Slashdot Mirror
New Linux Trojan Can Spy on Users by Taking Screenshots and Recording Audio (drweb.com)
An anonymous reader writes: Dr.Web, a Russian antivirus maker, has detected a new threat against Linux users: the Linux.Ekoms.1 trojan. It includes functionality that allows it to take screenshots and record audio. While the screenshot activity is working just fine, Dr.Web says the trojan's audio recording feature has not been turned on, despite being included in the malware's source code. "All information transmitted between the server and Linux.Ekoms.1 is encrypted. The encryption is initially performed using the public key; and the decryption is executed by implementing the RSA_public_decrypt function to the received data. The Trojan exchanges data with the server using AbNetworkMessage."
Probably requires doing some stupid to get infected...
Good thing all dumb users are on other platforms, right? RIGHT?!
Simply download the package and run these steps:
1. tar xzf trojan.tar.gz ./configure
2. cd trojan
3.
4. make
5. sudo make install
-- Will program for bandwidth
Linux didn't support my laptop's webcam.
Simply download the package and run these steps:
It doesn't build with my version of libc. Is there a wiki or forum, or something?
Yeah, because there are absolutely no vulnerabilities or privelege escalation exploits on a Linux system that can be exploited as infection vector.
I was worried we'd never get in the big leagues. Linus, you can now be proud and they won't laugh at you anymore.
Dr.Web malware specialists have not disclosed how this malware infects Linux computers.
But they are willing to sell you their Linux antivirus software.
From what I've gathered, it's written in C++, uses Qt 5.4 or higher (that's when the enumeration value QStandardPaths::GenericDataLocation was added to Qt) and it's not self-propagating.
So basically, it's a program that has to be installed on your computer... maybe from a compromised package repo server.
Anons need not reply. Questions end with a question mark.
Jokes on them, my headless Linux box doesn't have a microphone. I will go back to playing my xbox1 on my Samsung tv while asking Siri for game pointers...
sorry for my comments, I'm drunk
has detected a new threat against Linux users
What, all twelve of them?
for bsp in range(0,28):
print("^H")
I can break this thing by entering runlevel 3, deleting its ~/.config/autostart entry, and restarting X? And check for it by... looking for it there?
Or at the very worst, by rebooting to single-user and doing this?
Despite the presence of an audio recording feature in its codebase, Dr.Web says that this functionality was never active in the trojan's normal operation.
Now I lost any hope my microphone will ever work. If even hackers have a hard time ...
Wait, so someone has found a way to make audio work reliably across Linux distros? Does this make 2016 the Year of the Linux Desktop?
Virtually serving coffee
Linux.Ekoms.1 trojan is in the latest ubuntu-system-service (also used by MINT) https://bugs.launchpad.net/ubuntu/+source/ubuntu-system-service/+bugs?field.status:list=NEW
ubuntu-system-service 0.2.5build1 all Dbus service to set various system-wide
Well at least someone figured out how to get audio working on Linux
It's from an antivirus peddler and has the word "virus" in the URL, lol. Yeah, not clicking that.
even with wayland?
Linux rootkits have been around for many years, and there is already standard functionality for taking screenshots and recording audio built in to most linux distros.. You can just dd data from /dev/audio to a file, and you can take screenshots using xwd or import. The only difference is that most linux systems are servers or embedded so they usually don't have X11 running or any audio hardware attached.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
> Yeah, because there are absolutely no vulnerabilities or privelege escalation exploits on a Linux system that can be exploited as infection vector.
You must be a bit dense, so here's for you (read *really* slowly): the point is not that there aren't Linux vulnerabilities. There are quite a few at each point in time. The point is that this one either isn't a vuln at all (they don't tell us) or if it is, it's over-inflated.
Outrageous marketing claims do far more harm than good in this sector, so it's absolutely essential that those so-called "security experts" get a good public spanking when they are caught doing this (I'd prefer the spanking to be physical, but most of my colleagues never liked my tastes, so I'll shut up).
Well of course the source code is provided, no Linux user is going to install something without first knowing what it does!
Summation 2
the point is not that there aren't Linux vulnerabilities.
Apparently you haven't been paying attention, because that is exactly the point. It has been repeated over and over that malware only exists on Windows and cannot exist on Linux because of Linux's inherent superiority.
Nah, easier to download and install the compiled binary package. No compile stuff.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
You are literally the only one saying that here.
> It has been repeated over and over that malware only exists on Windows
Quotation needed.
Over the years I have met dozens of users that run as root. Even on systems such as Ubuntu they re-enable the root account for daily use. This could be an issue to users like these. They do this as they are Windows refugees and don't like being asked for their password all the time, there are tons of people that do this in Vista and up on Windows by disabling UAC as well. A system is only as secure as you (the operator) make it.
http://it.slashdot.org/comment...
TODO
-Ncurses support
This trojan doesnt work with pulseaudio..... well technically NOTHING works with pulseaudio.
So I want them to write and push out a patch so it will work with not just ALSA but the other 657 different audio interface API's.
Do not look at laser with remaining good eye.
And on Windows you simply download trojan.zip, unzip it and run the setup.exe. Of course, you probably just have to download and run a setup.exe, but that's the point: it does not say it's a trojan even if you have to compile it with many dependencies (which do not include libtrojan and libmalware).
I don't think it runs on anything except a 5 year old ubuntu with default setup and you need to kill pulseaudio + make sure your microphone is alsa device 0:1 for the experimental recording function. Also try disabling compositing, if your screenshots only show the desktop background.
You might have to create the certs for the encrypted uploads manually if the system isn't getting enough entropy fast enough or the Trojan will assume that the connection timed out and go into an endless loop.
Just run the Windows version with wine until the devs get their shit together!
Windows has a convenient feature where it will download AND run the Trojan for you.
There was a Linux kernel vulnerability announced yesterday... Ubuntu had the patch available by the time I got out of work. Phones, on the other hand are Phucked.
How does this Linux.Ekoms.1 trojan get onto the computer without the end user explicitly downloading and installing it.
Yeah, thanks for proving me right because that's not what he said either.
You should learn how to read before you start writing.
I (maybe shockingly) actually read the page.
FTP
~
EkomsCcClient:
It generates a filtering list for the "aa*.aat", "dd*ddt", "kk*kkt", "ss*sst” files that are searched in the temporary location and uploads the files that match these criteria to the server. If the answer is the uninstall line, Linux.Ekoms.1 downloads the /tmp/ccXXXXXX.exe executable file from the server, saves it to the temporary folder and runs it.
~
Last time I check unless you are running Wine, ccXXXXXX.exe will not execute in linux or have my years of use clouded my judgment?
I usually sit on a ton of mod points - this is +5 funny material here.
Honesty may be the best policy, but by process of elimination, dishonesty is the second best policy.
On xterm too?
Old school here. I access our Unix-like systems exclusively using Cygwin terminal which emulates xterm. At home I have Mac OS and FreeBSD. The latter one is a file server which I access mostly though a terminal.
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
Well maybe if you are running a debian, but for the redhats the rpm fails. I think it is a problem with dnf, cam anyone try with yum?
This kind of information TOTALLY USELESS unless the fear mongers in question actually tell us how this thing gets on a system. That's very important because it tells us how to AVOID this stuff. That's the whole point of ANY sort of problem report even if you're just talking about an unsupported printer.
Vague accusations are of no use to anyone except trolls.
How do you defend against this? How do you fix whatever security hole it's using?
The nature of the infection vector is really the only bit of relevant information and it seems to be missing.
A Pirate and a Puritan look the same on a balance sheet.
For those who are worried about the suboptimal performance of the trojan due to the asymmetric key encryption scheme: Apparantly, it uses AES for the encryption once it successfully obtains the symmetric key from the server. It would be great if they add support for other key distribution schemes as well.
On the loaded OS, run a full scan of all disk partitions using the Dr.Web Anti-virus for Linux.
/tmp/ccXXXXXX.exe executable file from the server, saves it to the temporary folder and runs it.'
How about 'kill -9 PID'
BTW: Anyone notice it also 'downloads the
Don't think drweb knows enough about *nix to even explain what it does.
Is this trojan under the GPL? If so, can somebody direct me to the git repo???
oh, I already got infected with the ./configure step
Malware did not install as root, did not need to. Just took all my thunderbird adresses and mailed all my contacts to try this awesome software.
Atari rules... ermm... ruled.
You need to download the Android SDK, then compile, load certificate on target and finally deploy on target.
Then, when the unsuspected owner returns from taking a piss, target is p0wned*. Enjoy!
* support up to Android 2.1 only
I dunno man, there's a bunch of unsupported compiler options and I end up with an a.out. This is frustrating!
WHAT!???
.
.
.
.
*They* wrote it.
Trouble is, wine doesn't emulate low level Windows driver stuff that trojans rely upon. Maybe trojan authors should band together and sponsor appropriate wine development?
Holy serendipity, Batman! I took a break due to frustration with my computer to read /.. I was trying to take screenshots to make a tutorial and couldn't figure out why I was only getting the background.
I knew the Linux was a joke to use
Well, it'll come in the same way any malware does - through an infection vector. For Linux, it probably comes in through commercial software piracy (yes, Linux has commercial software) via warez or cracks or keygens, or even stuff like WordPress themes that people actually pay money for.
So for Linux, as long as you stick with your distro's repos (that aren't compromised - but given these days packages are signed it'll be hard) or source code, you're fine. But start downloading commercial software for free and stuff, well...
Why in the world would somebody write a trojan to build a collection of neckbeard headshots? That's just sick!
I don't see any mention of a securty hole at all, do you?
Likely it's a trojan that runs if you install it first (after typing in your sudo password).
That's generally how things work on Linux.
How do you defend against this? How do you fix whatever security hole it's using?
The answer to both of these questions is the same. Buy our (not mine personally, the people who put out this report) antimalware software.
End of Line.
Linux turned me into a gnute!
I got better...
This is supposed to be a major issue with X. X lets any client read all input sent to the X server, view any window, etc. These aren't bugs in X, it's how it's designed.
Wayland doesn't allow this behavior so probably such a trojan wouldn't be possible with Wayland (outside of the audio aspect that is).