Slashdot Mirror

← Back to Stories (view on slashdot.org)

New Linux Trojan Can Spy on Users by Taking Screenshots and Recording Audio (drweb.com)

Posted by Soulskill on from the take-care-when-yelling-sensitive-personal-information-at-the-screen dept.

An anonymous reader writes: Dr.Web, a Russian antivirus maker, has detected a new threat against Linux users: the Linux.Ekoms.1 trojan. It includes functionality that allows it to take screenshots and record audio. While the screenshot activity is working just fine, Dr.Web says the trojan's audio recording feature has not been turned on, despite being included in the malware's source code. "All information transmitted between the server and Linux.Ekoms.1 is encrypted. The encryption is initially performed using the public key; and the decryption is executed by implementing the RSA_public_decrypt function to the received data. The Trojan exchanges data with the server using AbNetworkMessage."

4 of 130 comments (clear)

  1. back in the old days by Anonymous Coward · · Score: 5, Funny

    Linux didn't support my laptop's webcam.

  2. Re:And it's easy to get infected without realizing by code_monkey_steve · · Score: 5, Funny

    Simply download the package and run these steps:

    It doesn't build with my version of libc. Is there a wiki or forum, or something?

  3. Every cloud by melonman · · Score: 5, Funny

    Wait, so someone has found a way to make audio work reliably across Linux distros? Does this make 2016 the Year of the Linux Desktop?

    --
    Virtually serving coffee
  4. Re: And it's easy to get infected without realizin by Anonymous Coward · · Score: 5, Funny

    I don't think it runs on anything except a 5 year old ubuntu with default setup and you need to kill pulseaudio + make sure your microphone is alsa device 0:1 for the experimental recording function. Also try disabling compositing, if your screenshots only show the desktop background.

    You might have to create the certs for the encrypted uploads manually if the system isn't getting enough entropy fast enough or the Trojan will assume that the connection timed out and go into an endless loop.

    Just run the Windows version with wine until the devs get their shit together!