Slashdot Mirror
Multiplatform Java Botnet Spotted In the Wild
It's fun sometimes to be smug because you are ("one is") using an operating system less susceptible to malware, or at least less targeted by malware creators, than is Microsoft Windows. Now, reader Orome1 writes with word of a Java-based, equal-opportunity botnet Trojan, excerpting from Help Net Security's report: "'IncognitoRAT is one example of a Java-based Trojan discovered in the wild that is being downloaded and installed by another component. This malware behaves like other Windows botnets but uses source code and libraries that can operate on other platforms,' explains McAfee's Carlos Castillo." So far, no mention of a Linux version, though.
No mention of linux support. Do we always have to come last?
"So far, no mention of a Linux version, though."
Java is Java.. there generally would not be a "linux version", or any platform specific version.. sort of the whole point of this.
-Lod
AFAIK, any OS that allows a user to install software is susceptible to malware.
Anyone smugly thinking they aren't is an idiot.
Wake me up when a worm has been discovered in the wild targeting OS X or Linux
I believe this thing is called a "javawocky."
You don't enable or disable Java. If it's installed on your system, it's available to use. You can, however, enable or disable the Java applet plugin for your web browsers, which is probably what you're talking about and isn't necessarily what this is about (TFA didn't mention applets or browsers). Java applications (not applets) can run on your system as long as you have Java installed, regardless of whether you have the browser plugins enabled or not, just like how you can open a PDF if Adobe Reader is installed, regardless of whether you have the Adobe Reader browser plugin enabled or not. So in theory, if they found an attack vector for your OS, having the Java plugin disabled wouldn't stop this from running on your system at all.
Getting it onto your system is the trick, though. If they found a hole in the Java plugin's sandbox, they could potentially exploit that using an applet and get the code onto your system. Disabling the plugin prevents that possibility, but if they were trying to push this via browsers there are lots of other plugins and holes are found in browsers all the time.
That being said, I don't bother with the Java plugin either, because applets are crap and I have no use for them and agree with you about sites requiring them (and I'm a full-time Java developer)
unix is where the term root for #1 user, hence rootkit comes from.
Minor correction: On unix systems, root is always the #0 user. The #1 user is typically "daemon", though not always.
(Unix was written by -- and for -- C programmers, who always start counting at 0. ;-)
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
They just gave Oracle a new slogan for Java, "Write once, pwn everywhere!"
Monstar L
"No OS left behind."
2019 is going to be the year of Linux on the desktop.
2.7182 is e, not pi...
The original McAfee blog article says this (why not link to the original resource in the first place?):
So this is not different at all from the Java-based Facebook suicide Trojan horse which circulated in Spring 2010 (but was not spotted by most AV companies back then).
I think my original point stands though. If it's so easy to compromise Linux, why isn't it being done? Why can't the very people who like to crow about how easy it is (and even hurl accusations of "security through obscurity") just put up or shut up?
I think we both know the answer to that. The PEBKAC is still there for the average user, no matter which system they use. But in Linux the system isn't designed to make it trivial to run any code from any location, as windows historically has been -- it's a bit better with 7 than it was previously, and XP SP3 is also a major improvement over previous versions. But it's still fairly trivial to generate windows malware, going by the sheer volume of infected machines. I personally have one person in my contacts running win7 whose machine is spamming me daily. Oops. Windows is still the lowest hanging fruit, and as criminals are pretty much always lazy people looking to get rich quick that's what they go for. When that's gone, they'll move on to other scams (assuming OS X has been locked down, otherwise that's hanging a bit low as it is). They will not learn to be 1337 for reelz and finally code that Linux virus. That's not the criminal MO.
Caveat Utilitor
It's in the wild !! A Java ... a what??
A java program that takes the 'Write once, run anywhere' mantra to the next level.
And noscript is not used by the "patients" who need it most, and are the main targets of botnet operators.
Even if you pwn a noscript user, that user is far more likely to notice that he/she is infected, and eventually fix that. These users are the minority, so the botnet operators don't care.
FWIW, I've written a cross platform agent (unix/linux) that scans for hardware/software, connects to a remote server, and can download new instructions. This is legit, for work and is for admins to do software and hardware asset management. The same agent runs on OSX, AIX, Solaris and many Linux distros.
A botnet client wouldn't need root access, sending spam or helping to DDoS does not need root permissions. Most unix/linux machines allow normal users to set their own cron and at job, so that takes care of rerunning the bot after a reboot (there are other ways too).
So anyone who thinks a linux/unix botnet client would be difficult to create or "install" is ignorant or delusional.
The fanatics have got their heads firmly stuck in the sand.