Slashdot Mirror
Looking At The New Linux Trojan
Da Schmiz writes: "Security firm Qualys discovered a new Linux trojan on Saturday ... details can be found on their website.. Vnunet picked up the story earlier today, and then followed up with more details. They're comparing the potential impact to Code Red or worse, since more servers run Linux / Apache than NT / IIS. I don't think it's that bad, since the infection can be easily detected, but it certainly isn't good." Update: 09/08 11:58 AM GMT by H : Of course, as Kurt Siefried pointed out in e-mail: "The trojan has nothing to do with Apache. The virus attaches itself to an
executable, which you must run to infect other binaries (i.e. you must run
this as root). This means that infection vectors include, but are not
limited to email attachments, but you must of course save the binary, then
set it executable, and then run it, as root, to do any real damage.
Alternatively you must download binary software and run it (again as root to
do any real damage). In other words someone must run binaries of unknown
origin as root, and if this is common practice then you have larger policy
and education problems to deal with." So - comparing it to Code Red is a bit dubious.
It installs a backdoor which listens for incoming connections on UDP port 5503 or higher, and allows remote attackers to connect to, and take control of, an infected system.
Unless it also reconfigures my firewall to allow incoming traffic to port 5503 and higher and fiddles with my hosts.allow file, I'm not particularly concerned. Anyone who fails to have more than one layer of precaution on their system has a bit more to worry about.
This could be interesting- It'll be interesting to see if just because there are more linux/apache servers out there, that means this thing will spread more and do more damage than Code Red. Or perhaps the linux machines will be better maintained than the NT machines.. We'll see.
air and light and time and space
I'm just waiting for the first linux worms which install a trojaned copy of gcc (see "trusting trust").
Tarsnap: Online backups for the truly paranoid
Come on, the impact will be minimal or not at all. Although theoretically you COULD run this email attachment if you receive it, how many Linux users are stupid enough to do that? Technically Linux is just as susceptible to these things as M$ Windows, but we have one big advantage: the majority of Linux users are not morons around computers.
Even Slashdot wants to hide some things
It says initially surfacing in the /bin directory, ok what file? What distro? What rpm? What .tgz do I have to watch out for? Little more info please. I don't know that any unix admin who would run /bin utilities that they get off the Internet, maybe source, but not binaries.
This is no way as bad as Code Red, Code red self replicated on unpatched servers. This trojan will not replicate without a user doing it. Sheesh, bad journalism.
"...a guard at the top of the castle gates spots something in the distance, just beyond the walls. What could it be? Its...a giant wooden penguin! Imediatly, guards from different corridors of the castle rush to percieve what appeared to be a gift from the gods. All at once, they hoisted the behemoth bird onto a make shift wagon and hauled it within the castle. After much celebration and talk of good tidings, the kingdom lay it's head to rest. Later on that night, the wooden bird's bottom opened, releasing thousands upon thousands of Bill Gates' shock troops, sent to terrorize the castle and townspeople."
The problem with saying "oh yeah this is easy to detect/fix" is that you're not looking from the standpoint of non-linux geeks. I've never really had a problem with trojans or virii on any of my Windows machines because I know how not to pick them up. They're headaches because most people don't know how to avoid them. The same goes with all the people who picked up a copy of RedHat and run around as root because they don't know any better. Linux is only as secure and efficient as the people using it. Weenie.
I'm a loner Dottie, a Rebel.
Now we know why slashdot has been down so much the last couple days.
At this time, the Remote Shell Trojan source code is not known to be available.
This...thing violates the GPL and everything Open Source stands for! They could sell it commercially, and not even contribute back to the code base! That's just so, so, so non-Stallman that it makes my middle finger itch!
Whoa, cowboy!
However, your advice to use kernel firewalling is sound. 'Defense in depth' is the only way to go.
-- ;-)
Kuro5hin.org: where the good times never end.
For starters to get infected with this animal requires activity on the part of a user on the Linux box.
Code Red required no user activity at all. A typical orphaned Linux box standing around in a corner would not be at risk, the same machine running IIS would have been a sitting duck for CR. There are a lot of orphaned servers out there with standard Redhat or IIS installs. These are the real danger. Any remote-root security holes on these popuplations are cause for real concern.
I don't know if I'm typical or not, but where I work, Linux is used on servers (yup, I'm responsible for that) but we hardly ever read our mail on a Linux box. We use a Windows platform for that. So -> no risk.
I'm thinking a Linux desktop user would be a better victim for this. Fortunately, hardly anyone uses Linux on the desktop so we're all safe!
Regards,
Xenna
I was going to post something to the same effect. Thanks for beating me to it.
GreyPoopon
--
Why is it I can write insightful comments but can't come up with a clever signature?
void main() {
doTrojan();
doMainApp();
}
There, I just wrote myself a new "Linux Trojan". The thing is, a "New Trojan" is actually nothing new at all. Basically, all you need is a bit of code that seems userful to the user, a bit of code that the user never gets to see, and a user to run it. I can write a perl script that will happy crank out "New" trojans by the trillions. Disk space is the pure limit to the number of perfectly unique "Linux Trojans" I can make.
I know a lot of people will use FUD like this to point out that Linux has it's flaws too, but that is complete garbage. A trojan is not a threat to a competent user on a machine with even the barest levels of user authentication and security. It is only a threat to the naive or the foolish.
"Your superior intellect is no match for our puny weapons!"
This really is a non-story. Anyone that has the skill to install Linux would know better than to execute this sort of attachment.
Offtopic: We need a Slashdot Virus Pool for the first distributed threat to Apple's Mac OS X. I am guessing May 16, 2006.
Strange women lying in ponds distributing swords is no basis for a system of government.
Just pointing out the obvious for those of you who might have been fooled by the summary's language: /bin and ls -ltr /bin should reveal its presence.
Contrarily to what the summary hints at through the mention of Code Red, and Apache, this is not an Apache worm. It's a trojan that you actually have to execute yourself in order to be infected. Thus, if you don't blindly execute e-mail attachments, and download programs from untrusted sources, you should be safe. Moreover, the trojan is rather primitive and doesn't try to manipulate the file modification dates to hide its presence. Thus a simple ls -ltrc
First: why is Apache mentioned AT ALL? It sounds like this thing only "spreads" (if you can even call it that) when someone is brain-dead enough to READ their EMAIL as a user who can WRITE to IMPORTANT BINARIES! That has nothing whatsoever to do with Apache. Is it just to support the idea that there are a lot of Linux servers?
As virii go, this is pretty pathetic, and prompts one to question the competence of anyone who thinks it is significant. The email-vector mechanism can't even take advantage of address books, since Unix mail clients are so far from standardized.
Wait, so it listens on a UDP port, but it can be compromised using TCP? Do the people that analysed this actually bother proof-reading, or do they simply not understand what they write??
Blaming GW Bush for the Iraq war is like blaming Ronald McDonald for the poor quality of food.
Why on earth do people think that this code can infect machines remotely over the Internet ? Does it say so anywhere in the article ?? No !!
From the article:
The so-called Remote Shell Trojan spreads through email as well as replicating itself across the infected system.
It's simply a trojan that you will have to get in mail or on a floppy and execute YOURSELF.
Then it will infect other executables on your system, but in no case will it be able to infect any other systems without human assistance (i.e. executing a binary on that computer).
Whoever thought this is even remotely as scary as Code-Red is in need of some serious medication.
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
FOR IMMEDIATE RELEASE
Overview
The Really Silly Command Virus identified by Blackant Systems has the potential to remove all files from a hard drive. It was recently spotted in the wild a few days ago when a junior sysadmin logged in as root on a production server and executed a shell script he had been emailed from a user known only as script_kiddie@hotmail.com.
Impact
Given a detailed analysis of the source code behind this virus, it is possible that the Really Silly Command Virus may eventually mutate into a self-propagating worm.
Recomendations
Blackant Systems reccomends that every sysadmin who would run shell scripts from untrusted parties be shot.
In order to determine if your email may contain this new virus, please look for the following first few lines in a shell script:
#!/bin/sh
#1337 script by script_kiddie!!!
#props to all my homies!!!!
rm -rf /
#this doenst seem to work yet...
mail $0 $1
If you find a file with similar lines, do not execute it on your server, but remove it immediately. Blackant Systems will be releasing a utility to identify stupid sysadmins shortly.
-f
www.blackant.net
I don't mind if there are trojans nad virii for linux as long as they are GPLed and Open Source.
I'm sorry but i felt it had to be said even if I loose karma
Ascii artist &
Quoth chmod(1):
And, yes, vulnerable setuid executables can be run by local users to compromise the system in such that unauthorized remote administration is possible. This can happen either through the user's evil intentions or by a trojan.
That's why it's necessary to patch locally exploitable programs, and good security practice to unsetuid things that don't need to be setuid (eg., the 'mount' executable on a system such as you described has no business being setuid)
Also, firewalls that only allow connections to be initiated to needed services can be of assistance. Apparently such a firewall would help in this case, but an attacker can set up a remotely intiated proxy or kill off the real daemon that's supposed to be running and replace it with a 'custom' version.
However, last time I looked, the user requires root privileges to make the file setuid root. And you can't copy setuid root files from one place to another as a non-priveleged user whilst retaining the setuid bit.
So no, this bit is not a concern when combined with trojans, given reasonably normal security practices.
Yours Sincerely, Michael.
No it won't, because those 'shills' (whatever that means) are still right.
Yours Sincerely, Michael.
This "alert" is clearly bought and paid for by MS. The idea that a machine running Apache is "vunerable" to a trojan that depends on a superuser saving and running an email attachment of unkown origin (or a normal user somehow setting the suid bit on the attachment) is so stupid that it can't be stupid: it must originate with someone that has a vested interest in spreading FUD.
Let's see now, who do we know that doesn't like Linux, is having a major launch of a new version of their OS and is known for sponsoring "research" that shows that Linux is the tool of the Devil? Hmm.... Is it Bill, the mild mannered janitor? Could be, could be!
TWW
"Encyclopedia" is to "Wikipedia" what "Library" is to "Some people at a bus stop"
Original here: http://www.acm.org/classics/sep95/
Description here: http://www.tuxedo.org/jargon/jargon.html#back door
BTW, why is slashcode telling me I've violated the postercomment compression filter when I attempt links?
Yep, I've thought for a long time that the anti-virus software companies have a lot to be gained by writing viruses themselves (I'm using a loose definition of the word 'virus' here).
A few years ago I was perusing the virus database of a large anti-virus company. They categorised virii in various ways, and one of the attributes was where it had been found. The majority were 'laboratory only'.
Now, what does that mean? If it's only been found in the 'laboratory', then it must have been created there.
I'd be delighted if someone who knows can enlighten me as to what 'laboratory only' really means.
Yours Sincerely, Michael.
Cindy: Oh Harry, You're so smart! It really turns me on!
Harry: Oh wow!
Cindy: As soon as you finish that, I'll think up something to allow us to Celebrate!
Harry: Oh, WOW!!!
<horse braying>
Singers: "TROJAN MAN!!!"
Trojan Man: Looks like you two are planning to... exchange private keys?
Harry & Cindy: Well... Uh... I don't...
Trojan Man: Try new Linux Trojans! The Condom for the virus conscious!
Harry & Cindy: Thanks Trojan Man!
Trojan Man: My job is done here!
<horse braying>
Trojan Man: Yes, we'll find a philly for you some day...
Hey, geeks can dream, can't they?
I'm a leaf on the wind. Watch how I soar.
1) You have to be reading your email as root (unless of course you're stupid enough to have some other user write access to /bin files)
/bin/ls was changed seconds after executing said binary
2) You have to download, chmod +x and run a binary program from an email, presumably one that doesn't come from someone you know
3) You have to be stupid enough not to notice that
...
Can anyone say "stupid man's trojan"?
icqqm [ICQ:11952102]
Do not attribute to malice what can be explained by stupidity.
Who ever wrote this article is just plain silly!
As has been repeatedly pointed out, it would take a complete idiot to save an unknown binary file, chmod it, and run it as root. But you would have to *get* the binary before you could do that. Most of the talk about Linux virii and trojans is very hypothetical. Independent of all the theoretical reasons why they don't occur widely on Linux there is the empirical fact that there has never been anything affecting the same percentage of Linux systems that Cod Red or Sircam did for MS products.
This case seems no different. All the hype is little more than a scam by an anti-virus software company.
In other words this trojan is likely to affect the vast hordes of Linux users that always log in as root, use their Linux box to read email, and who automatically install and run binaries that the receive off the Internet.
All five of them.
Seriously speaking, this is one of those areas where Windows users see how easy it is to use email to trick Windows users into triggering trojans and they figure that Linux must be similarly vulnerable. It isn't.
First of all, most Linux users, even new Linux users, don't do much of their work logged in as root. In Linux it is trivial to use su or sudo to become root as necessary, and this particularly trick is one of the first that most Linuxers learn. Second of all, Linux does not make it easy to run foreign executables. No Linux client I can think of allows you to simply click on an attachment and automatically run it. Besides that, even if the person does run the executable how does it spread. Windows email viruses rely on the fact that they can programatically access the Outlook address book. Even Windows users who use Eudora or Netscape Messenger are immune to this trick. Under Linux the question of how the trojan is going to email itself to my friends is even more difficult. There are literally hundreds of mail clients that see active use. Your trojan would need to parse many different kinds of text based address books (heck, there are probably three different Emacs packages that one could use as an address book).
And when all was said and done the chance of this trojan spreading are nearly nil. After all, even if one Linux user got infected, and the trojan successfully mailed itself to 200 of his closest friends chances are good that very few of these friends would be running Linux, and chances are even better that none of those friends running Linux would be similarly vulnerable (or nearly as dense). The trojan would refuse to spread, and that would be the end of it.
Comparing this trojan to the Code Red worm is laughable.
Comparing a few newbies potentially being stupid enough to run an executable recieved in E-Mail as root to Code Red is quite a stretch.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
To me , the real issue here is whether this trojan will have much of an impact on Linux boxes, but its impact on people's perceptions of Linux.
If the popular media picks up a story that "LINUX USERS FACE DEADLY TROJAN (film at 11)", it will help create a perception of vulnerability, and its a small step to go to "and since Linux is freely distributed, who knows what can lurk in that copy you download..." While techies familar with Linux will have a reasonable grasp of the true threat and how to overcome it, what about the deciosn makers who are deciding what to implement at their companies? The ones that set budgets and decide what IT will implement (and IT may not have much of a say in the decision) will remmebr "Linux - oh yeh, that's the system that got hit with that DEADLY TROJAN."
I'm a consultant - I convert gibberish into cash-flow.
Perhaps I'm stupid for not buying Qualys virus checker but this whole thing sounds bizare. What is the subject of the email? What does the email say?
:P By the well know usenet-troll formula, Qualys is on it's last leg.
I have tried many of the linux email programs at one time or another--pine, elm, mutt, postilion, balsa, tk-rat, kmail, evolution and sundry others to numerous to recount. And lets face it people, for proper email viruses you need an advanced Microsoft email client. Outlook is a good example.
First there is the problem of automatic or almost automatic execution. Linux email clients have not yet achieved the same optomistic attitude towards code in email attachments as Outlook. However, anyone who has used Linux is already familiar with this and I do not need to elaborate.
Then, because Linux lacks any sort of standards (http://microsoft.com for more information), there is no easy way to send emails out to everyone on the persons list. The easiest thing would be to use perl. But even this is poses problems and the Qualys guys don't mention anything about perl or how it sends the emails out.
Personally, I really doubt Qualys knows what it's talking about. Look at how many times Qualys has been talked about in the context of linux. Compare that to a reputable Linux endeavor.
And also... Any security company should know that the only way to clean an infected computer is to reinstall. Installing more close source software on top of the close source virus seems like a silly thing to me.
(Not that I think Qualys would deliberately do something wrong but they don't seem competent enough to analyse this virus thouroughly or program a bug free fix).
This is no more an issue than the is the "threat" of linux-based viruses. C'mon. Only a complete IDIOT would would "infect" his system with this sort of virus/trojan.
Linux COULD be affected by a virus IF root ran a virus-infected app or if one of the linux office suites develops a hole-laden macro system ala Word - IF that macro was run as root.
This is no threat or problem to any linux system except those few morons who do everything as root and would actually download and run an unknown application off the net as root.
This is a sham. This is FUD. This is either an M$-supported FUD or an attempt by some bozo to get web hits and, as another poster mentioned, harvest email address. Hello spam!
In Bushworld, they struggle to keep church and state separate in Iraq as they increasingly merge the two in America.
Notice how ordinary communication paths are re-named to "infection vectors" to make them sound technical and dangerous - way to go Hemos ;)
/. warned me - otherwise I might just have saved the program, marked it as executable, su'ed to root, and run it on my main web/ftp servers or the firewalls. Year, right...
Anyway, it will be fun to see if the crap media picks this one up "uh no! a worm on Linux, we always knew it would happen! we haven't seen it yet, but someone mentioned it may get worse than CodeRed!"
But I'm really happy
Just a WAG here, but it could be that may virus writers just write them for fun and fame. Write a quick virus, put in your name or the name of something you are interested in, send it off to the virus labs from an anon account, and you are in a virus database ad infinitum. No real harm done.
I think it'd be a perfect opportunity to show off Linux's advantages, though. Sure you can get infected by this. But most Linux users don't routinely run as root, Linux provides a nice firewall system and you need root privileges to alter that firewall. So even if someone's infected, if they've blocked UDP port 5503 ( and maybe higher ports, wherever the Trojan will listen ) with the firewall then even if they're infected the Trojan can't be contacted and exploited and a simple script can be put into crontab to check for a) the listening connection, b) the lockfile and c) the rejected incoming attempts and alert the user. It'd take me maybe an afternoon to come up with the scripts that'd run on any Linux system.
So let them hype this one up, then demonstrate the 2 minutes' work it takes to immunize your system against it if you're dumb enough to run unknown software manually, and then note that you aren't that dumb in the first place.
(In all fairness to them, they do provide source alongside the pre-compiled binaries, so the security-conscious can audit the code and recompile.)
This reminds me a lot of a rant or two by Rick Moen of SVLUG fame. The main problem is sysadmin inexperience. Granted, you can still trash your own files (and lose all your user data), but the system will be safe. So just run untrusted executables as a different, non-privileged user, if you must run them at all.
--
Runnin' around, robbin' banks all whacked on the Scooby Snacks...
This is different than just say opening your mail program and going to the inbox and reading a mail that wipes your hard drive like the "I Love You" Windows virus did.
Or better yet the code red which atacket web servers by causing a buffer overrun.
Yeah thats that same thing. And I'm Joe isuzu
Only 'flamers' flame!
For basic, non-security updates, I hit one of the mirrors for all my apt-get fun. While it may be unlikely that one of the main debian servers would be compromised, I wonder if they mirrors wouldn't be more vulnerable...
I guess these are the chances we take in binary upgrades, but I'm not sure that source would be much more safe, at least for those of us who don't personaly audit every single source update we do (I know I don't have the time).
This sig is false.
Uh, if I remember correctly, all you had to do to find out if you had the Code Red worm was look for a text file in the root of your machine. That, and there was an executable for people too brainless to do so. How was Code Red not "easily detectable"?
Careful. Sometimes its the simple ones that are most effecive.
---
Hi! I'm a sig virus! Please copy and paste me to your signature file so that I may propagate!
I ran across this a couple days ago and it looks like a publicity stunt for Qualysis to get some attention. Here's a Deja discussion that sheds a little more light on it.
In all my years using Linux/AIX/Unix I can't recall ever receiving an e-mail/web/ftp download that chmod +x's itself on the client. Unless of course you're overwriting a file +x-ed with that name. Good thing I don't have any scripts named "R00tMePlz.sh" laying around.
www.dedserius.com
VB != VisualBasic
Slashdot's group consensus seems to be that this trojan has no chance of spreading.
I politely disagree.
With the spread of easy-to-install Linux systems, people with relatively little technical knowledge have installed Linux. These people are the ones most likely to fall for the trojan.
The only question... how could they get a list of newbies?
Never play leapfrog with a unicorn. Or a juggernaut.
This is dangerous:
# mv binary_attach
Please:
$sudo rm binary_attach
would be preferable. Some recent RH converts still don't know what a device file is...
www.dedserius.com
VB != VisualBasic
probably mark every reply down as "redundant". don't even know why i bothered to read it.
I've finally had it: until slashdot gets article moderation, I am not coming back.
Dwonis ducks and takes cover.
Using the find command mentioned in another comment, have a look at all the setuid/setgid executables. If you see something you know that machine isn't going to use, you can either remove its package, or unsetuid/setgid it.
Eg., if the machine is a webserver which will never be connected to a printer, you can get rid of lp, lpr and friends.
If you don't know what a program does, check the manpage. If it doesn't have one, try a websearch or unsetuiding it to see what breaks. (In my experience BSD has the best manpage availability and quality - eg., even each kernel driver has its own manpage.)