Slashdot Mirror
New Linux Trojan Is A DDoS Tool, a Bitcoin Miner, and Web Ransomware (softpedia.com)
An anonymous reader writes: A trojan that targeted Drupal sites on Linux servers last May that was incredibly simplistic and laughable in its attempt to install (and fail) web ransomware on compromised websites, has now received a major update and has become a top threat on the malware scene. That trojan, named Rex, has evolved in only three months into an all-around threat that can: (1) compromise servers and devices running platforms like Drupal, WordPress, Magento, Jetspeed, Exarid, AirOS; (2) install cryptocurrency mining in the background; (3) send spam; (4) use a complex P2P structure to manage its botnet; and (5) install a DDoS agent which crooks use to launch DDoS attacks.
Worse is that they use their DDoS capabilities to extort companies. The crooks send emails to server owners announcing them of 15-minute DDoS tests, as a forewarning of future attacks unless they pay a ransom. To scare victims, they pose as a known hacking group named Armada Collective. Other groups have used the same tactic, posing as Armada Collective, and extorting companies, according to CloudFlare.
Worse is that they use their DDoS capabilities to extort companies. The crooks send emails to server owners announcing them of 15-minute DDoS tests, as a forewarning of future attacks unless they pay a ransom. To scare victims, they pose as a known hacking group named Armada Collective. Other groups have used the same tactic, posing as Armada Collective, and extorting companies, according to CloudFlare.
After all, you have millions of people looking over source code, so any bugs and vulnerabilities are guaranteed to be found and repaired quickly. This will be fixed quickly and only a few systems will be exploited. On Windows, however, this would be crippling, spreading to many millions of systems while Microsoft waited a month or two to issue a fix. This isn't a story because open source software is guaranteed to be fixed quickly.
If you're a Windows user, you have nothing to worry about. Only Linux is affected by this trojan.
Linux has nothing to do with this. It's a Drupal security issue.
I expected better reporting of an issue like this from Slashdot. Then again, maybe not...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
in its attempt to install (and fail) web ransomware
It attempted to "fail" web ransomware? What does that mean?
That trojan, named Rex, has evolved
No, it's been reprogrammed.
systemd is Roko's Basilisk.
It will only affect Linux servers that are run by people who have a single-user OS mindset (AKA Windows). Anyone with a clue doesn't run Linux with full superuser permissions.
Quite a bit of the world's banking infrastructure, including customer-facing sites run on Linux. That alone shows the utter cluelessness of morons like you.
Of course, an incompetent Linux admin (for example a former incompetent Windows admin) can configure Linux to be insecure and install insecure versions of applications.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Alert. Clueless Windows user thinks desktop Linux runs like desktop Windows.
A trojan that targeted Drupal sites on Linux servers last May that was incredibly simplistic and laughable in its attempt to install (and fail) web ransomware on compromised websites
Let's go ahead and fix that:
A trojan that targeted Drupal sites on Linux servers last May that was incredibly simplistic and laughable in its attempt (and failure) to install web ransomware on compromised websites
Much better.
...except this is NOTHING like Blaster.
This is a Trojan, which by definition requires a great deal of user intent in order to work.
No, this is much more like Microsoft Office.
A Pirate and a Puritan look the same on a balance sheet.
The claim is that a) it is significantly easier to lock Linux down and b) the result is far better. With an incompetent admin, Linux is not more secure. No argument there. But this is also not a surprise. In actual fact, a networked computing device will be insecure, unless competently configured and administrated. Eventually, this may change, but not anytime soon.
The other thing is that admins that are actually competent often consider Windows to be an insult, because of how hard it makes good system administration.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Yes, security holes in WordPress, Magento, Jetspeed, Exarid, AirOS get the malware onto the system. But the malware is for Linux, and the subject and summary valid.