Slashdot Mirror

← Back to Stories (view on slashdot.org)

Beware 'Fedora-Redhat' Fake Security Alert

Posted by timothy on from the don't-get-took dept.

rixdaffy writes "I just received an email from the 'Redhat Security Team' telling me that I needed to download some tar file from fedora-redhat.com. Besides the fact that I don't use Red Hat/Fedora, I immediately smelled something fishy. Maybe it's not the first trojan targeted at Linux users, but together with the official sounding domain, it could trick some users into downloading and running the binary. It looks like Red Hat is already aware of the issue." According to Red Hat's page, "These emails tell users to download and run an update from a users home directory. This fake update appears to contain malicious code." Update: 10/25 01:32 GMT by T : One borked link, unborked.

3 of 628 comments (clear)

  1. Re:We knew this day would come by Solean · · Score: 0, Flamebait

    Linux users are proven to be smarter than the Windows breed of the human race. :)

    --
    -=Insert Witty Comment.=-
  2. Re:text of site by SnowZero · · Score: 1, Flamebait

    By the way, you want to use "affected", not "effected", which is a mistake the site also makes.

  3. Re:Christ, they didn't do a very good job... by Erik+Hollensbe · · Score: 0, Flamebait

    7.3 is widely used. It's because it was the last version of RH that wasn't nearly as chained to the desktop before the Fedora guys came in (who some would say made it worse).

    Most of the people running 7.3 are either doing it because it's too costly to upgrade (money is generally not as much of a problem as time or suggestively, downtime) and a good admin can keep things patched regardless.

    Those that are moving but are keeping RedHat are generally looking at RHEL. 7.3 is no longer supported which is the prime motivator, not any technological benefit.

    God damnit, I hate it when some clueless fart machine spits out something that is patent B.S. and then covers it all under the umbrella of "security". Even the servers with the best service contracts don't rely on that to make their systems "secure". It's common practice to "roll your own" where it's really important.