Slashdot Mirror
New Linux Crypto-miner Steals Your Root Password and Disables Your Antivirus (zdnet.com)
Malware targeting Linux users may not be as widespread as the strains targeting the Windows ecosystem, but Linux malware is becoming just as complex and multi-functional as time passes by. ZDNet reports: The latest example of this trend is a new trojan discovered this month by Russian antivirus maker Dr.Web. This new malware strain doesn't have a distinctive name, yet, being only tracked under its generic detection name of Linux.BtcMine.174. But despite the generic name, the trojan is a little bit more complex than most Linux malware, mainly because of the plethora of malicious features it includes. The trojan itself is a giant shell script of over 1,000 lines of code. This script is the first file executed on an infected Linux system. The first thing this script does is to find a folder on disk to which it has write permissions so it can copy itself and later use to download other modules. Once the trojan has a foothold on the system it uses one of two privilege escalation exploits CVE-2016-5195 (also known as Dirty COW) and CVE-2013-2094 to get root permissions and have full access to the OS.
This new malware strain doesn't have a distinctive name, yet,
How about:
VeggieCow (roots!)
AVTerminator
NohupForAll (read the article)
MinerMiner209-519er (perhaps too much a stretch).
Actually you really should read through the article, more interesting than I thought it would be from the summary and this little bugger really does a number on a system.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
that have long since been patched.
update your damn systems, people.
Seeing the bitcoin prices falling and falling I wonder: "Why would malware creators still create such stuff, isn't there anything more profitable than this?"
This is an example of why local privilege escalations should never be scoffed at. You can blather all you want about permissions etc, but only one slip is required, and you're shit out of luck
The sad thing is that I've had to argue this point for 20 years now
Not one shred of information on /how/ the script got on the system in the first place
I'm calling bullshit on the article.
With such a critical piece of information missing, it's clearly scaremongering and pretty close to fake news.
No it doesn't. The term doesn't refer to using a script, but rather to download one you didn't write and/or understand and just use it.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
And it seduces your mum and steals your bike.
Can't be all bad then. At least it leaves my dog alone!
Depends if its the compacted obfuscated form or not. Having seen a lot of exploit shell, the original stuff is going to be very low information density.
Most Unix like systems are happy without a "root" user as long as there is a user 0 called something.
I still don't agree with the POSIX standard that allows root to write to mode 000 files. If its 000, it was done for a reason and that means even root shouldn't be able to screw with it particularly if it is root:root mode 000.
No antivirus and no root password. I have one machine that's pretty much always idle and another that's a laptop. I would notice the fans kick on if either of those started mining.
I think I'm good.
"Once the trojan has a foothold on the system it uses one of two privilege escalation exploits CVE-2016-5195 (also known as Dirty COW) and CVE-2013-2094 to get root permissions and have full access to the OS."
Is this really malware that is targeting systems that haven't been patched in two years?
The Summary Wrote:
This script is the first file executed on an infected Linux system.
Let's name it systemd!
-=This sig has nothing to do with my comment. Move along now=-
A good precedent is the Morris Worm, the first major worm attack against UNIX systems. Published on Nov. 2, 1988, the worm used known vulnerabilities in popular UNIX tools such as sendmail, and also cracked weak passwords. Defenders effectively _broke_ the early Internet to contain the Morris Worm and while they frantically applied patches they'd considered risks to production systems before that day. Its author was eventually convicted, but Robert Tappan Morris had the best "get out of jail free" card one could imagine. His father was the head of the NSA. He is now a professor of computer science at MIT, and his current projects are listed at https://www.csail.mit.edu/pers... .
One may gobble up all resources on a system, rely on privilege escalation, hide logs, and be very hard to get rid of.
The other one is just malware.
MS appears not to care about bad press. The botnet stink gets replaced by the we'll force updates to 10 policy, we-control-your-W10-PC update policy, and the Windows as a recurring revenue service so we can push advertisements in programs forthcoming policy
See it was worth reading! It had all kinds of interesting stuff packed in there.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
People who have a clue do not work for insurance companies.
Sent from my ASR33 using ASCII
Ironically the script is placed in /etc/rc.local. Probably perfectly compatible with sysVinit.
Remember back when companies in the early 2000s would brag that their software was over a million lines of code, as a testament to some sort of level of complexity? Apparently that threshold has been pushed all the way back to only 1000 lines of code. Honestly, I blame all these copy-paste script kiddies who have never actually written code for thinking that a 1000 line program is "complex" or "large" by any stretch of the imagination.
Bring them all on. Linux is rock solid and all I got to say is bring them all on.
Having to run unsigned binary executables isn't exactly linux but a bastardisation huh? It's common now. Run as root too
A blog I run for the wealth
nt
GENERATION 26: The first time you see this, copy it into your sig on any forum and add 1 to the generation.
Since when Linux systems have antivirus as a norm? You could scan some unnecessary executable downloads, but that's it. There is no need for permanent resource hog sitting, eating and making you smile by a security illusion. When some bad code has run, the system has to be reinstalled fully. It's already dead inside. So when you install some unknown code, you could as well do that. The greatest security threat is still the promiscuous user.