Slashdot Mirror
New Linux Trojan Can Spy on Users by Taking Screenshots and Recording Audio (drweb.com)
An anonymous reader writes: Dr.Web, a Russian antivirus maker, has detected a new threat against Linux users: the Linux.Ekoms.1 trojan. It includes functionality that allows it to take screenshots and record audio. While the screenshot activity is working just fine, Dr.Web says the trojan's audio recording feature has not been turned on, despite being included in the malware's source code. "All information transmitted between the server and Linux.Ekoms.1 is encrypted. The encryption is initially performed using the public key; and the decryption is executed by implementing the RSA_public_decrypt function to the received data. The Trojan exchanges data with the server using AbNetworkMessage."
Simply download the package and run these steps:
1. tar xzf trojan.tar.gz ./configure
2. cd trojan
3.
4. make
5. sudo make install
-- Will program for bandwidth
Linux didn't support my laptop's webcam.
Simply download the package and run these steps:
It doesn't build with my version of libc. Is there a wiki or forum, or something?
Dr.Web malware specialists have not disclosed how this malware infects Linux computers.
But they are willing to sell you their Linux antivirus software.
From what I've gathered, it's written in C++, uses Qt 5.4 or higher (that's when the enumeration value QStandardPaths::GenericDataLocation was added to Qt) and it's not self-propagating.
So basically, it's a program that has to be installed on your computer... maybe from a compromised package repo server.
Anons need not reply. Questions end with a question mark.
Jokes on them, my headless Linux box doesn't have a microphone. I will go back to playing my xbox1 on my Samsung tv while asking Siri for game pointers...
sorry for my comments, I'm drunk
but why did they make a new name for it? "teamviewer" is much easier to remember.
Despite the presence of an audio recording feature in its codebase, Dr.Web says that this functionality was never active in the trojan's normal operation.
Now I lost any hope my microphone will ever work. If even hackers have a hard time ...
Wait, so someone has found a way to make audio work reliably across Linux distros? Does this make 2016 the Year of the Linux Desktop?
Virtually serving coffee
Linux rootkits have been around for many years, and there is already standard functionality for taking screenshots and recording audio built in to most linux distros.. You can just dd data from /dev/audio to a file, and you can take screenshots using xwd or import. The only difference is that most linux systems are servers or embedded so they usually don't have X11 running or any audio hardware attached.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Well of course the source code is provided, no Linux user is going to install something without first knowing what it does!
Summation 2
as they haven't disclosed how you get infected, i see this as the usual antivirus maker ploy of trying to increase sales by scare stories with nothing to back it up.
"The hands that help are better far than lips that pray." - Robert Ingersoll (1833-1899)
Nah, easier to download and install the compiled binary package. No compile stuff.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Sounds like I need to install this trojan, I might be able to get my microphone working in linux finally!
has detected a new threat against Linux users
What, all twelve of them?
I suppose you are using a windows phone or surface rt and are puzzled as to why there are more Linux users in the world than WP OS and WInRT users combined? I give the guys at DrWeb credit for trying to make money from us skin flint Linux users. Considering the fact that Mint Linux is starting to really catch on and has more users than WP OS and Surface RT users combined and it is only one distro that has millions of users. The fact that old computers and laptops are easily made to efficiently work by the millions in a large part because of Linux, your troll is starting to wear a little thin, and many people know it.
The truth is Windows is quickly becoming irrelevant on the home desktop because of the blatantly obvious planned obsolescence built into Windows. Hell I have a 6 year old atom 512 dual core 64 mini desktop with 4 gig of ram and it runs 7 fine. But is not compatible of running Win 10 and this is by design! When 7 goes for a shit and loses support I am almost willing to bet that most hardware that has been obsoleted by Microshaft will run the latest linux kernel and destops just fine.
Same goes for my old T42 non pae laptop which still gets 4-5 hours on a nine cell. All you have to do is know which kernel to run and bingo you can even run non PAE 32 mode procs on Linux...TRY THAT with windows! Stop trying to obscure the truth and spread bullshit about linux desktop distros, they are stellar at keeping the best gear from being thrown in the garbage dump and more and more people are starting to realize the truth about how advanced and flexible linux has really become in the past 15 years or so.
So I don't blame the antivirus snake oil salesmen for trying to get on the band wagon because Windows is more secure only because most people who hose their old gear just trash it after Windows obsoletes it. The whole desktop computer industry is changing and there is starting to be a large market for Linux because of the way it can keep gear going.
TODO
-Ncurses support
This trojan doesnt work with pulseaudio..... well technically NOTHING works with pulseaudio.
So I want them to write and push out a patch so it will work with not just ALSA but the other 657 different audio interface API's.
Do not look at laser with remaining good eye.
And on Windows you simply download trojan.zip, unzip it and run the setup.exe. Of course, you probably just have to download and run a setup.exe, but that's the point: it does not say it's a trojan even if you have to compile it with many dependencies (which do not include libtrojan and libmalware).
where on earth did i say it was a virus, dickhead? or shall i change "infected" to "deployed" to make your stupid nitpicking mind happier?
"The hands that help are better far than lips that pray." - Robert Ingersoll (1833-1899)
Its a post PC world. Android is Linux based, iOS uses UNIX and you keep a PC around to use as what? A boat anchor?
I don't think it runs on anything except a 5 year old ubuntu with default setup and you need to kill pulseaudio + make sure your microphone is alsa device 0:1 for the experimental recording function. Also try disabling compositing, if your screenshots only show the desktop background.
You might have to create the certs for the encrypted uploads manually if the system isn't getting enough entropy fast enough or the Trojan will assume that the connection timed out and go into an endless loop.
Just run the Windows version with wine until the devs get their shit together!
Windows has a convenient feature where it will download AND run the Trojan for you.
There was a Linux kernel vulnerability announced yesterday... Ubuntu had the patch available by the time I got out of work. Phones, on the other hand are Phucked.
How does this Linux.Ekoms.1 trojan get onto the computer without the end user explicitly downloading and installing it.
There is no way that this malware is going to be in usr or opt without having a root priv install so and it cannot access or modify etc unless you installed it as root.
People routinely install stuff with sudo, so if it's a trojan it was probably installed as root. Furthermore, privilege escalation bugs are quite common. I just did a search for: linux privilege escalation bug, and the top hit was a news item less than a day old:
http://www.darkreading.com/vul...
Tens of millions of Linux PCs and servers and 66% of all Android devices are impacted by a vulnerability in the Linux kernel that allows privilege escalation from local to root via a use-after-free attack, according to the research team at Perception Point.
Although no exploits for the bug have been seen in the wild yet, the vulnerability is far-reaching. According to Yevgeny Pats, co-founder and CEO of Perception Point, the bug affects all Linux kernels from release 3.8 and later, both 32-bit and 64-bit, operating on desktop, server, mobile, and embedded devices.
The vulnerability, CVE-2016-0728, is a reference leak in the keyrings facility, where security data like encryption keys and authentication keys are stored.
I (maybe shockingly) actually read the page.
FTP
~
EkomsCcClient:
It generates a filtering list for the "aa*.aat", "dd*ddt", "kk*kkt", "ss*sst” files that are searched in the temporary location and uploads the files that match these criteria to the server. If the answer is the uninstall line, Linux.Ekoms.1 downloads the /tmp/ccXXXXXX.exe executable file from the server, saves it to the temporary folder and runs it.
~
Last time I check unless you are running Wine, ccXXXXXX.exe will not execute in linux or have my years of use clouded my judgment?
There is no cure against human stupidity
I usually sit on a ton of mod points - this is +5 funny material here.
Honesty may be the best policy, but by process of elimination, dishonesty is the second best policy.
On xterm too?
Old school here. I access our Unix-like systems exclusively using Cygwin terminal which emulates xterm. At home I have Mac OS and FreeBSD. The latter one is a file server which I access mostly though a terminal.
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
upskirt.viewer is more likely to be clicked.
Sent from my ASR33 using ASCII
Oh, Wait ...
Sent from my ASR33 using ASCII
there, upload that! Honestly I didn't even see the directory .mozilla/firefox/profiled on my machine.
Yeah buddy we could have fun with that, you want data, how about a couple Gb of /dev/random!
Apocalypse Cancelled, Sorry, No Ticket Refunds
This kind of information TOTALLY USELESS unless the fear mongers in question actually tell us how this thing gets on a system. That's very important because it tells us how to AVOID this stuff. That's the whole point of ANY sort of problem report even if you're just talking about an unsupported printer.
Vague accusations are of no use to anyone except trolls.
How do you defend against this? How do you fix whatever security hole it's using?
The nature of the infection vector is really the only bit of relevant information and it seems to be missing.
A Pirate and a Puritan look the same on a balance sheet.
On the loaded OS, run a full scan of all disk partitions using the Dr.Web Anti-virus for Linux.
/tmp/ccXXXXXX.exe executable file from the server, saves it to the temporary folder and runs it.'
How about 'kill -9 PID'
BTW: Anyone notice it also 'downloads the
Don't think drweb knows enough about *nix to even explain what it does.
Is this trojan under the GPL? If so, can somebody direct me to the git repo???
oh, I already got infected with the ./configure step
Malware did not install as root, did not need to. Just took all my thunderbird adresses and mailed all my contacts to try this awesome software.
Atari rules... ermm... ruled.
You need to download the Android SDK, then compile, load certificate on target and finally deploy on target.
Then, when the unsuspected owner returns from taking a piss, target is p0wned*. Enjoy!
* support up to Android 2.1 only
What I can't understand is why someone who apparently knows everything already should trouble to read a forum such as Slashdot - let alone comment, and abuse those who do not enjoy their educational advantages.
If Slashdot isn't a place where people can discuss matters in a calm, civilized way, and learn from each other, what is it? (That's a rhetorical question, by the way).
I am sure that there are many other solipsists out there.
what point? he/she totally missed my point that its about anti virus maker trying to makes sales with crap information. i couldn't care if its a trojan or virus, if you can't say how it gets onto a machine, then your case for it being a problem seems very bogus. Virtually all antivirus suppliers have come up with crap scare stories to get linux users to buy their product.
"The hands that help are better far than lips that pray." - Robert Ingersoll (1833-1899)
who cares what an AC has to say? you go get a life or have the balls to at least register yourself
"The hands that help are better far than lips that pray." - Robert Ingersoll (1833-1899)
If Slashdot isn't a place where people can discuss matters in a calm, civilized way, and learn from each other, what is it? (That's a rhetorical question, by the way).
Thanks. I needed a good laugh!
Well, it'll come in the same way any malware does - through an infection vector. For Linux, it probably comes in through commercial software piracy (yes, Linux has commercial software) via warez or cracks or keygens, or even stuff like WordPress themes that people actually pay money for.
So for Linux, as long as you stick with your distro's repos (that aren't compromised - but given these days packages are signed it'll be hard) or source code, you're fine. But start downloading commercial software for free and stuff, well...
Why in the world would somebody write a trojan to build a collection of neckbeard headshots? That's just sick!
I don't see any mention of a securty hole at all, do you?
Likely it's a trojan that runs if you install it first (after typing in your sudo password).
That's generally how things work on Linux.
How do you defend against this? How do you fix whatever security hole it's using?
The answer to both of these questions is the same. Buy our (not mine personally, the people who put out this report) antimalware software.
End of Line.
This is supposed to be a major issue with X. X lets any client read all input sent to the X server, view any window, etc. These aren't bugs in X, it's how it's designed.
Wayland doesn't allow this behavior so probably such a trojan wouldn't be possible with Wayland (outside of the audio aspect that is).
you need to google teamviewer. it's the most widely spread backdoor in the world. (on gnu/linux it runs as a background daemon even if you don't manually turn it on. it does not (easily) let you disable the daemon and use it ad hoc. on OS X, you can't even uninstall it without leaving crap behind)