Linux Virus Alert

marcjw writes: "I don't see many of these (Linux virus alerts). In fact none in the six months or so since I've switched from MS. Maybe that's why this story from newsbytes caught my eye. At any rate, I'm not sure if this poses much of a threat to the general Linux community but it's always best to be forewarned."

Comments

Re:This cracks me up.

[Anonymous Coward]

hmmm.. social engineering anyone?

localhost:~$ tar zxf some-random-binary-0.0.1.tar.gz
localhost:~$ cd some-random-binary-0.0.1
localhost:some-random-binary-0.0.1$ ./runme

This program must be run as root.

localhost:some-random-binary-0.0.1$ su
Password:
localhost:some-random-binary-0.0.1# ./runme

Sucka!


Another point.. when was the last time you actually checked the code of something you've compiled? lets say instead of some-random-binary, it's some-random-young-sourceforge-app. Jeez, get off your fucking high horse.

Re:Protection?

[sjehay]

Yes - well, sort of. There are plenty of anti-virus programs out there, such as:

• Kaspersky
• Trend Micro
• RAV

and so on. Symantec/Norton also has a Linux/UNIX binary which is certainly bundled with the network-wide thing, I don't know if it's available separately. The trouble with all of these things is that although they are Linux applications, they detect Windows virii - they use the same signature files as the versions on other platforms do. This means they're very good for running on file/e-mail servers to protect the poor Windows machines behind them (which is what they're intended for) but they probably won't stop the subject of this post, for example. Basically, yes, they exist and work well but make sure you know what you're hoping for them to do...

Running binaries as root

[adadun]

Ya, I run lots of unknown binaries while logged in as root, it's my favorite activity.

I realize of course that you are joking, but I do believe that a lot of users run a lot of untrusted stuff as root. How many times have you run "make install" as root? I certainly have done it a few times for software packages that I downloaded from untrusted sources and without having read through the entire Makefile first. Who knows what kind of programs that I might unwillingly have run as root?

RPMs or other packages that are downloaded from more or less untrusted locations without encryption signatures might very well run a few evil scripts during the installation process (which, of course, is done as root).

To be really sure, one should always install new programs in a chrooted jail; the software should be installed in a totally new branch of the filesystem tree and the installation process should not be able to read of write to other parts the filesystem.

Re:Running binaries as root

[BlueWonder]

How many times have you run "make install" as root?

Never. I want to have full control over and knowledge of where each file is installed.

If the Makefile has been generated with GNU Automake (which is true for maybe 90% of all Makefiles I encounter), there is an easy solution: Install with make install DESTDIR=~/tmp as ordinary user, and if you agree with the file layout under ~/tmp, cp the files to their final location as root.

Re:This cracks me up.

[ljaguar]

OK, I'm really sick and tired of those people who say "Oh, I run binaries as root, so you do too."

Have you every thought of /usr/local?
./configure --prefix=/usr/local?

My /usr/local is writable by my staff. My staff consists of... me. So, I have root, my desktop login and staff. Just install stuff on /usr/local, as staff. Voila. Staff can't touch my $HOME or any of the system binaries. So any malicious script (at install time aka make install) is pretty much contained in... /usr/local.

Let's say I run a infected binary in /usr/local/bin as my desktop login. I loose my stuff. You can argue that this is just as bad, but my system is still not compromised.

This isn't rocket science, guys.