Neutrino Exploit Kit Has a New Way To Detect Security Researchers (csoonline.com)

itwbennett writes: [The Neutrino exploit kit] is using passive OS fingerprinting to detect visiting Linux machines, according to Trustwave researchers who found that computers they were using for research couldn't make a connection with servers that delivered Neutrino. Daniel Chechik, senior security researcher at Trustwave's SpiderLabs division wrote that they tried changing IP addresses and Web browsers to avoid whatever was causing the Neutrino server to not respond, but it didn't work. But by fiddling with some data traffic that Trustwave's computers were sending to the Neutrino server, they figured out what was going on.

Comments

This is not the year.

[Anonymous Coward]

Until we get proper malware support there can be no year of the linux desktop.

Re:This is not the year.

[JustAnotherOldGuy]

Until we get proper malware support there can be no year of the linux desktop.

I know- as someone who's in the process of switching to Linux Mint, I'm having trouble finding replacements for stuff like Zeus, Conficker, Koobface, Rustock, and Cutwail.

If someone could point me towards some quality malware to infect my Linux box with, I'd be grateful.

Re:This is not the year.

[Anonymous Coward]

https://www.winehq.org/ You're welcome

Re:This is not the year.

[NotInHere]

On desktop linux, even the viruses are open source!

Re:This is not the year.

[dimko]

Not good enough. Remove wine and mentioned above won't work.

Re:This is not the year.

[Ol Olsoc]

If someone could point me towards some quality malware to infect my Linux box with, I'd be grateful.

Dual boot with Windows - that should do it.

Re:This is not the year.

[ArmoredDragon]

I think "virus opens you" is applicable to any platform. Allusion to Russian jokes notwithstanding.

Re: This is not the year.

[Anonymous Coward]

With Linux, you are the infection.

Re:This is not the year.

[hankwang]

"point me towards some quality malware to infect my Linux box with, I'd be grateful."

Set a password 'root' for the root user, let sshd listen to the internet from the default port, and wait a few days.

Re:This is not the year.

[JustAnotherOldGuy]

Set a password 'root' for the root user, let sshd listen to the internet from the default port, and wait a few days.

I'm probably not technically proficient enough to figure out how to do that, so for the time being I guess I'll have to search the repositories for some highly-rated malware. Sadly there doesn't appear to be a version of Macafee Anti-Virus for Linux yet.

I did find something called "mkfs.ext4 /dev/sda1" which looks promising; I'll try it and let you know how it wo*J^$ - @~_![[^8(fx4| 5n är föd#&

Headline

[Livius]

For a second I thought sub-atomic particles were turning the tables on physicists.

(Seriously, we need more original names for these things.)

So spoof packets and find safety?

[140Mandak262Jamuna]

So a windows wanting to avoid infection from neutrino should spoof the TCP packets and pretend to be Linux?

Re:So spoof packets and find safety?

[klui]

The second link states passive OS fingerprinting, p0f, was developed by Michal Zalewski. http://lcamtuf.coredump.cx/p0f... shows your connection's fingerprint. It may be as easy as using a proxy such as Squid to perform the "spoofing."

Linux fails again

[shawn2772]

Yet again, Linux fails to be properly interoperable with the Windows ecosystem. Heck, I'll bet you can't even get properly detected and infected by Neutrino when running WINE.

Sigh.

Wait, what?

[iwaybandit]

Malware devs are protecting malware researchers? Hey, thanks!

Fatal flaw?

[Anonymous Coward]

If the exploit kit won't talk to malware detectors, it's possible to spoof all computers so they look like malware detectors, and the exploit is rendered harmless.

Re:Fatal flaw?

[silentcoder]

In this case it sounds like that's basically exactly what happens for Linux users, we'll be basically immune to Neutrino since the server will refuse packets from us.

well

[rossdee]

your tinfoil hat certainly won't stop neutrinos

oh, we are not talking about the massless subatomic particle?

Re:But you ARE a webmaster right?

[JustAnotherOldGuy]

Yes, I run several sites. What's your point?

Re:Which sites & do you get paid by ads on the

[JustAnotherOldGuy]

Which sites & do you get paid by ads on them? Finish the answer & point them out so I can verify this...

Lol, like I would tell a scumbag like you specifically what sites I run. Thanks, but I don't need some shitbag like you trying to DDOS me or hack my sites.

To answer your second question, some some make money from ads, some some sell products.