Slashdot Mirror
Ransomware Found Targeting Linux Servers, MySQL, Git, Other Development Files (drweb.com)
An anonymous reader writes: A new piece of ransomware has been discovered that targets Linux servers, looking to encrypt only files that are related to Web hosting, Web servers, MySQL, Subversion, Git, and other technologies used in Web development and HTTP servers. Weirdly, despite targeting business environments, the ransomware only asks for 1 Bitcoin, a fairly low amount compared to other ransomware.
"Once launched with administrator privileges..."
Well, there's your problem.
Unlike desktops big iron use tape and raid backups
http://saveie6.com/
whatever the market will bear
Sounds like they're trying to figure out how far their ransomware can get into various networks and environments. See who they hit and do a more invasive hack/extortion later for big money.
However 1 bitcoin is roughly $400. While still less than 10 bitcoins its not nothing either.
Minimum threshold fixed. Thanks!
The relatively low price is designed to make it too much of a hassle for the victims to contact the police, lawyers, etc. etc. in an effort to track down and stop the perpetrators.
They are probably hoping for higher volumes of payment from a lot of people instead of trying to go all Hollywood and ask for some insane amount of money that would make bringing in the cops worthwhile.
AntiFA: An abbreviation for Anti First Amendment.
That low ransom makes it REALLY easy for the business to justify just paying them off, instead of spending the time to deal with the problem in a different way. It's even small enough that a lower level manager who doesn't want to get fired for having screwed up and let this happen might pay it himself to keep from looking bad, which means that no one else in the organization might be informed.
If the malware can get enough traction, it could still bring in the big bucks over time.
A thousand pounds of wood moving at 300 feet per minute. Don't get in the way.
Consider yourself in a cyber-war... any line of program you run on your computer can be turned against you... why do you trust any of it with your full authority?
Because you don't have a choice, your OS doesn't give you one. Read up on the principle of least privilege, and the ambient authority model we currently use.
Not long ago someone was trying to convince me that git is an acceptable backup for your code, because it's distributed, so you don't need any other backups.
This story is another reminder that Git is not a backup. (As the older saying went, "RAID is not backup"). Mirroring is not a backup either, for similar reasons.
"First they came for the slanderers and i said nothing."
A single bitcoin is likely to be a very common kind of transaction.
Remember the Ashleigh Madison blackmailers who were asking for very specific amounts, which allowed multiple transactions to multiple bitcoin addresses to be grouped together by those investigating?
It would be much harder to associate all those wallets if they were for an amount that's commonly used.
How does this malware spread? How does it get on the servers? How does it get executed?
If it relies on some idiot to run it as root, I just can;t see it as a real threat. If it's coming in via a distro's updates, well that would be... exciting.
It's Dr. Evil, from the 1960's.
Table-ized A.I.
"Once launched with administrator privileges, the Trojan loads into the memory of its process files containing cybercriminals' demands"
1. There is no reason to have anything rinning as root
2. There is no reason to run any non-os command as root
3. it takes 45 mins at most to reimage a server and redeploy from backup
The people who get this are asking for it. Its like the internet startup darwin awards.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
eg. from this article...
http://www.securityweek.com/file-encrypting-ransomware-targets-linux-users
It’s unclear at this point how the malware is distributed and installed on victims’ computers
eg. from this article...
http://securityaffairs.co/wordpress/41787/cyber-crime/linux-ransomware.html
Linux ransomware already infected at least tens of users
So nobody knows how this mysterious trojan gets run as root on web servers. No mention of what distro is affected, if this story is legit. Realize there are actual proprietary OS companies who pay to shill. The fact that Linux is better and open source and free makes Windows and Apple look stupid. So does it make sense they want to discredit Linux? FUD about web servers?
Wait for an actual legit demonstration of how this "ransomware trojan" infects a web server. I mean other than some tweak got paid a few bucks to write a script and give it to his gamer buddies in Russia to run as root @ localhot.
Read even this.
https://en.wikipedia.org/wiki/Linux_malware
Worms and targeted attacks
The classical threat to Unix-like systems is vulnerabilities in network daemons, such as SSH and web servers. These can be used by worms or for attacks against specific targets. As servers are patched quite quickly when a vulnerability is found, there have been only a few widespread worms of this kind. As specific targets can be attacked through a vulnerability that is not publicly known there is no guarantee that a certain installation is secure. Also servers without such vulnerabilities can be successfully attacked through weak passwords.
Threats
The following is a partial list of known Linux malware. However, few if any are in the wild, and most have been rendered obsolete by Linux updates or were never a threat. Known malware is not the only or even the most important threat: new malware or attacks directed to specific sites can use vulnerabilities previously unknown to the community or unused by malware.
So don't believe the hype. If this story is legit at all, it will be scrutinized 100% and all possible methods of injection will be considered by one hell of a lot of smart people. The code is open source.
Not to mention any SERIOUS webhost is NOT going to be running Gnome/KDE/whatever, so the usual "infection vector", namely the browser (FF/Chrome) is not present and therefore is not going to be able to do its dirty work.. Frankly, I can't really imagine *how* this malware would get onto a properly setup Linux-based webhost.. Perhaps I'm missing something, after all I've only been using Linux professionally since 1994 or so...
THANK YOU, Edward Snowden!! Americans owe you a debt of gratitude (whether they know it or not..)
For Dr. Web anti virus crap.
Once again, if you bypass all the security as only a complete idiot would do, Unix is vulnerable.
until we type "snapper rollback ..." or "zfs rollback ...". then we can continue eating donuts and browsing slashdot.
Easy - piracy.
You have to remember a properly secured webhost would mean the instances are separated from each other, but an infected instance can will wreak damage on the instance its on. (And more malware these days are user-space based - sure it's harder to hide, but sometimes... why bother?).
And what are people pirating? Well, think of things like "premium" themes for stuff like WordPress and other things people buy crap for.
And this doesn't exclude the piracy of stuff like monitoring tools and other such things because the company refuses to pay for it.