Korean Mozilla Binaries Infected

Magnus writes "Korean distributions of Mozilla and Thunderbird for Linux were infected with Virus.Linux.RST.b. This virus searches for executable ELF files in the current and /bin directories and infects them. It also contains a backdoor, which downloads scripts from another site, and executes them, using a standard shell."

Comments

Virus data

[NoInfo]

This virus has been in the wild since at least early 2002.

Here's Symantec's take on the virus:

http://securityresponse.symantec.com/avcenter/venc /data/linux.rst.b.html

Black day for Unix Firefox users

[teslatug]

A new flaw affecting Firefox users under Unix allows webmasters to craft a URL that when run from an application like Evolution can execute any command. The flaw stems from the use of backticks in the shell script used to launch Firefox. Read more about it here on the Secunia advisory. Version 1.0.7 fixing the flaw is already out.

Re:Secure..

[Anonymous Coward]

Actually Linux is more secure. If you run mozilla as a normal user, then mozilla and the virus can't write to the files in /bin, and therefor can't do any really servere damage.

Re:6 stories down on the front page

[tpgp]

"Mozilla hits back at browser security claim"

Funny? Yes. True? No - you see its not exactly a mozilla problem.

Whilst searching for more information about this, I stumbled across this pagelast time these servers were hacked in June).

Choice quote:

Unlike Mozilla Europe, Mozilla Japan and Mozilla China, the Korean Mozilla site is not officially affiliated with the Mozilla Foundation.

So, its not mozilla.org (the article states "on public servers. Mozilla.org is the latest example")

Its someone who's taken the mozilla source and made their own binaries. A problem yes, a serious problem even, but not to the scale that Kaspersky Labs would have us believe.

Who would have thought it? A security company overhyping an issue!

I'm not sure why they bother. Do they really think stories like this are going to make linux users go and buy their security 'solution'?

no surprise

[burnin1965]

The web site was hacked 3 months ago and back then they admitted the site was not an official Mozilla site.

http://www.mozillazine.org/talkback.html?article=6 771

Sorry for hack.
by channy

Thursday June 9th, 2005 6:39 PM

Reply to this message

This is Channy Yun, leader of Mozilla Korean Community. This site is not official web sites of Mozilla Foundation. And this hack is orginated by no patch for PHP vulnerability of my hosting company for mozilla.or.kr. I will change it with backup and fix it with my ISP. Sorry for your worry.

I'm thinking they should give up their domain which likely causes the confusion and give the false impression that what you are downloading from the site is an official Mozilla binary.

burnin