Slashdot Mirror
New Linux Trojan Is A DDoS Tool, a Bitcoin Miner, and Web Ransomware (softpedia.com)
An anonymous reader writes: A trojan that targeted Drupal sites on Linux servers last May that was incredibly simplistic and laughable in its attempt to install (and fail) web ransomware on compromised websites, has now received a major update and has become a top threat on the malware scene. That trojan, named Rex, has evolved in only three months into an all-around threat that can: (1) compromise servers and devices running platforms like Drupal, WordPress, Magento, Jetspeed, Exarid, AirOS; (2) install cryptocurrency mining in the background; (3) send spam; (4) use a complex P2P structure to manage its botnet; and (5) install a DDoS agent which crooks use to launch DDoS attacks.
Worse is that they use their DDoS capabilities to extort companies. The crooks send emails to server owners announcing them of 15-minute DDoS tests, as a forewarning of future attacks unless they pay a ransom. To scare victims, they pose as a known hacking group named Armada Collective. Other groups have used the same tactic, posing as Armada Collective, and extorting companies, according to CloudFlare.
Worse is that they use their DDoS capabilities to extort companies. The crooks send emails to server owners announcing them of 15-minute DDoS tests, as a forewarning of future attacks unless they pay a ransom. To scare victims, they pose as a known hacking group named Armada Collective. Other groups have used the same tactic, posing as Armada Collective, and extorting companies, according to CloudFlare.
it is obvious that the person posting these is busy in FUDing.
After all, you have millions of people looking over source code, so any bugs and vulnerabilities are guaranteed to be found and repaired quickly. This will be fixed quickly and only a few systems will be exploited. On Windows, however, this would be crippling, spreading to many millions of systems while Microsoft waited a month or two to issue a fix. This isn't a story because open source software is guaranteed to be fixed quickly.
This has already been fixed.
If you're a Windows user, you have nothing to worry about. Only Linux is affected by this trojan.
This is why I don't install social bullshitting platforms, and I run custom-built web servers that only support the bare minimum subset of features that I absolutely need for my sites to function. Which means if I need dynamic content generated by a script, I'll run that script from an HTTP server written in bash. Web frameworks are for the weak minded,
Linux has nothing to do with this. It's a Drupal security issue.
I expected better reporting of an issue like this from Slashdot. Then again, maybe not...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
in its attempt to install (and fail) web ransomware
It attempted to "fail" web ransomware? What does that mean?
That trojan, named Rex, has evolved
No, it's been reprogrammed.
systemd is Roko's Basilisk.
It will only affect Linux servers that are run by people who have a single-user OS mindset (AKA Windows). Anyone with a clue doesn't run Linux with full superuser permissions.
So every Desktop Linux OS being used as a server.
As it is, the best way to solve this is to quit using shitty CMS software that is full of holes like Wordpress (The "Microsoft Windows" of the CMS's)
Too many "off the shelf" software is used by people who don't know about about security, and Wordpress comes with NOTHING to prevent being taken over. It's Windows 95 all over again.
Quite a bit of the world's banking infrastructure, including customer-facing sites run on Linux. That alone shows the utter cluelessness of morons like you.
Of course, an incompetent Linux admin (for example a former incompetent Windows admin) can configure Linux to be insecure and install insecure versions of applications.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
if at first you don't succeed... (95rtm, 98rtm, me, vista, 8, 10) try, try again... even the malware on linux is showing-up microsoft.
the problem is, that's exactly what they do... every time they fuck up windows real good, they've followed-up with something usable... until now.. they seem to have forgotten that lesson and just shovel more shit these days: 10... backported bullshit updates... all-or-nothing cumulative updates for 7/8... ms account required just to install a *store bought* office... bribes^H^H^H^H^H^Hpaying users to use their stuff (edge, bing before that)...
I'm reading from this that nerds are easy to socially engineer. If you want them to fix something - even the code in your prototype malware - all you do is put it out and wait for them to give a scathing but accurate critique, then follow their advice.
For there is nothing so insecure as a nerd's ego, which means they're willing to demonstrate their prowess at every opportunity.
It's like the adage that if you want a right answer to something on the Internet, you don't ask a question, but give the wrong answer.
Alert. Clueless Windows user thinks desktop Linux runs like desktop Windows.
Unpossible. Linux is secure by design. Stop FUDing you Micro$oft SHILLS!
A trojan that targeted Drupal sites on Linux servers last May that was incredibly simplistic and laughable in its attempt to install (and fail) web ransomware on compromised websites
Let's go ahead and fix that:
A trojan that targeted Drupal sites on Linux servers last May that was incredibly simplistic and laughable in its attempt (and failure) to install web ransomware on compromised websites
Much better.
This. Dumbest comment I've read on slashdot.
...except this is NOTHING like Blaster.
This is a Trojan, which by definition requires a great deal of user intent in order to work.
No, this is much more like Microsoft Office.
A Pirate and a Puritan look the same on a balance sheet.
And that is really saying something. It is Slashdot.....
unfortunately just like Windows Linux is not secure by default, it actually requires skilled admins to correctly lock it down. Many hobbyists or home users just jump on the "Linux is secure" bandwagon and don't realise that security actually requires effort on their part. This is why there are so many compromised Linux servers, bad admins are common and many of them don't even realise they are bad.
The claim is that a) it is significantly easier to lock Linux down and b) the result is far better. With an incompetent admin, Linux is not more secure. No argument there. But this is also not a surprise. In actual fact, a networked computing device will be insecure, unless competently configured and administrated. Eventually, this may change, but not anytime soon.
The other thing is that admins that are actually competent often consider Windows to be an insult, because of how hard it makes good system administration.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Yes it is always Microsoft or Wordpress. Never Linux. As someone who uses both regularly, I agree Linux is more secure and Microsoft products are 10 times easier to use then their overly complex Linux analogues.
With an incompetent admin, NOTHING is secure.
Your last comment is spot on. About 15 years ago I was bounced out the door of a not so small manufacturing business because someone higher up came in and thought we needed to be running Windows servers instead of HP/UX (and I had no problem with telling him what I thought of the idea.) Within a year, he had replaced one part time administrator (me, who was free to do things like user support literally half of every day) with three full time administrators. Between that, new hardware, licensing costs, and as it turned out training, the budget increased by literally a factor of five, or so I was told.
So yeah, the updated version of the old saying might be "nobody ever got fired for buying Microsoft" but honestly they should be.
Yes, security holes in WordPress, Magento, Jetspeed, Exarid, AirOS get the malware onto the system. But the malware is for Linux, and the subject and summary valid.