Slashdot Mirror
New Linux Trojan Is A DDoS Tool, a Bitcoin Miner, and Web Ransomware (softpedia.com)
An anonymous reader writes: A trojan that targeted Drupal sites on Linux servers last May that was incredibly simplistic and laughable in its attempt to install (and fail) web ransomware on compromised websites, has now received a major update and has become a top threat on the malware scene. That trojan, named Rex, has evolved in only three months into an all-around threat that can: (1) compromise servers and devices running platforms like Drupal, WordPress, Magento, Jetspeed, Exarid, AirOS; (2) install cryptocurrency mining in the background; (3) send spam; (4) use a complex P2P structure to manage its botnet; and (5) install a DDoS agent which crooks use to launch DDoS attacks.
Worse is that they use their DDoS capabilities to extort companies. The crooks send emails to server owners announcing them of 15-minute DDoS tests, as a forewarning of future attacks unless they pay a ransom. To scare victims, they pose as a known hacking group named Armada Collective. Other groups have used the same tactic, posing as Armada Collective, and extorting companies, according to CloudFlare.
Worse is that they use their DDoS capabilities to extort companies. The crooks send emails to server owners announcing them of 15-minute DDoS tests, as a forewarning of future attacks unless they pay a ransom. To scare victims, they pose as a known hacking group named Armada Collective. Other groups have used the same tactic, posing as Armada Collective, and extorting companies, according to CloudFlare.
Open source: security by the other kind of obscurity (i.e. wishful thinking).
it is obvious that the person posting these is busy in FUDing.
After all, you have millions of people looking over source code, so any bugs and vulnerabilities are guaranteed to be found and repaired quickly. This will be fixed quickly and only a few systems will be exploited. On Windows, however, this would be crippling, spreading to many millions of systems while Microsoft waited a month or two to issue a fix. This isn't a story because open source software is guaranteed to be fixed quickly.
This has already been fixed.
This is a harbinger of the inevitable for Linux. It's simply a matter of time before Linux gets hit by a crippling worm like Blaster. The Linux kernel is a mess. Sure, there are some areas that are well-maintained, but there are many areas that are poorly coded and probably vulnerable. The Linux source is a mess, with so much code thrown together, some of which is awfully written, poorly commented, and just a complete disaster. It's just a matter of time before a particularly nasty vulnerability is found in the Linux kernel, and a worm is written that races across networks while infecting any server in its path. Any of the BSD code bases are far cleaner than Linux, far better maintained, and are far more secure. Linux has likely nearly reached its peak on servers, because when this happens, users will flock to BSD.
If you're a Windows user, you have nothing to worry about. Only Linux is affected by this trojan.
This is why I don't install social bullshitting platforms, and I run custom-built web servers that only support the bare minimum subset of features that I absolutely need for my sites to function. Which means if I need dynamic content generated by a script, I'll run that script from an HTTP server written in bash. Web frameworks are for the weak minded,
The hackers just waltzed in.
Linux has nothing to do with this. It's a Drupal security issue.
I expected better reporting of an issue like this from Slashdot. Then again, maybe not...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
in its attempt to install (and fail) web ransomware
It attempted to "fail" web ransomware? What does that mean?
That trojan, named Rex, has evolved
No, it's been reprogrammed.
systemd is Roko's Basilisk.
if at first you don't succeed... (95rtm, 98rtm, me, vista, 8, 10) try, try again... even the malware on linux is showing-up microsoft.
the problem is, that's exactly what they do... every time they fuck up windows real good, they've followed-up with something usable... until now.. they seem to have forgotten that lesson and just shovel more shit these days: 10... backported bullshit updates... all-or-nothing cumulative updates for 7/8... ms account required just to install a *store bought* office... bribes^H^H^H^H^H^Hpaying users to use their stuff (edge, bing before that)...
I'm reading from this that nerds are easy to socially engineer. If you want them to fix something - even the code in your prototype malware - all you do is put it out and wait for them to give a scathing but accurate critique, then follow their advice.
For there is nothing so insecure as a nerd's ego, which means they're willing to demonstrate their prowess at every opportunity.
It's like the adage that if you want a right answer to something on the Internet, you don't ask a question, but give the wrong answer.
Unpossible. Linux is secure by design. Stop FUDing you Micro$oft SHILLS!
A trojan that targeted Drupal sites on Linux servers last May that was incredibly simplistic and laughable in its attempt to install (and fail) web ransomware on compromised websites
Let's go ahead and fix that:
A trojan that targeted Drupal sites on Linux servers last May that was incredibly simplistic and laughable in its attempt (and failure) to install web ransomware on compromised websites
Much better.
Yes, security holes in WordPress, Magento, Jetspeed, Exarid, AirOS get the malware onto the system. But the malware is for Linux, and the subject and summary valid.