New Linux Trojan Can Spy on Users by Taking Screenshots and Recording Audio (drweb.com)

An anonymous reader writes: Dr.Web, a Russian antivirus maker, has detected a new threat against Linux users: the Linux.Ekoms.1 trojan. It includes functionality that allows it to take screenshots and record audio. While the screenshot activity is working just fine, Dr.Web says the trojan's audio recording feature has not been turned on, despite being included in the malware's source code. "All information transmitted between the server and Linux.Ekoms.1 is encrypted. The encryption is initially performed using the public key; and the decryption is executed by implementing the RSA_public_decrypt function to the received data. The Trojan exchanges data with the server using AbNetworkMessage."

Comments

And it's easy to get infected without realizing it

[rossz]

Simply download the package and run these steps:

1. tar xzf trojan.tar.gz
2. cd trojan
3. ./configure
4. make
5. sudo make install

back in the old days

[Anonymous Coward]

Linux didn't support my laptop's webcam.

Re: back in the old days

[Anonymous Coward]

That's a common misconception about systemd: just run `systemctl stop malwared` and you'll be all sorted.

Re:And it's easy to get infected without realizing

[code_monkey_steve]

Simply download the package and run these steps:

It doesn't build with my version of libc. Is there a wiki or forum, or something?

haha

[ouachiski]

Jokes on them, my headless Linux box doesn't have a microphone. I will go back to playing my xbox1 on my Samsung tv while asking Siri for game pointers...

Re:Stupid users

[greenfruitsalad]

but why did they make a new name for it? "teamviewer" is much easier to remember.

Every cloud

[melonman]

Wait, so someone has found a way to make audio work reliably across Linux distros? Does this make 2016 the Year of the Linux Desktop?

Malware's source code

[Rik Sweeney]

Well of course the source code is provided, no Linux user is going to install something without first knowing what it does!

Where can I submit a bug report?

[Lumpy]

This trojan doesnt work with pulseaudio..... well technically NOTHING works with pulseaudio.

So I want them to write and push out a patch so it will work with not just ALSA but the other 657 different audio interface API's.

Re: And it's easy to get infected without realizin

[Anonymous Coward]

I don't think it runs on anything except a 5 year old ubuntu with default setup and you need to kill pulseaudio + make sure your microphone is alsa device 0:1 for the experimental recording function. Also try disabling compositing, if your screenshots only show the desktop background.

You might have to create the certs for the encrypted uploads manually if the system isn't getting enough entropy fast enough or the Trojan will assume that the connection timed out and go into an endless loop.

Just run the Windows version with wine until the devs get their shit together!

Re: oh noes

[Anne Thwacks]

Fortunately Windows PCs are not compromised until Windows is installed.

Oh, Wait ...

Re:shocked, shocked i say!

[thegarbz]

I tried to restart Gnome Shell... and I started getting audio in a foreign language of people speaking.

You fool. We finally found someone who was able to get remote audio working on Linux and you hung up on them!