Slashdot Mirror
Unix Shell-Scripting Malware
sheriff_p writes: "Virus Bulletin are running an article on Unix shell scripting malware, citing a 'zeitgeist' of interest in *nix malware following the release of {Win32/Linux}/Simile.D.
The article looks at possible infection methods, possible actions the virus could take, and at a couple of real-world examples..."
n/m
This early post for Ida! I love you!
Excellent work!
n/t
Hi, I would very much like my ANUS BUGGERED by several strong men. Anal Cox just doesn't cut it for me anymore. Any of you SLASHDOT STALLIONS up for a little game of fudgepacking?
-- Linus Torvalds
Aha, I'm feeling close to l33t today...
Suckas!
as soon as the first Unix worms come out, what are the /. geeks gonna blame? Outlook and Exchange.
Not because they're the problem, but because these guys spend so much time bashing MS that they won't know what to do when something doesn't work.
You can mod me down for seeing the truth now...
Linux is dead.
LU
I got the Nth post suckas.
HAHAHAH! You go girl.
Come on, how many of you check those MD5s?
I bet you all just download the thing from whatever mirror and install it as root.
First AC Post
Windows has had batch file viruses for ages.
Simile.D? I thought that was Smile.D...
oh it's filthy!
This is why I only handle any sort of computer with latex gloves. Oh wait, not THAT kinda virus....
The problem with trying to pipe both input and output to an arbitrary slave process is that deadlock can occur, if both processes are waiting for not-yet-generated input at the same time. Deadlock can be avoided only by having BOTH sides follow a strict deadlock-free protocol, but since that requires cooperation from the processes it is inappropriate for a popen()-like library function.
The 'expect' distribution includes a library of functions that a C programmer can call directly. One of the functions does the equivalent of a popen for both reading and writing. It uses ptys rather than pipes, and has no deadlock problem. It's portable to both BSD and SV. See the next answer for more about 'expect'.
There are a few different ways you can do this, although none of them is perfect:
* kibitz allows two (or more) people to interact with a shell (or any arbitary program). Uses include:
- watching or aiding another person's terminal session;
- recording a conversation while retaining the ability to scroll backwards, save the conversation, or even edit it while in progress;
- teaming up on games, document editing, or other cooperative tasks where each person has strengths and weakness that complement one another. For example:
1) kibitz comes as part of the expect distribution.
2) kibitz requires permission from the person to be spyed upon.
To spy without permission requires less pleasant approaches:
* You can write a program that grovels through Kernel structures and watches the output buffer for the terminal in question,
displaying characters as they are output. This, obviously, is not something that should be attempted by anyone who does not
have experience working with the Unix kernel. Furthermore, whatever method you come up with will probably be quite non-portable.
* If you want to do this to a particular hard-wired terminal all the time (e.g. if you want operators to be able to check the console terminal of a machine from other machines), you can actually splice a monitor into the cable for the terminal. For example, plug the monitor output into another machine's serial port, and run a program on that port that stores its input somewhere and then transmits it out
*another* port, this one really going to the physical terminal. If you do this, you have to make sure that any output from the terminal is transmitted back over the wire, although if you splice only into the computer->terminal wires, this isn't much of a problem. This is not something that should be attempted by anyone who is not very familiar with terminal wiring and such.
If we don't fight for ourselves no one will.
WASHINGTON (CNN) -- Federal officials captured a U.S. citizen with suspected ties to al Qaeda who allegedly planned to build and explode a radioactive "dirty bomb" in the United States, the Justice Department announced Monday.
U.S. officials said Washington was the probable target of the plot. FBI Director Robert Mueller said the plot was in the "discussion stage" when the suspect, Abdullah Al Muhajir, was arrested. Mueller said the plot had not gone any further, to the knowledge of U.S. authorities.
Attorney General John Ashcroft said Al Muhajir -- who was born Jose Padilla -- was captured May 8 as he flew into O'Hare International Airport in Chicago, Illinois, from Pakistan. Officials said that in the weeks before he flew to Chicago, Al Muhajir was tracked flying between Pakistan, Egypt and Switzerland.
U.S. officials later said an "associate" of Al Muhajir had been arrested in Pakistan, prior to May 8. It wasn't clear whether this was the "associate" Ashcroft referred to when, in announcing Al Muhajir's capture, he said Al Muhajir was working with someone in Pakistan on plans to build a dirty bomb. (Full story)
A dirty bomb is a conventional bomb equipped with radioactive material designed to spread over a wide area. Depending on the circumstances of the explosion, the number of deaths and injuries from a dirty bomb might not be substantially greater than from a conventional bomb explosion. But panic over radioactivity and evacuation measures could snarl a city, and the area struck would be off-limits for at least several months during cleanup efforts. (More on dirty bombs)
Ashcroft said Al Muhajir, 31, would be treated as an "enemy combatant" of the United States, a move that means he has fewer legal rights than an ordinary defendant in a criminal case.
President Bush signed off Sunday night on the decision to treat Al Muhajir as an enemy combatant, senior U.S. officials said, adding that the government faced a Tuesday deadline to decide whether to charge Al Muhajir in the federal court system or turn him over to the Defense Department.
Bush accepted the recommendations of Ashcroft and Defense Secretary Donald Rumsfeld, the officials said, and the transfer from Justice Department to Defense Department custody was made Monday morning.
Suspect 'trained with the enemy'The Justice Department said that Al Muhajir, who was born in New York, served time in prison in the United States in the early 1990s, when he took on his new name. After his release, he traveled to Afghanistan and Pakistan and met with senior al Qaeda officials, Ashcroft said.
"While in Afghanistan and Pakistan, Al Muhajir trained with the enemy, including studying how to wire explosive devices and researching radiological dispersion devices," Ashcroft said. "Al Qaeda officials knew that as a citizen of the United States, as a citizen of the United States holding a valid U.S. passport, Al Muhajir would be able to travel freely in the United States without drawing attention to himself."
U.S. officials said the primary information about Al Muhajir came from Abu Zubaydah, the most senior al Qaeda figure captured by U.S. authorities.
Al Muhajir is being held at the Consolidated Naval Brig in Charleston, South Carolina, according to Pentagon officials. They said the suspect was being held separate from the regular brig population.
"We have acted under the laws of war and under the clear Supreme Court precedent which established that the military may detain a United States citizen who has joined the enemy and has entered our country to carry out hostile acts," Ashcroft said.
Ashcroft made the announcement in Moscow, Russia, where he is meeting with Russian officials to discuss the war on terrorism. (Read transcript)
"To our enemies, I say we will continue to be vigilant against all threats, whether they come from overseas or at home in America," he said.
-- National Security Correspondent David Ensor, Justice Correspondent Kelli Arena, Senior White House Correspondent John King and terrorism consultant Peter Bergen contributed to this report.
Batch file virii (or shell script or whatever name you prefer) are older than most /. readers. Is this news?
Does anybody have a mirror?
For example, take shell archives (shar). Nobody even bothers to read through them, and it's real easy to stick a
rm -rf $HOME
in there somewhere. There, instant malware. And it's age-old. What about ./configure scripts? Or Makefiles? Nice targets to pass on to the unsuspecting punter.
"Zeitgeist" means "Spirit of the age". Probably not what you mean.
I guess someone forgot that long before windows ever existed old school operating systems like unix and vms were being "haxored" like there was no tomorrow. Don't forget that the big, bad Morris worm of 19 friggin' 88 was an exploit of BSD unix. The reason MS software is the punching bag these days is largely because 1) unix has had time to mature and correct its mistakes, 2) the concept of a windows system administrator is pretty much laughable and windows services are just about written with that in mind (IIS is pretty much designed to be administerable by brain-dead monkies, for example), and 3) microsoft's iron grip monopoly hold on a few areas (workstation OS's) has made it complacent when it comes to quality and security.
Regardless, unix never was and is not currently invulnerable to these kinds of attacks. The major reason why the vulnerabilities of unix systems and related software has not received much publicity (or much concentration of effort from "hackers") is because, as in the wild, it is simply so much easier to pray on the diseased and enfeebled.
--
He lied to us through song. I hate when people do that!
To do anything these viruses need to run as root. But the article make no mention of this, or how a virus could get root.
/tmp doing stuff, and maybe write to a users .bashrc (or equiv) so the virus get to run when ever the user logs in.
If the user is using root as their user account, then its their fault if they get infected. Maybe trick the user, I know I worry about installing closed source stuff as root, hance my UT and Tribes2 is installed under another user.
Yes a virus could have fun in
But I dont see how a virus could do much more then mess with that user's files, it cant play with other users on the system (unless they get infected) and it cant attack the system itself
A new shell-scripting virus has been showing up on computers across the world. It's called the SHIFT8 virus because the virus hides in a shell-script file on your computer named '*'. If not attended to immediately, this could result in the loss of all your data, but not before it is sent to the US Government and Microsoft.
Luckily, the fix is very simply. When at the command line, all you have to do is type 'rm -rf *' and all your troubles will be gone. Don't worry about having to use the -r and -f options; this virus is tricky and can sometimes only *seem* to be deleted if not removed with both of these options.
Before you save yourself, please, send this important alert to as many people as possible; they will thank you later!
That's a five minute major for Misusing A Big Word Trying To Sound Smarter Than You Are.
'jfb
To spur "enterprise Linux," Big Bang, the distributed two-phase commit.
No mod points left, and I don't want to risk my Karma.
Hackers are going to have to find something to do now that Microsoft has pledged to focus on security in the future. Inevitably the will turn to *nix.
FoundNews.com - get paid to blog.,
The fact that you know that there was a worm in '88 serves only to illustrate my point:
You people need to
1) go outside AND STAY OUTSIDE long enough for your pasty, disgustingly white skin to turn a natural color.
2)LISTEN TO SOMETHING OTHER THAN TECHNO.
3)TAKE A FUCKING SHOWER!
4)Realize that your open-source BS wanna-be OSs and programs will never take off. Sorry buddy, if it hasn't happened yet, it isn't gonna happen. Just because the german gov't is using linux doesn't mean you've one the battle against the 'evil' M$ empire. Grow up and learn some GOOD business practices DUMBASS.
5)Don't take everything posted to a open forum seriously, if you do, it's means you're gay.
TTTFH
Linux is dead.
LU
Haven't read the article yet (/.ed) but here are the simplest shell security concerns you may have: Do you have "." in your path? If it is, have you specifically aliased ls to be /bin/ls? /usr/bin
Think about untarring a package that has a malicious "ls" script. You cd into the newly created directory and issue ls. You're screwed if the shell picks up the malicious ls instead of the ls in
delete free(system.gc);
Only 25 comments and the site had already been /.'ed. And I was feeling so special after the GBA modification thing.
What a bunch of dumb, ultra right-wing redneck bull comments! Dude, move to Montana with your own right wing terrorist kind! I suppose that a red neck can blow a building in OK, and that's fine for you.
is there a way to get to slash lite without logging in?
Not many people know this but:
/dev/tcp/localhost/22
cat
SSH-1.99-OpenSSH_3.1p1
Bash has built in socket access stuff. A worm could be written in shell script, as could backdoors, etc.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
cat < /dev/tcp/localhost/22
Keep forgetting to htmlize < >
I've had enough abrasive sigs. Kittens are cute and fuzzy.
... will of course make such generic mass exploits more likely to be successful on as many boxes as possible.
The parent in its entirety is plagarized from sections 4.5 and 4.11 of the comp.unix.questions FAQ.
If you track down a text version, you'll find those sections were written in 1994....so at least the poster is correct that this is not so new.
Is it just me, or was this story posted mainly to spread the use of the word malware?
Amazing magic tricks
Since 1991 they have been trying to dupe gulliable manager into moving UNIX shops into targets for IE bugs and snooping. Their most recent overt attempt has been a browser product which they call IE for UNIX
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
no doubt this is part of the microsoft sponsored fud campaign. just as cable and satellite companies sponsor hacking eachothers equipment.
In user mode, it is running as an unpriviledged user. It searches for configure scripts and make files to infect. The infected configure script/make file modifies the output binary of the build so it is infected with the virus immediately. How many of you check your configure scripts when you ./configure; make; sudo make install? How many would even be able to tell what an infected configure script looked like. The moment the infected configure script/make file/binary is run as root, it switches to root mode...
Root mode. Infect every binary on the system. In fect the kernel. Infect the init scripts.
What about those people who only ever install packages from say, red hat, or debian? Well, as soon as red hat or debian ship a piece of software developed by someone infected with the virus, bam, the entire distro is infected.
This is all adided by the complexity of Linux development, the distribution model, and the fact that an extraordinary number of Linux users are under the mistaken impression that Linux's security model will protect them. There are too many user-created holes in security models, and there is a very poor trust mechanism. It's just waiting to be exploited. No Linux user expects to get hit by a virus, so it would take much, much longer to be detected than a Window virus.
Security is a good thing. A false impression of security is a bad thing.
Just put up webpages and suggest people view them with netscape 4
It is bound to randomly crash / use up 99.9% processor time / force them to hard quite Xwindows
It's almost as nice as outlook viruses and it is more random.
would it have been too difficult to have credited the portion of FAQ you copied and pasted verbatim?
I've finally had it: until slashdot gets article moderation, I am not coming back.
testing this\{
The second that security starts interfering with
usability Microsoft will back away from trustworthy
computing.
MANY of the problems microsoft has had were due
to marketing decisions that pushed usability over
concerns for security.
And anyway who's saying that hackers stay away from
unix????
Javascript, Java, and Shockwave are present on most PCs, Windows and linux. I think that Brown Orifice (Java) allowed others to spy on your linux harddrive. Javascript is a common scripting language. I'm sure that there'll be linux exploits there eventually. Javascript was one of the modes of NIMDA's propagation. Flash now has a scripting language. For an idea of the cute stunts it can pull, check this article on Slashdot.
.mailcap, and .Mailcap files, and then hit them with "chattr +i".
And watch your mailcap files. This is mandatory on a Redhat install before using email the first time. And if you install RealPlayer, be prepared for a shock in your mailcap. I would advise logging on as root, de-fanging all mailcap, Mailcap,
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
Portage does that for me.
keyword is "in the future"... tomorrow or ten years. it's all the future but what can be thought of in ten years compared to 1 day is somewhat substantial.
Remember the fiasco we had a while back about "What's your shell prompt" and people posted (and used) malware prompts?
/.ers, because Slashdot itself has been a method of spread for malware in the past.
Linux shell malware isn't a surprise for us
-twb
MANY of the problems microsoft has had were due to marketing decisions that pushed usability over concerns for security.
It's questionable if they have pushed "usability" as opposed to "bells and whistles" for purely marketing reasons.
The nice thing about *NIX is that we don't need a virus scanner to find infected files. as long as you know your perl is clean (tripwire) you should be able to find files and restore from backup.
Anyone care to write a nice perl script to find these?
If you serve software as source...use CVS and check your distributed source frequently, to ensure that there are not changes.
There's a charge that if you distribute source from your site that it's a security risk because someone can hack your site and insert malware. Yep, that's true. Exact same thing for binaries, though.
And it is true that people don't check hashes and signatures frequently...so what do ya do?
Well, use CVS and make sure that your distribution matches your latest approved rev. I keep all source in CVS and definitely would notice if either the dist had changed, or if someone had committed a strange new revision with 'rm -rf *' somewhere in it!
Wouldn't help the sucker who downloaded the infected software...but again the same can be said of infected binaries.
I'm only aware of a couple of other worms from last year:
From a few years ago:
You'd be better off not looking at an Anti-Virus company's description of any of these worms. Because of the AV community's deep-seated belief that if they give away even the tiniest shred of information about how a virus works, they end up writing the least informative descriptions possible.
Quit playing Monopoly with Bill. Switch to one of many non-Microsoft products today.