Looking At The New Linux Trojan

Da Schmiz writes: "Security firm Qualys discovered a new Linux trojan on Saturday ... details can be found on their website.. Vnunet picked up the story earlier today, and then followed up with more details. They're comparing the potential impact to Code Red or worse, since more servers run Linux / Apache than NT / IIS. I don't think it's that bad, since the infection can be easily detected, but it certainly isn't good." Update: 09/08 11:58 AM GMT by H : Of course, as Kurt Siefried pointed out in e-mail: "The trojan has nothing to do with Apache. The virus attaches itself to an executable, which you must run to infect other binaries (i.e. you must run this as root). This means that infection vectors include, but are not limited to email attachments, but you must of course save the binary, then set it executable, and then run it, as root, to do any real damage. Alternatively you must download binary software and run it (again as root to do any real damage). In other words someone must run binaries of unknown origin as root, and if this is common practice then you have larger policy and education problems to deal with." So - comparing it to Code Red is a bit dubious.

Comments

What file did they find did this trojan infect?

[BrookHarty]

It says initially surfacing in the /bin directory, ok what file? What distro? What rpm? What .tgz do I have to watch out for? Little more info please. I don't know that any unix admin who would run /bin utilities that they get off the Internet, maybe source, but not binaries.

This is no way as bad as Code Red, Code red self replicated on unpatched servers. This trojan will not replicate without a user doing it. Sheesh, bad journalism.

a similar story in history

[Tregod]

"...a guard at the top of the castle gates spots something in the distance, just beyond the walls. What could it be? Its...a giant wooden penguin! Imediatly, guards from different corridors of the castle rush to percieve what appeared to be a gift from the gods. All at once, they hoisted the behemoth bird onto a make shift wagon and hauled it within the castle. After much celebration and talk of good tidings, the kingdom lay it's head to rest. Later on that night, the wooden bird's bottom opened, releasing thousands upon thousands of Bill Gates' shock troops, sent to terrorize the castle and townspeople."

This explains a lot...

[ASCIIMan]

Now we know why slashdot has been down so much the last couple days.

Partial isinformation

[sigwinch]

Unless it also ... fiddles with my hosts.allow file, I'm not particularly concerned.

Whoa, cowboy! /etc/hosts.allow only affects friendly programs that bother to parse it (e.g., inetd, or programs that use tcpwrappers). An unfriendly program is free to ignore it.

However, your advice to use kernel firewalling is sound. 'Defense in depth' is the only way to go.

Don't worry, this is no Linux Code Red

[Xenna]

For starters to get infected with this animal requires activity on the part of a user on the Linux box.

Code Red required no user activity at all. A typical orphaned Linux box standing around in a corner would not be at risk, the same machine running IIS would have been a sitting duck for CR. There are a lot of orphaned servers out there with standard Redhat or IIS installs. These are the real danger. Any remote-root security holes on these popuplations are cause for real concern.

I don't know if I'm typical or not, but where I work, Linux is used on servers (yup, I'm responsible for that) but we hardly ever read our mail on a Linux box. We use a Windows platform for that. So -> no risk.

I'm thinking a Linux desktop user would be a better victim for this. Fortunately, hardly anyone uses Linux on the desktop so we're all safe!

Regards,
Xenna

These journalists must be desperate for attention.

[hebble]

First: why is Apache mentioned AT ALL? It sounds like this thing only "spreads" (if you can even call it that) when someone is brain-dead enough to READ their EMAIL as a user who can WRITE to IMPORTANT BINARIES! That has nothing whatsoever to do with Apache. Is it just to support the idea that there are a lot of Linux servers?

As virii go, this is pretty pathetic, and prompts one to question the competence of anyone who thinks it is significant. The email-vector mechanism can't even take advantage of address books, since Unix mail clients are so far from standardized.

A new one has been found!

[friscolr]

Advisory # 44526

FOR IMMEDIATE RELEASE

Overview

The Really Silly Command Virus identified by Blackant Systems has the potential to remove all files from a hard drive. It was recently spotted in the wild a few days ago when a junior sysadmin logged in as root on a production server and executed a shell script he had been emailed from a user known only as script_kiddie@hotmail.com.

Impact

Given a detailed analysis of the source code behind this virus, it is possible that the Really Silly Command Virus may eventually mutate into a self-propagating worm.

Recomendations

Blackant Systems reccomends that every sysadmin who would run shell scripts from untrusted parties be shot.

In order to determine if your email may contain this new virus, please look for the following first few lines in a shell script:

#!/bin/sh
#1337 script by script_kiddie!!!
#props to all my homies!!!!
rm -rf /

#this doenst seem to work yet...
mail $0 $1

If you find a file with similar lines, do not execute it on your server, but remove it immediately. Blackant Systems will be releasing a utility to identify stupid sysadmins shortly.

The New Linux Trojan!

[bgarcia]

Harry: Just a few more lines to be debugged, and it'll be finished!

Cindy: Oh Harry, You're so smart! It really turns me on!

Harry: Oh wow!

Cindy: As soon as you finish that, I'll think up something to allow us to Celebrate!

Harry: Oh, WOW!!!

<horse braying>

Singers: "TROJAN MAN!!!"

Trojan Man: Looks like you two are planning to... exchange private keys?

Harry & Cindy: Well... Uh... I don't...

Trojan Man: Try new Linux Trojans! The Condom for the virus conscious!

Harry & Cindy: Thanks Trojan Man!

Trojan Man: My job is done here!

<horse braying>

Trojan Man: Yes, we'll find a philly for you some day...



Hey, geeks can dream, can't they?