Slashdot Mirror
Multiplatform Java Botnet Spotted In the Wild
It's fun sometimes to be smug because you are ("one is") using an operating system less susceptible to malware, or at least less targeted by malware creators, than is Microsoft Windows. Now, reader Orome1 writes with word of a Java-based, equal-opportunity botnet Trojan, excerpting from Help Net Security's report: "'IncognitoRAT is one example of a Java-based Trojan discovered in the wild that is being downloaded and installed by another component. This malware behaves like other Windows botnets but uses source code and libraries that can operate on other platforms,' explains McAfee's Carlos Castillo." So far, no mention of a Linux version, though.
It's in the wild !! A Java ... a what??
So far, no mention of a Linux version, though.
Someone tell me timothy is trolling. He can't really be that stupid, can he?
No mention of linux support. Do we always have to come last?
"So far, no mention of a Linux version, though."
Java is Java.. there generally would not be a "linux version", or any platform specific version.. sort of the whole point of this.
-Lod
I doubt that it works on MacOSX. Converting a jar to an exe is difficult. I wish I could do it reliably on Linux, but I can't (gcj doesn't really work). Jar2exe is Windows-only. So I don't see why we need to worry. Java itself is secure enough to at least make virus writing very difficult. So again, nothing to worry about. Another case of journalistic exaggeration.
I have always used virus infections not as a measure of the resilience and robustness of an operating system (we all know that any coder that claims their code is bullet-proof is a moron).
Rather, I use the infection rates as a measure of the significance of the operating system.
If the hackers don't want to hack your OS, then your OS is insignificant to them.
Now, I'm not about to make a case that the hackers' opinions are relevant, but lets face it... they're in the business of market penetration. As soon as an OS gains any real significance in the marketplace, the hackers will turn their attention to it.
- The motorcyclist's creed : "You can be in the right, or you can be alive. Your choice."
Because it has a small market share. Nobody wants to write a program that will work on unix based systems because it just isn't practical. The main reason for this is that Linux systems vary wildly in terms of operation and security. Windows does not have this "problem" (and lack of standardization is what has kept Linux out of the mainstream) and, to a degree, neither do Macs. Who would want to write a botnet for linux systems? Now, if our dreams become a reality, and Linux becomes the de facto standard then we will have problems too, this is a perfect example of security though obscurity. The opportunity costs outweigh the benefits, as long as this is true then Linux users have little to fear.
00010111 always try everything twice
AFAIK, any OS that allows a user to install software is susceptible to malware.
Anyone smugly thinking they aren't is an idiot.
Wake me up when a worm has been discovered in the wild targeting OS X or Linux
Wasn't this posted here a while back? I think it does run on Windows, Mac and Linux, but tests showed that Linux is the only platform that doesn't allow it to restart after a reboot. Can't find the story, could be wrong.
Shut up cat.
My karma is not a Chameleon.
unix is where the term root for #1 user, hence rootkit comes from. just look at rkhunter and chkrootkit they search for about ~150 such programs. and until very recently there has been a long standing remote vuln in dhcpd3 which existed for months after it was believed to be patched, although the patch was ineffective in ubuntu. yes i still use linux anyway, cause mathematica matlab and intel compilers have 1st class support and hence i am much more productive and the interface is more humane.
Java is Java.. there generally would not be a "linux version", or any platform specific version.. sort of the whole point of this.
Which is why I neverenable java, period. If a site requires it, they don't need my eyeball time.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
jar2exe doesn't work by compiling Java to native code, it starts a JVM and provides the ability to package .jar files into the executable. In principle, a Linux version would be fairly simple to make.
Also, a given JVM is only as locked down as the SecurityManager running inside of it (assuming no exploitable flaws) and you can be assured the trojan packager is not installing one that stops anything.
Write once, pwn anywhere.
This is almost as news worthy as a botnet client written in Win32, that might potentially infect Linux computers because the packager could wrap it in Wine.
Java botnet, courtesy of McAfee, the same company that tried to scare people with "jpeg virus" a couple of years ago...
They just gave Oracle a new slogan for Java, "Write once, pwn everywhere!"
Monstar L
"No OS left behind."
2019 is going to be the year of Linux on the desktop.
---Something unexpected surprise--
Hello. My friend
=== http://www.happyshopping100.com/ ====
Dedi cated servi ce, the new style, so you feel like a warm spring!!!
WE ACCEPT PYAP AL PAYMENT
YOU MUST NOT MISS IT!!!
thank you!!!
Believe you will love it.
---Something unexpected surprise-- Hello. My friend === http://www.happyshopping100.com/ ==== Dedi cated servi ce, the new style, so you feel like a warm spring!!! WE ACCEPT PYAP AL PAYMENT YOU MUST NOT MISS IT!!! thank you!!! Believe you will love it.
-Something unexpected surprise-- Hello. My friend === http://www.happyshopping100.com/ ==== Dedi cated servi ce, the new style, so you feel like a warm spring!!! WE ACCEPT PYAP AL PAYMENT YOU MUST NOT MISS IT!!! thank you!!! Believe you will love it. **
The author's blog written in very good, description is very in place, I love Handys from myefox.
The author's blog written in very good, description is very in place, I love epad from myefox.
NoScript.
Even fucking slashdot feels it's necessary to have 5 mother-fucking java domains on their fucking webpage. Every fucking page I log onto adds a new one every fucking week. What is with the goddamed proliferation of this mother-fucking bullshit java domain fucking crapbucket of bloatpageshit. My fucking 'experience' on Amazon hasn't fucking changed since 1999 but the pages loads like cane toads going up my fucking virgin asshole in an Alaskan blizzard. Fuck off you fucking webdevelopers go find a different fucking job and stop trying to justify your fucking worthless existences by fucking up everyone's 'experience'.
The original McAfee blog article says this (why not link to the original resource in the first place?):
So this is not different at all from the Java-based Facebook suicide Trojan horse which circulated in Spring 2010 (but was not spotted by most AV companies back then).
I used to run one of those what is my IP sites. Now it's IPv6 only because various botnets started (ab)using it. I get a few thousand hits by "Apache-HttpClient/UNAVAILABLE (java 1.4)" pr. hour. Other AV vendors have known for a while, searching for my sites lists several (not mcafee) who lists my site as something the bots use.
9/11: Never forget it was a false-flag operation
what the fuck(ing) ?
> Java-based Trojan discovered in the wild that is being downloaded and installed by another component. This malware behaves like other Windows botnets but uses source code and libraries that can operate on other platforms ..
Is there a working demo in the wild that I can click on and get rooted on other non-Windows platforms?
Why would there be a "Linux version" of code that runs on multiple platforms? The "Windows version" IS the "Linux version."
Move sig!
We all know how slow Java is and botnet node users are not willing to upgrade their hardware just to provide a faster service for people who don't pay a cent. So this well-known Java paradigm "Is it too slow? Just add more hardware power!" will not work here.
Who needs to bother getting users to use sudo for e-mail? They install their shitty little PHP-based content management systems by hand and then happily never fucking update them.
Hurr, durr, yum, herp derp, apt-get; all those regular updates and package management bullshit is bullshit when it comes to people uncompressing crap into docroots.
The amount of Linux servers I've seen that have been totally owned and churning out spam by the goddamned megaton is legion .
Java??? How is this going to go unnoticed when it consumes 1/2 your memory and cpu
Per my subject-line above? Linksys routers have a SECURITY setting that allows for filtration of JAVA applets too, per this point you made:
"Getting it onto your system is the trick, though. If they found a hole in the Java plugin's sandbox, they could potentially exploit that using an applet and get the code onto your system. Disabling the plugin prevents that possibility, but if they were trying to push this via browsers there are lots of other plugins and holes are found in browsers all the time." - by Cougar Town (1669754) on Thursday May 05, @09:26PM (#36043646)
So, IF anyone's concerned about that? The "layered security" way around it, is to use router based filtering of JAVA applets (again, which Linksys routers have a security option for, as one example thereof).
APK
this trojan isnt made this way to be multiplatform, but to make it harder to analyse and/or detect both with manual and automated analysis.
I am sick and tired of these motherfucking rants on this motherfucking site!
"When information is power, privacy is freedom" - Jah-Wren Ryel
AppArmor.
"When information is power, privacy is freedom" - Jah-Wren Ryel
Hello
If this is your first white screen of death
First contact Microsoft about this problem.
Then press the [any] key to continue.
If this screen still appear you are infected by a virus.
-----------
This white screen of death is made by Microsoft
-----------
And, I really don't see your point, unless you're saying that a secured http page has an exploit on it for instance, theoretically... is that where you're going in your statement?
APK
P.S.=> If so, that's when I'd couple using say, Opera's "by site preferences" & ONLY ALLOW java to run on certain pages that demand it & that I know are trustworthy... in combination with the Linksys security feature I noted (where the router can "filter out" java applets), for "layered security" purposes... apk
excuse my question: is this the first botnet running in java? what are the other common languages that are used to write this stuff. For sure it ain't Visual Basic. Why is the code of malware not portable when written in c++? For now its just a matter of time until the botnets run more reliable in linux, but still run in $gcc_plattform.