Slashdot Mirror
Beware 'Fedora-Redhat' Fake Security Alert
rixdaffy writes "I just received an email from the 'Redhat Security Team' telling me that I needed to download some tar file from fedora-redhat.com. Besides the fact that I don't use Red Hat/Fedora, I immediately smelled something fishy. Maybe it's not the first trojan targeted at Linux users, but together with the official sounding domain, it could trick some users into downloading and running the binary. It looks like Red Hat is already aware of the issue." According to Red Hat's page, "These emails tell users to download and run an update from a users home directory. This fake update appears to contain malicious code." Update: 10/25 01:32 GMT by T : One borked link, unborked.
I wouldn't worry, they're probably on the forums trying to find the command to install it.
Whois of fedora-redhat.com:
;)
Domain Name.......... fedora-redhat.com
Creation Date........ 2004-10-24
Registration Date.... 2004-10-24
Expiry Date.......... 2005-10-24
Organisation Name.... Raymond Jackson
Organisation Address. 224 Cedar Avenue
Organisation Address.
Organisation Address. New York
Organisation Address. 95301
Organisation Address. NY
Organisation Address. UNITED STATES
Admin Name........... Raymond Jackson
Admin Address........ 224 Cedar Avenue
Admin Address........
Admin Address........ New York
Admin Address........ 95301
Admin Address........ NY
Admin Address........ UNITED STATES
Admin Email.......... rayjackson23@yahoo.com
Admin Phone.......... +1.2098994533
Admin Fax............
Tech Name............ YahooDomains TechContact
Tech Address......... 701 First Ave.
Tech Address.........
Tech Address......... Sunnyvale
Tech Address......... 94089
Tech Address......... CA
Tech Address......... UNITED STATES
Tech Email........... domain.tech@YAHOO-INC.COM
Tech Phone........... +1.6198813096
Tech Fax............. +1.6198813010
Name Server.......... yns1.yahoo.com
Name Server.......... yns2.yahoo.com
Looks like somebody's gonna get arrested.
Running untrusted code can result in system compromise.
Everyone checks the gpg signatures right?
Now if each time when someone tries this sort of thing gets their server posted here on slashdot, we could actually do something good with the slashdot effect and put their server up in smoke before much damage is done. :-D
home
or better yet, it Microsoft paid the Yankee group to do it for them, and then do an "independent study" on it.
I'm sure glad I'm using windows!
Dammit why does Linux have to be so complicated, I mean damn you have to compile your own viruses and everything!!!!
Debian has been weeding out incompetent users with its "impossible to use" installer for years.
It keeps the "Mandrake Crew" off of the debian-users lists.
But I am running SUSE! Am I adviced in similar fashion? Perhaps I too should applying patch lest SUSE found vulnerability also? Thankyou to www.fedora-redhat.com for adviced me in this helpful manner against remote attackers!
Ok, that was a horrible misspelling of malicious :|
Thanks for posting that! Whew, I sure am glad I managed to get that patch installed before anyone was able to take over my system...
I'll turn into a supernova and burn up everything. Well I'll turn into a black little hole and you'll turn into string.
The funniest part is that the code (a shell script compiled into C code, then into a binary, to obfuscate its purpose) failed miserably on my test systems, both Knoppix AND Fedora Core 2. It spat out a bunch of errors which completely revealed the fact that it was trying to add a user, start sshd, etc. C'mon, if you're gonna terrorize the Linux world, at least do it right!
>md5sum fileutils-1.0.6.patch.tar.gz
68349c219d941209af8f7c968b89d622 *fileutils-1.0.6.patch.tar.gz
So you can be sure you're getting the real fake patch.
The shareholder is always right.
This was version 0.1 of the trojan, and is not yet ready for public release. With helpful contributions like your, we hope to use the "many eyes" approach, in keeping with the OSS philosophy, to form a complete and fully featured trojan.
Thus we would like to thank you for your generous time in helping this valuable project reach its full potential.
You may also like to take note of our web site www.bugzilla-Fedora-Redhat.com, where we have set up a forum dedicated to improving our product.
Don't forget the domain that the script emails, root@addlebrain.com
Sorry to dissapoint you, but I doubt he owns the domain - they offer free webmail, so it's likely he just signed up for an account. Presumably they didn't stop anyone from getting the username 'root' - I signed up for 'administrator' just now (password 'monkey' if you don't believe me) with no problems.
If the Antivirus companies were responsible, they'd have done a better job.
If Microsoft was responsible, they wouldn't have included any source code.
If SCO was responsible, they'd have included sourcecode and then sued you for running it
All things taken into consideration, I'm with 'other' on this one
Ripping an new rectum in the fabric of spacetime.
(Mind you, I'm no better. First time I got a computer virus, when I was running MSDOS, my first reaction was to run a binary diff against a clean version of the file, and disassemble the result to see what it did. Do you know if there's a cure for this?)
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
How do we know this isn't a trojan ;)
Surely we just have to send a load of bogus reports to root@addlebrain.com and he'll have a fun time trying to find the genuine ones.
.mil and .gov sites. :o)
If you do, make sure the IP addresses are of
It's safe to view, as long as you don't go trying to compile and run it! :-p
Hey, stop trying to deny my GPL rights you Windows-loving tyrant!
I knew, my habit of not updating my systems would help me someday.
Python script to convert photos into "artsy" portraits: http://p2pbridge.sf.net/pyPortrait/
And I think I'll "benchmark" the site a few million times.
e =XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXX'
/usr/sbin/ab2 -n 10000000 -c 10 'http://www.fedora-redhat.com/?you=asshole&garbag
This is ApacheBench, Version 2.0.40-dev <$Revision: 1.121.2.8 $> apache-2.0
Copyright (c) 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Copyright (c) 1998-2002 The Apache Software Foundation, http://www.apache.org/
Benchmarking www.fedora-redhat.com (be patient)
Power to the Peaceful
It appears the human body maintains a temperature of approximately 98.6'F... lemmie shove a thermometer up my @ss, and I'll report back my findings here.
Oops.
--Power to the Peaceful
"What can be done to prevent this from happening in the future? What failsafes can be built into Linux to prevent people with less than average pc skills from destroying their systems?"
No monitor.
What do you mean it is not done??? It has the MS quality control stamp all over it. It is not a bug, it is a feature. :):):)
I prefer the "u" in honour as it seems to be missing these days.
Don't you mean www.bugzilla-Fedora-RedHat.com?
Try:
These are more than good enough.
I prefer the "u" in honour as it seems to be missing these days.
I can just imagine...
./configure
"Attached is a sexy picture of Anna Kournikova.
To view the picture, simply:
1) save the attachment
2) su -
3) tar -xjf anna.tar.gz
4)
5) make
6) make install
7) anna"
Maybe it's not the first trojan targeted at Linux users, but together with the official sounding domain, it could trick some users into downloading and running the binary.
This is an unfortunate reality today. Back in my day, the only way to be a real Linux guru was to compile and build your system from scratch using a dev box.
Nowadays, any average person can easily install Linux and instantly become "31337". Today's typical Linux user has no idea what half the files on his system do, or where they came from. Unforunately, the majority of you with moderator points fall into this category so my post is doomed!
I would advise those who are new to Linux to visit the Linux From Scratch website and set aside a weekend of learning. There is no better method for gaining useful knowledge regarding the reduction of hard drive clutter and increasiong optimization, and security.
This is an honor virus. Please forward to all your friends, then format your hard drive(s). Thank you.
I feel fantastic, and I'm still alive.
In India or U.S.?
What's interesting, is that I actually got this message as a forward from one of my clients, who uses Progeny updates.
I was in a hurry, I didn't even think about the fact that Redhat is not Progeny, so my response was to simply run "yum update", a quick preview (there was only like two, not very important packages to update) and that was it. All of about 5 minutes, and I did nothing further, since the kernel wasn't updated and no running services were affected.
I forgot all about it until now, reading this article!
I have no problem with your religion until you decide it's reason to deprive others of the truth.
This is a buggy honor virus. Please format your hard drive(s) and then pass it to all your friends.
Thank you.
Free Software: Like love, it grows best when given away.
It's more than just a faulty presentation--the whole premise is innane:
ls and mkdir are running as a network server with root privileges? How did that happen?
Besides, we all know RedHat systems configure ls and mkdir to change to low-privilege users (lsnobody and mkdirnobody) after accepting the connection (unless you modify /etc/ls.conf or /etc/mkdir.conf, that is).
Besides, we all know RedHat systems configure ls and mkdir to change to low-privilege users
We do?