Slashdot Mirror
New Multi-Purpose Backdoor Targets Linux Servers
An anonymous reader writes A new multi-purpose Linux Trojan that opens a backdoor on the target machine and can make it participate in DDoS attacks has been discovered and analyzed by Dr. Web researchers, who believe that the Chinese hacker group ChinaZ might be behind it. "First, Linux.BackDoor.Xnote.1 sends information about the infected system to the server. It then goes into standby mode and awaits further instructions. If the command involves carrying out some task, the backdoor creates a separate process that establishes its own connection to the server through which it gets all the necessary configuration data and sends the results of the executed task," the researchers explained.
You have to run the file as a system admin for it even to work. This is a non issue joke.
The source was Dr. Web's own marketing page.
This smells like a press release (which smells coincidentally like spam).
"The malware will only be installed in a system if it has been launched with superuser (root) privileges"
aaaand i've already gone back to my tea.
any sysop worth her salt knows the rules:
0. It will build without root or not at all.
1. It will come from a repository or reputable source.
2. It will check its md5 and check it twice.
3. It will be compatible with standard secops tools like chroot, jails, cgroups, propolice, and selinux. this includes sandboxing.
4. Isolate, quarantine, and deploy the secops team. any compromised machine, any network, any server without question.
5. Slap about with a large bit of herring or trout the dev or luser in accordance with LART policies.
Good people go to bed earlier.
The linked article mistranslates the original russian.
The vector is SSH, brute force attempts to guest the root password. The net-security article mistranslates to SSL.
Most linux systems don't have root passwords anymore. Use sudo, don't allow root logins and you are safe from those stupid 'so 1996' kind of attacks.
Non-Linux Penguins ?