Slashdot Mirror
Linux Trojan Mines For Cryptocurrency Using Misconfigured Redis Servers (softpedia.com)
An anonymous reader writes: In another installment of "Linux has malware too," security researchers have discovered a new trojan that targets Linux servers running Redis, where the trojan installs a cryptocurrency miner. The odd fact about this trojan is that it includes a wormable feature that allows it to spread on its own. The trojan, named Linux.Lady, will look for Redis servers that don't have an admin account password, access the database, and then download itself on the new target. The trojan mines for the Monero crypto-currency, the same one used by another worm called PhotoMiner, which targets vulnerable FTP servers. According to a recent Risk Based Security report from last month, there are over 30,000 Redis servers available online without a password, of which 6,000 have already been compromised by various threat actors.
clearly the story is a fake there is no virus for linux because linux is OPEN SORES which means its BUGS are shallow and it is FREE FROM MALWARE. Wasn't freedom from malware one of the four freedoms?
>there are over 30,000 Redis servers available online without a password, of which 6,000 have already been compromised by v arious threat actors.
That is specific FBI language, used only by FBI.
FBI BurEAU HeaD
ur
Set a password. Problem solved. There is literally nothing being exploited except total lack of a password to get in.
Same thing would happen if you put up a Windows server with no password.
There is an "authentication" feature, but it's amazingly primitive, and the credentials are sent in the clear -- in other words, next to useless. The rest of the page makes it fairly clear: If you are running a Redis server accepting connections from the open Internet, you are an idiot.
Editor, A1-AAA AmeriCaptions
So in other words, the whole article/summary is flamebait/clickbait. Only an idiot would install a server and not configure an admin password.
Saying that "Linux has malware!" because morons misconfigure an application running on Linux, is like saying "Windows has malware!" because SQL Server was installed with a blank sa password. I mean, sure, Windows does have malware, but this is just clickbait nonsense.
"Misconfigured" is an understatement. If your server got rekt like this, I say you deserve a personal verbal smackdown by Linus himself. Complete with vulgar suggestions on how your mother bangs farm animals from three counties over.
Really, this is like having a tank, and losing in single combat to Zangief. Sure, he wrestles bears for fun, but c'mon, he can't pile drive a frickin' TANK.
Operating in the sphere of open source security, I know very well how secure open source software CAN be. But I know too well how often people cut corners because of the feeling of herd security and the trust that "the community" will take care of it. Sadly, this behavior often comes from the technical folks...
fact.
This is the year of the Linux desktop! ;-)
This comment is FBI Slashdot too.
Just try shutting the fuck up? Maybe pass out parking tickets?
Find a school hallway to monitor?
You can have the most secure OS in the world and get hosed from social engineering. That is the world of spycraft. Slashdot right now is exactly that. A lot of recent stories have been all bait. Slashdot asks: Where do you get YOUR torrents from. etc.
If your Apache server fucks up it is not because of Linux. If your Redis server or samba server fuck up it is not because of Linux either. If something does go wrong they will patch it asap. This is not like Microsoft which is spyware itself. It is also not closed source like Apple nor is it gay. Linus works very hard to do what he's done and now even the International Space Station is on Linux. Everywhere is Linux, including Slashdot. This is why the FBI killed Ian Murdock of Debian. It is mature and stable and a very high number of users are loyal to it.
Head's up again on THIS FUCKING SITE FUCK YOU DICE and Debian.
our faithful "editor" has apparently never heard of the Morris Worm.
"I don't know, therefore Aliens" Wafflebox1
What does the Morris worm have to do with BeauHD and this article?
Only 6000 compromised servers? We need the full 30k! Cmon guys, get on the ball here! That worm doesn't spread itself fast enough. All those servers must be pwned immediately!
What the heck is Redis? Okay, I see that it's some sort of database server... but why would anyone use it instead of software people have heard of?
#DeleteChrome
If you are running a Redis server accepting connections from the open Internet, you are an idiot.
Good thing we don't have too many of them! No, wait...
Maybe Lennart Poettering could take some tips from linux malware writers on how to write working code.
I had a properly configured redis server once, then it got hacked. Like, within a month. Fortunately it was all statistical data on it, but I'll never use this product again since the hacker was able to get root access on the server.
I think that this "trusted" within "trusted environments" scheme is unfit for todays and future IT integration.
Because it will not encourage the developer(s) to write code with security in mind(*). Because it will remove this vector from their mindset.
Secondly as an integrator you would need to built that trusted environment, infrastructure and with a "security neglecting" application another headache.
Many security breaches manifest themself with a breakin into those "trusted enviroments", and my personal point is there is no such thing like a "trusted environment" instead it should be called "not-directly-exposed environment"
And yes even your localhost applications should have authentification, because that todays infrastructure is so complex even without neglectence it is so incredible easy to do things wrong.[1]
(*)Security in mind:
- Learn from mistakes of other - read exploited code understand why it was exploited and learn from the safe replacement
- Thinking: your program is prey in a big bucket filled with parasites as well as predators that will use every chance you give them
- basically secure by default, not secured by a long terms of service.
[1] https://apache.slashdot.org/st...
I agree with the design. If you want things like this to be secure you want to use them over the internet, you should use TLS with pinned certificates on both the client and server.
Designing security into most protocols is stupid and superfluous when TLS already provides the necessary mechanisms of AA&C.
I'm of the further opinion that TLS should be removed from the daemon process, and provided by the kernel or NIC, because it decomplicates software design and makes it more modular: want to rip out TLS and replace it with CurveCP, go ahead, no changes to the software required.
When you combine that with a good security model like Capsicum+CloudABI you end up with a highly secureable system, that doesn't take much thought to get right.
Would that kill you to put in the summary? SMTP server? RDBMS? A game?
I see from a link that a reader posted that they have ".io" domain, which tells me that they're hipster crapware, so its hardly surprising its a target (of other hipsters, running THEIR crapware).
Edit, for crying out loud.
here's an idea for redis, and such systems that aren't supposed to directly on the internet:
- by default, don't listen on any "public" IPv4 or IPv6 global unicast addresses:
http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xhtml
http://www.iana.org/assignments/ipv6-unicast-address-assignments/ipv6-unicast-address-assignments.xhtml
- but do listen on all other "internal" IPv4 and IPv6 addresses:
https://en.wikipedia.org/wiki/Unique_local_address
https://en.wikipedia.org/wiki/Link-local_address
https://en.wikipedia.org/wiki/Localhost
https://en.wikipedia.org/wiki/Private_network
Reference: https://en.wikipedia.org/wiki/Reserved_IP_addresses
- Of course, have a configuration setting available to override that check, with a comment\warning that a firewall must be configured to block ports, xyz, from untrusted networks to prevent redis from being hacked.
Why use Monero?
Finally, the year of the Windows desktop is here!
GNU/LINUX *IS* secure. This article is clickbait bullshit.
Imagine seeing a story about how someone hacked a car's engine start system to allow an unauthorized user to start the car and drive it away. The "hack" only requires that the keys are left in the ignition, and the driver's side window is left rolled down.
It's bullshit. This is a flaw caused by retards who aren't competent being allowed to administer systems. It's not even a hole in the OS, it's some software package.
Congrats, Assdot. Another non-story.
another in a long line of reasons why devs should not be allowed to use networks.
No. This is so wrong it is Not Even Wrong.
But the devs documented it, and clearly too! How can this be wrong?
It's wrong because the security perimeter has collapsed. All the best security information says so; every network of non-trivial size is already compromised. Thus the dev advice to deploy Redis "by trusted clients inside trusted environments" is brain-dead. There are no such environments anymore, not in the wild.
OK, if you set up an isolated lab, not connected to the internet, and surrounded by a Faraday cage. You also have to eliminate the human factor, so no users are permitted, not even trusted admins. What have you got? A laboratory curiosity, not useful and not of interest. It's a proverbial hothouse for navel gazers.
In this day and age, sending credentials in clear text is "commit the developer to a home for the insane" level of irresponsible. It would be acceptable only in Alpha stage software, pre version 1.0 and when credential encryption is still on the To-Do List. And by the way, if Microsoft had done this, the Linux fans out there would be savaging them mercilessly. Which for once, would be the correct thing to do.