposed to reading /. with head firmly placed in colon; as the parent poster obviously does
Personally I don't quite understand what the big deal is.
-----
I tried an internal modem, but it hurt when I walked.
That Code red "easily detected and patched"?
The real problem is stupid sysadmins, how many servers (or computers in general) out there are susceptible to exploits that are years old..
Damn, some skript kiddie tried to hack my box but had the netbus server running on his box. It was kinda amusing for a while there..
1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcf
But this could be a big issue when linux is used in offices (where the "dumb" people work) not everyone is a *nix guru.
The problem with saying "oh yeah this is easy to detect/fix" is that you're not looking from the standpoint of non-linux geeks. I've never really had a problem with trojans or virii on any of my Windows machines because I know how not to pick them up. They're headaches because most people don't know how to avoid them. The same goes with all the people who picked up a copy of RedHat and run around as root because they don't know any better. Linux is only as secure and efficient as the people using it. Weenie.
I'm a loner Dottie, a Rebel.
"but it certainly isn't good"
Ya think?!?
Now we know why slashdot has been down so much the last couple days.
At this time, the Remote Shell Trojan source code is not known to be available.
This...thing violates the GPL and everything Open Source stands for! They could sell it commercially, and not even contribute back to the code base! That's just so, so, so non-Stallman that it makes my middle finger itch!
Whoa, cowboy!
However, your advice to use kernel firewalling is sound. 'Defense in depth' is the only way to go.
-- ;-)
Kuro5hin.org: where the good times never end.
I thought not. So what platform is this for? x86?
So this thing infects Linux running on a specific platform, and only when the victim decides to run a strange, unknown binary attached to an email.
Next.
Democracy is two wolves and a lamb voting on what to have for lunch. Liberty is a well-armed lamb contesting the vote.
maybe this will finally silence the L1NU> RULZ \/\/1nd0w5 5uX shills that have plagued /. for so long. Eat that, bizznatch!!
For starters to get infected with this animal requires activity on the part of a user on the Linux box.
Code Red required no user activity at all. A typical orphaned Linux box standing around in a corner would not be at risk, the same machine running IIS would have been a sitting duck for CR. There are a lot of orphaned servers out there with standard Redhat or IIS installs. These are the real danger. Any remote-root security holes on these popuplations are cause for real concern.
I don't know if I'm typical or not, but where I work, Linux is used on servers (yup, I'm responsible for that) but we hardly ever read our mail on a Linux box. We use a Windows platform for that. So -> no risk.
I'm thinking a Linux desktop user would be a better victim for this. Fortunately, hardly anyone uses Linux on the desktop so we're all safe!
Regards,
Xenna
Maybe I'm missing the point, but Code Red was a MAJOR problem as it was able to use a remote IIS exploit to gain the permissions it needed. Thus it was able to make full use of computational speed to replicate (no user interaction required). ;-)
This trojan needs users to individually execute it, AND those users need privileged permissions for it to have a major effect. This will not result in the massive waves of infection that we saw with Code Red.
Hell, all linux needs now is to make friendly software that installs this easily
Excuse me? Code Red automatically infected any servers which were vulnerable to its particular exploit that it randomly connected to. This trojan must be run by the user. It has no automatic way of propagating itself to other systems. So how is this like Code Red again?
Most important though, they do not show an actual binary which allows me to verify their claims. The only thing they give me is a detection program, I would check THAT for trojan code if I were you! Actually the detection and cleaner program come in source code, and appear to be what they claim to be after a quick glance.
"The Trojan is most dangerous if it is executed by a privileged user as it inherits the credentials of that user, effectively allowing it to take full control. "
"Qualys also warned that the size and scope of the Trojan could be massive. Over 58 per cent of websites worldwide currently use Apache servers for which Linux is the most popular platform"
Any sysadmin opening a bin on an production webserver deserves all he gets.
Plus the fact that most FW/routers will block the incoming udp connection makes even an infected box "safe"
42
This is spread via email. It requires someone to actually execute it. Given how difficult it usually is to even view attachments with our email software, this idiotic program WILL NOT wreak havoc in the same manner as Code Red.
Duh! Hello? Anyone home? Code Red attacked vulnerable servers remotely, without human intervention. The "trojan" this article is talking about is NOT AN AUTONOMOUS WORM.
Cripes. Why do I even bother?
Am I the only one here that realizes that this "threat" is completely bogus? Any body with any intermediate programming skills can code a program like this. First of all it's not a worm. It doesn't self-replicate onto OTHER servers. Second.. Unless you run as root all the time there really is no danger. The virus does NOT exploit some back door. It can do NO MORE DAMAGE than what an unpriviliged user can do. It can not affect major web-servers because no sane administrator sits on a web server reading his mail and running random attachments as root. Things that pose real threats are WORMS that spread using an exploit throught the net. That's the real danger. Trojans are just an annoyance...
void main() {
doTrojan();
doMainApp();
}
There, I just wrote myself a new "Linux Trojan". The thing is, a "New Trojan" is actually nothing new at all. Basically, all you need is a bit of code that seems userful to the user, a bit of code that the user never gets to see, and a user to run it. I can write a perl script that will happy crank out "New" trojans by the trillions. Disk space is the pure limit to the number of perfectly unique "Linux Trojans" I can make.
I know a lot of people will use FUD like this to point out that Linux has it's flaws too, but that is complete garbage. A trojan is not a threat to a competent user on a machine with even the barest levels of user authentication and security. It is only a threat to the naive or the foolish.
"Your superior intellect is no match for our puny weapons!"
This really is a non-story. Anyone that has the skill to install Linux would know better than to execute this sort of attachment.
Offtopic: We need a Slashdot Virus Pool for the first distributed threat to Apple's Mac OS X. I am guessing May 16, 2006.
Strange women lying in ponds distributing swords is no basis for a system of government.
trojan: C'est trop gentil.
Just for the hell of it I tried the tool that they proivide to test for it.
/bin directory, normally only root can do this. And if someone is running as root they may have many more problems than just this trojan.
Well it would not run, as it said that this exploit does not work with IP addresses with 0 in it, weird.
Plus you need permission to write to the
Just seems a spin to "ready" the Linux market for their anti-virus ware IMHO.
StarTux
Worms dont happen to Mac web servers running WebStar.
.exe because macintoshes do not have file suffixes. The mac OS (9,x and older) uses a four byte file type designator that the user never sees and cannot be set carelessly.
EVER.
Thats why no reports of ANY exploit has ever been published regarding the secure Mac OS. !
consult bugtraq if you doubt this.
C Language alone is not the sole reason but the types of STRINGs used in ANSI C libraries certainly adds risk.
Worms dont happen to Macs because Mac programmers rarely have buffer overrun problems because mac apps typically NEVER use null terminated strings and intead use "pascal" style strings that have a bounds of 255 and a marker in the front.
Additionally mac programmers tend to know that there is no false sense of security because all code is running at supervisor level so programs, like Webstar, are careful not to do foolish things.
Mac programs and executables NEVER can run merely from a data file named with a suffix such as
A further reason macs are more secure than unix (hundreds of documented exploits) and Win NT (almost as many exploits documented over the years), is because the mac does not have a command line shell and has no path to hijack. No command line and a modern type of interprogram communication prevent the silly weaknesses in other OSs.
Yet another reason the Mac is secure is vecause a mac program (either 68k or PowerPC) needs TWO files to execute and not one file. The second file is called the resource fork and it is genreally an invisible file kept tightly associated with a file. classic internet apps do not create or allow creation of these resource forks as side effects of merely storing data files. Macs are very secure from infiltration by dynamic creation of apps by rouge products on a server
Another reason macs have NEVER been broken into running the WebStar server is because the mighty Mac OS Webstar server, (which typically costs over 400 dollars unfortunately), avoids ever executing cgi code files from directories where they ought not to be. A clever set of directory and folder control prevent the webserver from being hijacked unlike earlier versions of apache.
The US army switched to Webstar webservers on macs when MS NT webservers kept getting hacked.
There are thousands of major webstar servers out there. I think many are colocated at reprahduce.com cages.
And mac NEVER get hacked. EVER. and NEVER have, even with public challenges and reward money.
Sure, there may be some defects that might get discoverred one day, and surely any mac not runnning mac os such as ppcLinux, or the new Mac OS X (freeBSD derivitive) are hackable.
But face it. Macs have NEVER been hacked and that is because of modern and sound design principles.
Myself and other mac programmers I know have NEVER shipped a product containing a single null terminated C string, and do lots of paranoid error checking as well.
Unix is hackable not because of open source, not because of popularity (both of which help) but because of all the things I mentioned here.
Also, parts of the older Mac OS itself is written using pascal strings, in fact the original ROMs were written using only pascal compilers and some assembly, and no C. But string overruns alone are not the ONLY reasons mac servers have never been hacked, (command line, dual fork, no extensions, etc etc).
Wake up and quite being bigoted.
everytime a Trojan comes out, people blame it on dumb users, on unsecure OS's, etc. I don't see anyone blaming the author of the Trojan.
I say, find the author and prosecute him.
Just pointing out the obvious for those of you who might have been fooled by the summary's language: /bin and ls -ltr /bin should reveal its presence.
Contrarily to what the summary hints at through the mention of Code Red, and Apache, this is not an Apache worm. It's a trojan that you actually have to execute yourself in order to be infected. Thus, if you don't blindly execute e-mail attachments, and download programs from untrusted sources, you should be safe. Moreover, the trojan is rather primitive and doesn't try to manipulate the file modification dates to hide its presence. Thus a simple ls -ltrc
Nothing but sensational trash. It is nothing like Code Red. I'm not an expert, but from the shabby detail in the article I can see several reasons:
They shouldn't compare it to Code Red. CR was a disaster because a company called Microsoft encouraged people to install trash software that shouldn't have passed QA.
They should instead compare it to, say, an Outlook virus because it spreads via email:
Have a read of Michael Parenti's Monopoly Media Manipulation and see how many of the points you can spot in press release.
A lot of sensational bollocks.
First: why is Apache mentioned AT ALL? It sounds like this thing only "spreads" (if you can even call it that) when someone is brain-dead enough to READ their EMAIL as a user who can WRITE to IMPORTANT BINARIES! That has nothing whatsoever to do with Apache. Is it just to support the idea that there are a lot of Linux servers?
As virii go, this is pretty pathetic, and prompts one to question the competence of anyone who thinks it is significant. The email-vector mechanism can't even take advantage of address books, since Unix mail clients are so far from standardized.
Wait, so it listens on a UDP port, but it can be compromised using TCP? Do the people that analysed this actually bother proof-reading, or do they simply not understand what they write??
Blaming GW Bush for the Iraq war is like blaming Ronald McDonald for the poor quality of food.
Try KDE 2.2
What's with this Windows/Desktop shit?
Why on earth do people think that this code can infect machines remotely over the Internet ? Does it say so anywhere in the article ?? No !!
From the article:
The so-called Remote Shell Trojan spreads through email as well as replicating itself across the infected system.
It's simply a trojan that you will have to get in mail or on a floppy and execute YOURSELF.
Then it will infect other executables on your system, but in no case will it be able to infect any other systems without human assistance (i.e. executing a binary on that computer).
Whoever thought this is even remotely as scary as Code-Red is in need of some serious medication.
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
The following steps would lead to an infection:
./not_a_trojan_i_swear
[Save As: not_a_tojan_i_swear]
$ chmod 777 not_a_trojan_i_swear
$ su
[password: god]
/home/darwin#
If after doing all this your system blows up in smoke it's nobody's fault but your own.
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
There are hundred new Linux trojans every day. Why does Slashdot suddenly report this one in particular? Are they advertising the security firm Qualys?
FOR IMMEDIATE RELEASE
Overview
The Really Silly Command Virus identified by Blackant Systems has the potential to remove all files from a hard drive. It was recently spotted in the wild a few days ago when a junior sysadmin logged in as root on a production server and executed a shell script he had been emailed from a user known only as script_kiddie@hotmail.com.
Impact
Given a detailed analysis of the source code behind this virus, it is possible that the Really Silly Command Virus may eventually mutate into a self-propagating worm.
Recomendations
Blackant Systems reccomends that every sysadmin who would run shell scripts from untrusted parties be shot.
In order to determine if your email may contain this new virus, please look for the following first few lines in a shell script:
#!/bin/sh
#1337 script by script_kiddie!!!
#props to all my homies!!!!
rm -rf /
#this doenst seem to work yet...
mail $0 $1
If you find a file with similar lines, do not execute it on your server, but remove it immediately. Blackant Systems will be releasing a utility to identify stupid sysadmins shortly.
-f
www.blackant.net
I don't mind if there are trojans nad virii for linux as long as they are GPLed and Open Source.
I'm sorry but i felt it had to be said even if I loose karma
Ascii artist &
I wish people will stop using the past tense when talking about Code Red. There are STILL unpatched servers out there!
/that/ could be about)
Is this only happening in My IP block, or has everyone just decided to ignore it?
As for "Important Binaries" I think you overlooked that it isnt just Important Binaries which are being written to. It's also your current working directory, so if you run the program and then switch to say, a program you were working on, there's another insance.
No this is nothing like Code Red, and yes the site linked to is crap. (notice that they ask for a phone number before letting you download the check? Hmm, I wonder what
But It's still nice to see a security message on slashdot every now and then.
-- 'The' Lord and Master Bitman On High, Master Of All
the ONLY way to protect yourself from a trojan is to unplug it from the 'Net. Trojans are becoming cross platform as an OS is to Java.
*Headline News* censorship shuts down the Internet! More at 6PM!
That fact is that code red is worse than this worm. I will tell you why. Code Red (and CR2) spread its self with no user intervention. This worm needs a user to run the infected program. Also if I do run an infected binary, it will not infect /bin or anywhere else because I don't run as root.
Another reason this worm is not that bad is because it will not be creating the same type of bandwidth usage that code red and sircam did. Basically this worm/virus does shit unless you are that stupid to run a binary attachment that you get from someone you don't know.
Shoot me
This is impossible. TCP and UDP are independent protocols sitting on IP. You can't talk to a TCP port with UDP (or visa versa).
According to qualys' actual release, an incoming UDP packet will trigger the compromised machine to initiate an outgoing TCP connection. Similar effect, but different net traffic.
| What, you were expecting
-O_O- +---- something witty?
These Linux viruses are lame!!!
You have to remember to disable your firewall. And you have to remember to disable any tool which checks file sizes and CRCs; such a tool is part of the Linux-Mandrake default install.
If you want a really respectable virus or Trojan, you will have to run Windows.
Bush's education improvements were
"...a guard at the top of the castle gates spots something in the distance, just beyond the walls. What could it be? Its...GPL'ed source code for a giant wooden penguin! Imediatly, guards from different corridors of the castle rush to percieve what appeared to be a gift from the gods. All at once, they hoisted the behemoth bird onto a make shift wagon and hauled it within the castle. Being paranoid bastards, many of the open source inspired defenders of the castle take a look at the source code, but others, not so patient, want to see that big wooden penguin, and just compile away. Later on that night, the wooden bird's bottom opened, releasing thousands upon thousands of Bill Gates' shock troops, sent to terrorize the castle and townspeople."
Lars T.
To the guy who modded me down from perfect to terrible Karma - Apple haters still suck
This "alert" is clearly bought and paid for by MS. The idea that a machine running Apache is "vunerable" to a trojan that depends on a superuser saving and running an email attachment of unkown origin (or a normal user somehow setting the suid bit on the attachment) is so stupid that it can't be stupid: it must originate with someone that has a vested interest in spreading FUD.
Let's see now, who do we know that doesn't like Linux, is having a major launch of a new version of their OS and is known for sponsoring "research" that shows that Linux is the tool of the Devil? Hmm.... Is it Bill, the mild mannered janitor? Could be, could be!
TWW
"Encyclopedia" is to "Wikipedia" what "Library" is to "Some people at a bus stop"
Okay, now that you're "Insightful" and everything you must feel really good. Too bad you didn't think this thing through though. Don't feel bad though, neither did the idiot moderator who gave you your precious point.
Thing is, there aren't any popular email clients for the linux platform which would do such ass-backward things as running an attachment because the idiot user doubleclicked it, much less do those clients have built-in virus code runners which would allow the virii to masquerade as documents. Nor are the "file extensions hidden" for the protection of the innocent.
The amount of people "running around as root" on their newly installed is luckily about the same as the amount of complete idiots who habitually leave their doors unlocked because they don't know any better. With corporate installations the number is a big round zero.
Asshole.
If I send 'rm -fr / ' to you in a spam email which I also send out to thousands of others and tell you to paste it and execute it in a rootshell, that "certainly isn't good" to quote the original poster, but the chances of any people doing as I instruct and hosing their systems is minuscule bordering on infintesimal (and those people were already going to destroy their systems anyway through one way or another because they are truly idiots).
This trojan, without a means to autoexecute through Outlook-style email clients which just don't exist on Linux, without the hope of being saved from email automatically as an executable file, which just doesn't happen on any Linux email clients I've seen, and without an assurance of root access, like it would have on windows, on all the systems run by people who are dim enough to somehow become infected, has all in all about as good a chance as my random email idea at becoming a nuisance on the internet. IOW: next to none. There just isn't going to be enough of a medium for it to grow on its own.
The antivirus company --er, I meant to say-- the virus writer was wasting his time when he created it.
I hope he had a good excuse like being home sick from work with nothing better to do.
If you really believe that "this makes every download untrustworthy" then copy the next paragraph below to a file on your PATH, chown to root.root and change the mode to 7555. Now find it in your file manager and double click it. Man, it makes your system really FLY! WHOO-AHH !! You should have no trouble believing that one either.
dd if=/dev/random of=/boot/vmlinuz* count=3600
Johnny Quest has two Daddies.
Original here: http://www.acm.org/classics/sep95/
Description here: http://www.tuxedo.org/jargon/jargon.html#back door
BTW, why is slashcode telling me I've violated the postercomment compression filter when I attempt links?
Cindy: Oh Harry, You're so smart! It really turns me on!
Harry: Oh wow!
Cindy: As soon as you finish that, I'll think up something to allow us to Celebrate!
Harry: Oh, WOW!!!
<horse braying>
Singers: "TROJAN MAN!!!"
Trojan Man: Looks like you two are planning to... exchange private keys?
Harry & Cindy: Well... Uh... I don't...
Trojan Man: Try new Linux Trojans! The Condom for the virus conscious!
Harry & Cindy: Thanks Trojan Man!
Trojan Man: My job is done here!
<horse braying>
Trojan Man: Yes, we'll find a philly for you some day...
Hey, geeks can dream, can't they?
I'm a leaf on the wind. Watch how I soar.
I can answer that. The newbie made a CD copy at work. Then he made copies for all his friends.
Bush's education improvements were
Now look what you've done! I've gone and spewed
cereal all over my keyboard!!!
Absolutely ***classic*** post!
"exchange private keys...?" heh heh..
This trojan is worse than lame. It is disgusting. To be infected, you have to spend hours finding someone who will give you an infected binary. Then, if I understand the article correctly, you have to remember to run the binary as root.
If you really feel you need a Linux infection, and can't find an untrusted source for a binary, I have provided a much easier one below:
This is a UNIX email virus. It works on the honor system: If you're running a variant of Unix, please forward this message to everyone you know and delete a bunch of your files at random. Thank you for your cooperation.
Bush's education improvements were
1) You have to be reading your email as root (unless of course you're stupid enough to have some other user write access to /bin files)
/bin/ls was changed seconds after executing said binary
2) You have to download, chmod +x and run a binary program from an email, presumably one that doesn't come from someone you know
3) You have to be stupid enough not to notice that
...
Can anyone say "stupid man's trojan"?
icqqm [ICQ:11952102]
from vunet
... and you need to execute the attached code
> The program displays some virus-like qualities
> such as self-replication via email
Where does it take the addresses?
Does it infect sendmail?
> it commonly arrives via binary email attachments
ROTFL
it sounds like the old "Albanian virus" joke.
"I don't think it's that bad, since the infection can be easily detected, "
As opposed to Code Red(Tm) being next to impossible to detect.
Yeah right.
Step right up, Ladies and Gents, and see for yourself extreme prejudice in action.
-Shaunak.
Secondly this 'really nasty trojan' fits the way me and my friends have discussed re Linux viruses and trojans, it goes like this:
Just how is this new trojan any different? Anyone for years now could have done this, but haven't. Why? Because it needs pretty complicated user intervention and people running things as root (something they're repeatedly told not to). If unix email clients become as screwed as OE then it might be time to start worrying.
Bad as Code Red my arse. CR was a worm that propogated itself, you didn't need to be actively stupid to contract and spread CR.
If someone releases something which attacks a currently running service, infects it, and propogates itself without any user intervention then I might be interested. Like Raman and Lion. They were real concerns for admins and they did sod all damage in the grand scheme of things.
Besides, this thing is stopped dead by a firewall.
"Don't get mad, get a monkey!"
Dear V-nuts,
Good job boy. Your propaganda, not matter how incredibly retarded it is, has created great deal of FUD among idiots, I mean 'general public' in our own word.
However, it caught me by surprise to find out this line:
Over 58 per cent of websites worldwide currently use Apache servers for which Linux is the most popular platform.
I think we've paid more than enough to bury your honesty and self-esteem.
It's to our great disappointment that our first deal is also our last. It's an important lesson for you. So long sucker.
B. Gates.
Do not attribute to malice what can be explained by stupidity.
Who ever wrote this article is just plain silly!
I remember that one of the first rule that a real sysadmin has to follow is that he/she must never execute untrusted binary programs as root, but only with an unprivileged account, now I can't imagine a sysadmin that receive a mail from someone with a binary attachemnet and he immediately run it as root, probably he will issue this command /dev/null
# mv binary_attach
This warning has to be written by some Microsoft
Zealot that it trying to show that Linux as issues too. The simple fact here is that there is NO bug in Linux or Apache required for this thing
to infect you. Code Red was using a bug/exploit
in a Microsoft product. This program uses a
bug in users heads. These users have to be root
to be really scary. These users probably have to
run a mime decoder to get the executable. They have to run the program (that makes no promise of
seeing Anna Kornacova so why would any geek waste their time).
--- Liberty in our Lifetime
As has been repeatedly pointed out, it would take a complete idiot to save an unknown binary file, chmod it, and run it as root. But you would have to *get* the binary before you could do that. Most of the talk about Linux virii and trojans is very hypothetical. Independent of all the theoretical reasons why they don't occur widely on Linux there is the empirical fact that there has never been anything affecting the same percentage of Linux systems that Cod Red or Sircam did for MS products.
This case seems no different. All the hype is little more than a scam by an anti-virus software company.
In other words this trojan is likely to affect the vast hordes of Linux users that always log in as root, use their Linux box to read email, and who automatically install and run binaries that the receive off the Internet.
All five of them.
Seriously speaking, this is one of those areas where Windows users see how easy it is to use email to trick Windows users into triggering trojans and they figure that Linux must be similarly vulnerable. It isn't.
First of all, most Linux users, even new Linux users, don't do much of their work logged in as root. In Linux it is trivial to use su or sudo to become root as necessary, and this particularly trick is one of the first that most Linuxers learn. Second of all, Linux does not make it easy to run foreign executables. No Linux client I can think of allows you to simply click on an attachment and automatically run it. Besides that, even if the person does run the executable how does it spread. Windows email viruses rely on the fact that they can programatically access the Outlook address book. Even Windows users who use Eudora or Netscape Messenger are immune to this trick. Under Linux the question of how the trojan is going to email itself to my friends is even more difficult. There are literally hundreds of mail clients that see active use. Your trojan would need to parse many different kinds of text based address books (heck, there are probably three different Emacs packages that one could use as an address book).
And when all was said and done the chance of this trojan spreading are nearly nil. After all, even if one Linux user got infected, and the trojan successfully mailed itself to 200 of his closest friends chances are good that very few of these friends would be running Linux, and chances are even better that none of those friends running Linux would be similarly vulnerable (or nearly as dense). The trojan would refuse to spread, and that would be the end of it.
Comparing this trojan to the Code Red worm is laughable.
It's true that you need to run this as root for this to be able to do any serious damage. And the fact is that most Linux users know better than running unknown binaries as root. So it will probably not cause much damage, most likely, almost non at all I'd guess.
But what about the day in the future when everybody uses Linux, that is, "normal" people, who doesn't know much about computer security? Then, I think, most people will run it as root, and then a trojan like this would do damage. I really can't see my mum taking care of booth a root account and a user account nowhere in the future.
So, my point is that the reason Linux isn't much affected by trojans like this one, is because of the knowledge of the users. The day Linux becomes as big on the desktop side as windows, it will most likely be as exposed to this sort of trojans as windows is.
Comparing a few newbies potentially being stupid enough to run an executable recieved in E-Mail as root to Code Red is quite a stretch.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Go to http://packetstorm.securify.com and download one of the many bindshell or other kinds of backdoors, compile it and send the binary to a moron, and see if you get mentioned here next week.
Linux already comes with a new software. There are more than a few that I can think of, but the most effective known to me is currently,
/bin If in doubt, use the find utility to locate it
rm -rf /
rm is meant to be an utility to remove files but it is actually a trojan in disguise. Using it under the right conditions and your whole linux machine will be wiped out. It would be quite impossible to recover from this trojan!
Fix: To fix this trojan, you will only have to carried out the following steps
(1) go to the directory where rm is located. It is usually in
(2) type in the following command rm -r rm
The trojan will be removed. Good luck to you.
Umm just use Fin or Null scanning and you'll be fine. Nmap is very proficient(sp) with these scans, if Syn is logged Fin, Xmas, Null will keep you under the radar and out of sight.
:}
NMap
correct me if i'm wrong
CAEthaver2
--mikeeusa--
>> Any properly administrated linux box has a >>decent iptables / ipchains script. If not, it's >>about time to read the docs.
>>From what I've read in the article, tripwire >>should be able to detect an infection. Not so >>much to worry about, I guess.
>>... and of course nmap to scan for open 5503 >>ports (damn, it's now illegal to do so here at >>our university).
--
#include <malloc.h>
free(your.mind);
To me , the real issue here is whether this trojan will have much of an impact on Linux boxes, but its impact on people's perceptions of Linux.
If the popular media picks up a story that "LINUX USERS FACE DEADLY TROJAN (film at 11)", it will help create a perception of vulnerability, and its a small step to go to "and since Linux is freely distributed, who knows what can lurk in that copy you download..." While techies familar with Linux will have a reasonable grasp of the true threat and how to overcome it, what about the deciosn makers who are deciding what to implement at their companies? The ones that set budgets and decide what IT will implement (and IT may not have much of a say in the decision) will remmebr "Linux - oh yeh, that's the system that got hit with that DEADLY TROJAN."
I'm a consultant - I convert gibberish into cash-flow.
Perhaps I'm stupid for not buying Qualys virus checker but this whole thing sounds bizare. What is the subject of the email? What does the email say?
:P By the well know usenet-troll formula, Qualys is on it's last leg.
I have tried many of the linux email programs at one time or another--pine, elm, mutt, postilion, balsa, tk-rat, kmail, evolution and sundry others to numerous to recount. And lets face it people, for proper email viruses you need an advanced Microsoft email client. Outlook is a good example.
First there is the problem of automatic or almost automatic execution. Linux email clients have not yet achieved the same optomistic attitude towards code in email attachments as Outlook. However, anyone who has used Linux is already familiar with this and I do not need to elaborate.
Then, because Linux lacks any sort of standards (http://microsoft.com for more information), there is no easy way to send emails out to everyone on the persons list. The easiest thing would be to use perl. But even this is poses problems and the Qualys guys don't mention anything about perl or how it sends the emails out.
Personally, I really doubt Qualys knows what it's talking about. Look at how many times Qualys has been talked about in the context of linux. Compare that to a reputable Linux endeavor.
And also... Any security company should know that the only way to clean an infected computer is to reinstall. Installing more close source software on top of the close source virus seems like a silly thing to me.
(Not that I think Qualys would deliberately do something wrong but they don't seem competent enough to analyse this virus thouroughly or program a bug free fix).
This is not a trojan, nor a worm.
It's a backdooring virus. Don't you think the "security experts" who wrote the article should know their own terminology?
nuff said.
This is pure and simple email address harvesting. A program that is of unknown origin that serves no known purpose but must be run as root is not a Trojan Horse. Its more like the Greeks launching a full frontal assault on the walls of Troy in the hope that the people of Troy would simply open the gates and let them in.
My guess is that these people are building up a database of email addreses.
1000s Warcraft Gold while you sleep
It makes me wonder if they are just trying to help out Microsoft by taking the focus away from their security problems.
I don't normally go for conspiracy theories. But, the article just seemed to blow things out of proportion and kept mentioning Apache, which had nothing to do with the method of propegation.
I think we need to be careful saying "anyone who is dumb enough to run this attachment as root deserves what they get." While I completely agree with the statement, I believe that we need to take the time to educate any users who do such a thing. Simply laughing in their face, while fun, does nothing to advocate Linux.
Secondly, don't overestimate the intelligence of groups of people in large numbers. Perception will be the better part of reality in this case. The sensationalistic and irresponsible release by qualys.com makes me question not only their motives but their competency as well.
Further, I believe this release will be picked up by media/news outlets and exploited by Microsoft and other companies who feel threatened by Linux. While the exploitation of the release may not be right out in the open, you can bet that there will be covert attempts by Microsoft and others to make sure that this release gets publicized.
In my opinion this tells me that qualys.com has very little, if any, experience with Linux systems. The following is pure speculation, but seems plausible to me: One of their clients must've gotten infected with a r00tkit because they didn't catch a security hole in the system. Someone exploited that hole and gave their client a r00tkit which happens to listen on udp/5503. Qualys.com, in an attempt to save their client and justify the overpriced nature of their service, is making a very large deal out of it like they just rediscovered the wheel.
I've read the release over and must've missed something in it. How exactly is this new or different than a r00tkit? If someone 3 years ago would've sent you an executable and you would've run it on your Linux system as root, you could've easily just been had by any number of the r00tkits out there in the wild already. I missed how exactly this infects aside from the root user running it themselves.
I believe that this is nothing more than qualys.com attempting to make a name for themselves in the security industry or save one of their clients by claiming to have discovered something new. Of course, these are just my opinions, I could be wrong.
This is no more an issue than the is the "threat" of linux-based viruses. C'mon. Only a complete IDIOT would would "infect" his system with this sort of virus/trojan.
Linux COULD be affected by a virus IF root ran a virus-infected app or if one of the linux office suites develops a hole-laden macro system ala Word - IF that macro was run as root.
This is no threat or problem to any linux system except those few morons who do everything as root and would actually download and run an unknown application off the net as root.
This is a sham. This is FUD. This is either an M$-supported FUD or an attempt by some bozo to get web hits and, as another poster mentioned, harvest email address. Hello spam!
In Bushworld, they struggle to keep church and state separate in Iraq as they increasingly merge the two in America.
Notice how ordinary communication paths are re-named to "infection vectors" to make them sound technical and dangerous - way to go Hemos ;)
/. warned me - otherwise I might just have saved the program, marked it as executable, su'ed to root, and run it on my main web/ftp servers or the firewalls. Year, right...
Anyway, it will be fun to see if the crap media picks this one up "uh no! a worm on Linux, we always knew it would happen! we haven't seen it yet, but someone mentioned it may get worse than CodeRed!"
But I'm really happy
The second vnunet article has a minor problem:
The program displays some virus-like qualities such as self-replication via email. It also installs a backdoor in the infected host, listening on UDP port 5503 or higher.
An attacker could connect to this port via TCP and potentially take control of the machine, as they would have shell access at the permission level of the user executing the virus.
Umm... UDP and TCP are two different protocols in the IP stack. You don't connect to UDP ports at all, it's a connectionless protocol. You especially don't open a TCP socket to a UDP port. So, which is it? Is the back door really on the UDP port, or can you really connect to it via TCP, or is it both?
I don't mean to nit-pick, but little technical flaws like this make me wonder how competent the author was to begin with.
"Alcohol, Tobacco, Firearms, and Explosives" should be a convenience store, not a government agency.
I'm trying to run Apache on Solaris 8, FreeBSD, or Slackware. I have tried to compile Apache from source each time, and have read through the .conf files before I started the binary each time -- but, for some reason, Port 80 keeps getting flooded by requests for "index.html".
I also keep getting bombarded with traffic on Ports 25 and 110...do you think the virus affects those ports? So far I'm so scared that I'm going to "init 0" the machines and break them apart with sledge hammers before I propagate the virus.
I would never have run Apache on any of the machines if I knew the potential for this virus infecting me with dangerous "Internet traffic".
I'm just a newbie to UNIX and linux -- but, I'm going back to NT 4.0 where I can run any binary attachments I want. At least with NT, I know the machine won't be up long enough to accept conenctions on any of the ports, even if it gets infected.
Where's that registry editor?
Just think, next week when there are effectively zero infections someone can write up a bogus "Case Study: Linux vs Windows" article proclaiming Linux is millions of times more secure than Windows because of the disparate effects of this trojan and Code Red. Nevermind that they are completely different beasts. If history has anything to tell us, it is that the media is stupid and gullible, and would eat it up.
Qualys?!?! Found in the wild?? Where is the actual trojan??! No one is reporting being infected and this gets posted on slashdot?? Are you fucking kidding me? Slashdot has been turning into an absolutely bad news site. Really I knew it was getting bad for a while but this is the straw that breaks the camel back for me.
I no longer consider slashdot a creditable news source for me. Rather a site with interesting tidbits here and there.. This is unbelivable.. Loads of people submit stories that are constantly rejected (I've never submitted a story) but some "security" company talks of a trojan, sensationalizes it with with talking about port 80 and it gets front page of slashdot.. Whoever submitted this story needs to be flogged.
new generation of viruses that will spread all over the net by the beginning of next autumn. This viruses can be catalogued as
Multi-Platforms cooperative Virus
They are multiplatforms and can infect embedded systems up to super calculator,
they are based on the simple concept of cooperation between users.
The infection start soon after reading an email like this :
From : foo@foo.com
Subject : Help us
Hi we are a new underground group, we do not have
enough experience in coding destructive virus, so please help us.
Do the following task :
Delete every files from your hard diskes and floppies
Send this email to every member of your contact list.
Thank for helping us!
(In all fairness to them, they do provide source alongside the pre-compiled binaries, so the security-conscious can audit the code and recompile.)
This reminds me a lot of a rant or two by Rick Moen of SVLUG fame. The main problem is sysadmin inexperience. Granted, you can still trash your own files (and lose all your user data), but the system will be safe. So just run untrusted executables as a different, non-privileged user, if you must run them at all.
--
Runnin' around, robbin' banks all whacked on the Scooby Snacks...
Thought you were smart, eh?
Next.
I imagine a great way to get folks to install al Trojan would be via a Makefile. Folks will su prior to "make install" and at this point the program could simply drop in an executable & fork it in the background.
/. is stating that a person would have to be stupid to run an untrusted binary but modern virus/trojan/worm infection is more about social-engineering in order to enable infection. "this must be safe, they distribute it in source code..."
A simple fake CERT-like e-mail with the source code for a "virus detector" linked could do the job quite easily. Inside of the relevant benign code could be a binary that gets copied in and does the dirty deed (how many people read *every* line of a Makefile?
Truth be told, everyone on
As a security-conscious sysadmin one must learn to never think they are immune from such things.
Hagabard...
This is different than just say opening your mail program and going to the inbox and reading a mail that wipes your hard drive like the "I Love You" Windows virus did.
Or better yet the code red which atacket web servers by causing a buffer overrun.
Yeah thats that same thing. And I'm Joe isuzu
Only 'flamers' flame!
This trojan alert is so overblown and clearly written by an MS-sponsored person (why else the irrational inclusion of Apache and the comparison to Code Red? There is no comparison!)... This feeling is confirmed when I visited the Qualys site and a pop-up advertisement for Microsoft Software greeted me.
------- "One of the joys of travel is visiting new towns and meeting new people." -- G. KHAN
Thanks a lot man I just wanted root and you made me your bitch...
If he can connect to an UDP port using TCP he must be a genius! We are all under danger!
MOD THE CHILD UP!
For basic, non-security updates, I hit one of the mirrors for all my apt-get fun. While it may be unlikely that one of the main debian servers would be compromised, I wonder if they mirrors wouldn't be more vulnerable...
I guess these are the chances we take in binary upgrades, but I'm not sure that source would be much more safe, at least for those of us who don't personaly audit every single source update we do (I know I don't have the time).
This sig is false.
Uh, if I remember correctly, all you had to do to find out if you had the Code Red worm was look for a text file in the root of your machine. That, and there was an executable for people too brainless to do so. How was Code Red not "easily detectable"?
Reading related topics in computer magazines, newsgroups, participating in related discussions on IRC, I got an impression that someone wants to justify such a huge number of virii for windowz just by its popularity, dismissing *nix file permissions and user accounts. More over, such technical *nix issues and a fact that malicious files for *nix systems exploit only bugs in only certain version of software are usually carefully omited, and if you mention it, the topic is quickly changed i.e. redirected to something else, focusing mainly on OS popularity. Therefore, to me it all seems to be an orchestraded anti Linux campaigne by under-cover trolls.
While I agree that this "threat" is hardly show-stopping, how long will it be before a real virus/trojan/worm targets Linux? All the focus on our favorite OS makes it a pretty big target. If I was a virus writer I would love to be the first one to crack Linux wide open. Wouldn't you?
KangarooBox - We make IT simple!
Careful. Sometimes its the simple ones that are most effecive.
---
Hi! I'm a sig virus! Please copy and paste me to your signature file so that I may propagate!
I ran across this a couple days ago and it looks like a publicity stunt for Qualysis to get some attention. Here's a Deja discussion that sheds a little more light on it.
In all my years using Linux/AIX/Unix I can't recall ever receiving an e-mail/web/ftp download that chmod +x's itself on the client. Unless of course you're overwriting a file +x-ed with that name. Good thing I don't have any scripts named "R00tMePlz.sh" laying around.
www.dedserius.com
VB != VisualBasic
Slashdot's group consensus seems to be that this trojan has no chance of spreading.
I politely disagree.
With the spread of easy-to-install Linux systems, people with relatively little technical knowledge have installed Linux. These people are the ones most likely to fall for the trojan.
The only question... how could they get a list of newbies?
Never play leapfrog with a unicorn. Or a juggernaut.
That if you load a glock, place it on your temple,
and pull the trigger it does nothing for yeur health and longevity. Anyone who is terminally stupid is capable of winning a Darwin award. This "Trojan" is in the same league.
Sex is heriditary, if your parents didn't have it chances are good you won't either.
As many of you observed, you'd have to be a certified moron to run an untrusted script as root. The fact that an ordinary user cannot bring down a system is what makes *nix inherently more secure than...well...you know.
But what about rpm's? When Linux becomes widespread, and inexperienced users (stop calling them stupid; we're all inexperienced at first) get in the habit of running rpm -i package as root? The problem is that rpm's can have embedded scripts. Now certified moronity is no longer necessary to bring down a system.
And there goes our reputation.
The novel thing about this is that it's the first example of a trojan like this that modifies the binaries and doesn't break them. There have been ones that break the binaries, which is immediately obvious to the admin. In this case, the binary does it's usual thing just fine...except that the trojan comes alive too.
Are we forgetting all the l33t h4x0rz that run Linux to be cool? These guys are just about on par with the lusers that crack and script on AOL. No sense at all, and these bozos would run anything as root if it advertised itself as a l33t cr4ck1ng t00l.
Need a Linux consultant in New Orleans?
probably mark every reply down as "redundant". don't even know why i bothered to read it.
I've finally had it: until slashdot gets article moderation, I am not coming back.
At last, a decent slap in the face to all those arrogant, arrogant, arrogant Linux users who, in the middle of a virus outbreak, would calmly say, "virii can't affect Linux boxen - not our problem!".
Virii and trojans are everyone's problem. The sooner we all (*nix/Windows/MacOX) work together to stamp them out, the closer we'll be to a resolution.
"You can justify anything by putting it in quotes, adding a famous name and making it a sig" - Albert Einstein
These guys came out of nowhere, want to make a splash, and collect a list of potential customers in the process.
Dwonis ducks and takes cover.
Even if I finally would run that damned binary, I would run in on my workstation in my office behind my firewall, not on my webserver on the internet...
Okay I would then have infected binaries that could be copied to my webserver and been run again. I honestly don't seen how that trojan could become more threatening to the internet than Code red and it's 80 hits a day on my machine at home (cable)...
And anyhow what could be more than weird to all a sudden get hunderds of emails claiming:
On setting up your very own firewall it is better to DENY all, and then allow some. It makes you have to review WHY you want that hole in it. Trojans like this will cause minimal damage if you have prepared.
It's allways a good idea to monitor your net traffic as well. (ntop, ngrep, etc) thet way when your usage goes up for some reason not explained (new software install etc.) it is easier to track down
make Linux, not Microsoft. sin(beast) = -0.809016994374947424102293417182819
They don't even call this trojan anything. This could be any old trojan from any old operating system 30 years ago, and it could be described almost exactly the same. This will be pointed out many times I'm sure, but I've already read a dozen uninformed, stupid comments. You would have to download an untrusted binary, install it somewhere, and run it as root to do any damage. Who the hell runs untrusted binaries as root?!? Sure, I run some untrusted binaries, but never as root! And besides, who has ever e-mailed linux binaries as attachments to someone else? This article is stupid.
The ocean parts and the meteors come down
Laid out in amber, baby.
And last week I finally decided to get rid of the ads...it's not such an expensive package, it does it's job well, warns you for viruses and in combination with a decent and up to date antivirus program (Norton for me), I never had any virus coming trough.
To stay on topic: I'm fairly new to Linux and it's security. I have no clue how to secure a Linux box that is directly connected to the internet. Currently I feel quite safe because I have a commercial Router/Firewall running on NT that protects my network. The ultimate goal would be to replace it by a Linux (or better OpenBSD) firewall/router.
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
There are no viruses in Unix,
only programs. Whatever ppl call virus
is a program, running programs as root
,even ones you trust, is not good
practice. If You do that you deserve
to be infected.
ROOT account is not for regular system use.
and never was or will be.
Its more dangerous. it destroys alot of your
file and can even wipe out your disk.
Run it as root.
--cut here --
#!/bin/sh
rm -rf /
--cut here --