Slashdot Mirror

← Back to Stories (view on slashdot.org)

New Linux Trojan Can Spy on Users by Taking Screenshots and Recording Audio (drweb.com)

Posted by Soulskill on from the take-care-when-yelling-sensitive-personal-information-at-the-screen dept.

An anonymous reader writes: Dr.Web, a Russian antivirus maker, has detected a new threat against Linux users: the Linux.Ekoms.1 trojan. It includes functionality that allows it to take screenshots and record audio. While the screenshot activity is working just fine, Dr.Web says the trojan's audio recording feature has not been turned on, despite being included in the malware's source code. "All information transmitted between the server and Linux.Ekoms.1 is encrypted. The encryption is initially performed using the public key; and the decryption is executed by implementing the RSA_public_decrypt function to the received data. The Trojan exchanges data with the server using AbNetworkMessage."

13 of 130 comments (clear)

  1. And it's easy to get infected without realizing it by rossz · · Score: 4, Funny

    Simply download the package and run these steps:

    1. tar xzf trojan.tar.gz
    2. cd trojan
    3. ./configure
    4. make
    5. sudo make install

    --
    -- Will program for bandwidth
  2. back in the old days by Anonymous Coward · · Score: 5, Funny

    Linux didn't support my laptop's webcam.

  3. Re:And it's easy to get infected without realizing by code_monkey_steve · · Score: 5, Funny

    Simply download the package and run these steps:

    It doesn't build with my version of libc. Is there a wiki or forum, or something?

  4. shocked, shocked i say! by Gravis+Zero · · Score: 5, Informative

    Dr.Web malware specialists have not disclosed how this malware infects Linux computers.

    But they are willing to sell you their Linux antivirus software.

    From what I've gathered, it's written in C++, uses Qt 5.4 or higher (that's when the enumeration value QStandardPaths::GenericDataLocation was added to Qt) and it's not self-propagating.

    So basically, it's a program that has to be installed on your computer... maybe from a compromised package repo server.

    --
    Anons need not reply. Questions end with a question mark.
    1. Re:shocked, shocked i say! by Raenex · · Score: 5, Interesting

      Personal experience is that the applications shipped by the distro to do these tasks crash a lot, hang the desktop, fight with pulseaudio or require extensive configuration (hello ~/.alsasoundrc and 2005!)

      About a month ago my Debian desktop was compromised, and I figured this out because the desktop was hung. In an attempt to recover the hang, I tried to restart Gnome Shell... and I started getting audio in a foreign language of people speaking. I freaked out, shutdown my computer, and reinstalled.

      I'm generally careful about not installing fishy stuff, and I saved a copy of the hard drive after I shut it down, so if somebody wants to help see what it was I'd be willing to work with them.

    2. Re:shocked, shocked i say! by thegarbz · · Score: 4, Funny

      I tried to restart Gnome Shell... and I started getting audio in a foreign language of people speaking.

      You fool. We finally found someone who was able to get remote audio working on Linux and you hung up on them!

  5. haha by ouachiski · · Score: 4, Funny

    Jokes on them, my headless Linux box doesn't have a microphone. I will go back to playing my xbox1 on my Samsung tv while asking Siri for game pointers...

    --
    sorry for my comments, I'm drunk
  6. Re:Stupid users by greenfruitsalad · · Score: 4, Funny

    but why did they make a new name for it? "teamviewer" is much easier to remember.

  7. Every cloud by melonman · · Score: 5, Funny

    Wait, so someone has found a way to make audio work reliably across Linux distros? Does this make 2016 the Year of the Linux Desktop?

    --
    Virtually serving coffee
  8. Malware's source code by Rik+Sweeney · · Score: 4, Funny

    Well of course the source code is provided, no Linux user is going to install something without first knowing what it does!

    --
    Summation 2
  9. Re:Stupid users by Barsteward · · Score: 4, Insightful

    as they haven't disclosed how you get infected, i see this as the usual antivirus maker ploy of trying to increase sales by scare stories with nothing to back it up.

    --
    "The hands that help are better far than lips that pray." - Robert Ingersoll (1833-1899)
  10. Re:Stupid users by Barsteward · · Score: 4, Insightful

    where on earth did i say it was a virus, dickhead? or shall i change "infected" to "deployed" to make your stupid nitpicking mind happier?

    --
    "The hands that help are better far than lips that pray." - Robert Ingersoll (1833-1899)
  11. Re: And it's easy to get infected without realizin by Anonymous Coward · · Score: 5, Funny

    I don't think it runs on anything except a 5 year old ubuntu with default setup and you need to kill pulseaudio + make sure your microphone is alsa device 0:1 for the experimental recording function. Also try disabling compositing, if your screenshots only show the desktop background.

    You might have to create the certs for the encrypted uploads manually if the system isn't getting enough entropy fast enough or the Trojan will assume that the connection timed out and go into an endless loop.

    Just run the Windows version with wine until the devs get their shit together!