11 ms·
Linux ransomware in the wild
- joecool1029 9y agoNice read but nothing particularly special here and it happened months ago. The title is alarmist. TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.
- waynecochran 9y agoFirst time I've seen ransomware on Linux though ... maybe I'm not paying attention...
- jcun4128 9y agoYeah I thought I was doing alright dual adblock and virtual box.
- rjzzleep 9y agoIsn't that how most ransomware spreads? Here's a detailed view on Angler exploit kit which spreads through ad networks[1]. What's a good way to browse safely without using something like tails? There's firejail[2] and obviously I can run it as a different user [1]: https://news.sophos.com/en-us/2015/07/21/a-closer-look-at-the-angler-exploit-kit/ https://news.sophos.com/en-us/2015/07/21/a-closer-look-at-th... [2]: https://firejail.wordpress.com/ https://firejail.wordpress.com/
- microcolonel 9y agoAlso, don't run ads (at least not without protection).
- rjzzleep 9y agoI assumed that was implied for every HN reader. But even though I have noscript and ublock with a lot of things blocked you never have 100% coverage.
- pletnes 9y agoPeople claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!
- 0XAFFE 9y agoYou learn with the time and also sometimes when its not so obvious, what to activate and what not, I just close the tab and don't bother with the content.
- dhimes 9y agoIt is tedious, but I do it. If I ever get lazy I always select "temporarily add..."
- rjzzleep 9y agoFor the most part here are some patterns I've noticed: 1. when pages don't work at all, try looking for cloudflare links. They might have their JS and CSS hosted there 2. When you want to play videos or audio look for *cdn domains (aliexpress has alicdn for example). These ones I tend to add to my whitelist. 3. If you have something like google apis you can add it to the whitelist and add a sitespecific conditional in adblock or ublock.
- freedomben 9y agoIt can be tedious; but so can waiting for somebody's poorly written javascript to lag your browser. I started blocking all JS by default for security, but I've actually found it to be a much better user experience as well. You deal with the annoyance of having to whitelist domains, and sure a lot of SPAs don't work at all until you enable JS for the client-side rendering, but many, many websites work far better because all the content I care about is server-side rendered and JS is used to load ads that disrupt the experience (this is especially true on mobile. For that I highly recommend the Brave browser). You'd be surprised how much better it can make parts of the web tho to have no JS :-)
- disconnected 9y ago
- fulafel 9y agoChrome has a better sandbox than Firefox, for one. A notch better would be running Qubes OS.
- wpietri 9y agoThe title seems fine to me. I knew Linux ransomware was a theoretical possibility, but I didn't know it was out there in the world. Or, as they say, "in the wild".
- spydum 9y agostand up an old version of wordpress with poor admin/admin credentials on an external box, and wait a couple hours. You'll find all sorts of malware on a linux box. ransomware included. Pretty common, though it seems most people who compromise linux machines use them to launch further attacks, not ransomware. The ransomware linux variants I see all do about the same thing: wipe various /var/log/* logfiles, they encrypt all your mysql dbs, your homedir files, and your webserver docroot.
- freedomben 9y agoI'm not sure I agree with your anlaysis. True the user ran Firefox as root (which is terrible practice), but also had the same problems on a different system that never ran firefox: > Interesting to note that another system, also a sister, seems to have caught the same, and I can't recall ever having run anything but VirtualBox VMs on that one, it's turned off right now until I figure out a recovery plan, so at least 2 systems to recover, and have one clean one to do so from. That said, it could easily be explained if SSH private keys weren't encrypted (passphrase protected) and allowed an easy hop from infected to sister. And if somebody is running Firefox as root, it doesn't seem too extreme to assume they might have unencrypted private keys... So it may just be from running Firefox as root, but it's still possible it could be from other things.
- avian 9y agoWhy does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory. If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.
- pedrocr 9y agoThere may be things an exploit can do as root that wouldn't work under your user to break out of the adobe flash "sandbox". But yeah, the real recommendation is to get rid of flash and kill it with fire. The security of free software isn't fullproof but good riddance from the web to that particular closed source blob.
- 4lch3m1st 9y agoThe whole point of security and good practices is to make harder for those arbitrary codes to be executed (or for whatever other flaws to be exploited, until they're fixed). Running a browser as root is not good practice. Doesn't mean that something bad will happen, but it's more or less line laying the cheese on the ground and expecting mice not to go after it. Even if you have none around, you just shouldn't risk it. At all. Unless you know exactly what you're doing.
- deleted 9y ago[deleted]
- joshstrange 9y ago> TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack. That has been speculated but far from proven. On the last page they are still talking about the point of entry and how they are in no way convinced it was FF/Flash.
- ryanlol 9y ago>TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack. While possible, this sounds so spectacularly unlikely that I can’t help but think that you’re just speculating.
- Filligree 9y agoThe article itself mentions running Firefox as root, but there's no way the user can be sure that's the infection vector.
- abrowne 9y agoNot trying to blame the user, just trying to understand: why would someone ever run a web browser as root? A text editor to edit system files, ok, but a browser?
- raverbashing 9y agoProbably because they were lazy and just logged in as root "like they do in windows" because they don't know how to sudo Or maybe that was not the source of the infection, just ssh enabled with a weak password
- CJefferson 9y agoSeeing as the user's main problem is their home directory was encrypted, the root doesn't seem like it would make any difference... Better would be easier ways to run browsers (and all applications) inside protected systems of some kind, so even if they are hacked they can't touch anything outside their own cache directory, and creating downloaded files.
- 482794793792894 9y agoYou're describing a sandbox. You run the security-vulnerable routine inside a separate process and give this process the most minimal read/write-permissions that the routine can still work with. Flash itself has been sandboxed inside Firefox's Plugin Container since forever and Firefox is getting a sandbox around tabs as we speak. But you can break out of sandboxes. By either exploiting a bug in the OS that bypasses process permissions or by finding a hole in the sandbox that allows you to do things. I imagine, for example, if you want to upload a file, then the tab-process has to talk to the less restricted main-Firefox-process, which has to then open up a file-chooser dialog and give control to the user. But it could for example be possible to somehow malform this request to the main-Firefox-process, so that the file-chooser crashes and just hands over a random file, before the user has even seen the dialog. (Obviously, I'm not going to come up with an actual security vulnerability on the spot here.) This kind of vulnerability can't be fixed with a sandbox. You need some way to upload files, for which you'll need filesystem access in some way and to pretty much the entire Home-directory. Theoretically, you could require the user to copy the file into a separate "Upload"-directory and then only have read-permissions to that directory, but that's hardly user-friendly and would probably end up with some users keeping their entire Home-directory underneath that Upload-directory.
- cisanti 9y agoI don't understand from this post why run Firefox as root and why have in addition flash enabled on Linux. But it's still interest that they bother with making ransomware the first place for Linux.
- pritambaral 9y agoLots of servers run Linux. Lots of data to hold ransom on lots of servers running Linux.
- cisanti 9y agoBut who runs flash on server as root?! If this was the source..
- yjftsjthsd-h 9y agoIt's a multi-stage thing, first stage gets into a system by browser exploit, then it uses SSH keys to get everywhere else
- Sir_Cmpwn 9y agoIt doesn't seem to have been mentioned on the forums, which is alarming, but the correct response to finding out your machine has been owned is to shut it the fuck down. Right away. Then boot up a rescue CD, which will have a known working system (read: not compromised), from which you can do some forensic work to find out how you were owned and what data is recoverable. Take the data you can recover offline and then reinstall from scratch. Don't try to fix it, just recover what you can and throw the rest away.
- mcjiggerlog 9y agoEven better - make sure that everything is under version control or backed up so that in such a situation you can just reinstall from scratch without introducing the possibility of "recovering" infected files.
- ricardobeat 9y agoThere’s still the possibility that the infected files have been already committed to version control or backups, before it activated.
- empath75 9y agoAs a developer, my laptop could blow up at any point and I’d lose very little of importance. Maybe an hours worth of work at most. My real concern would be them grabbing secrets, not losing any data.
- zython 9y ago
- KGIII 9y agoHmm... I half expected this to be a joke and the post about how they had to compile it themselves and were trying to get the dependencies squared away. Friends don't let friends run Flash. Does Gentoo have Firejail readily available? That would have prevented this, I'm pretty sure.
- jaclaz 9y agoIt seems like some variant of the Linux.Encoder.1 (2015): http://www.zdnet.com/article/crypto-ransomware-strikes-linux-but-attackers-botch-private-key/ http://www.zdnet.com/article/crypto-ransomware-strikes-linux... https://labs.bitdefender.com/2015/11/linux-ransomware-debut-fails-on-predictable-encryption-key/ https://labs.bitdefender.com/2015/11/linux-ransomware-debut-... probably "python based" and, as mentioned on the gentoo forums, the ransomware mesage is very similar to the one in: https://github.com/jdsecurity/CryptoTrooper https://github.com/jdsecurity/CryptoTrooper
- ybaumes 9y agoFake news. There is no virus on Linux..
- sctb 9y agoPlease don't post unsubstantively on Hacker News. We'd like to skip right to gratifying our intellectual curiosity. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- campuscodi 9y agoLinux ransomware has been around since the fall of 2015. Nothing special, mate.
- campuscodi 9y agoWow...voted down for speaking the truth and bringing some actual knowledge to this fear-mongering thread. HN is turning into Slashdot, I see.
- segmondy 9y agoThis is 7 months old. From March. Title makes it sound like breaking news.
- binaryapparatus 9y agoThere is trend of insecurity/vulnerabilities that seems to gain in speed in recent months. Not trying to sound ominous and nothing to really point finger to but it seems like a thing. Since few months ago I do almost all browsing in carefully set w3m. No javascript at all of course and certainly no flash. I am typing this in vim which is set as default form editor in w3m for me. Edit: if you are wondering if w3m can work well try looking at HN using w3m, its a real beauty.
- hawski 9y agoThat is one of the reasons I am thinking about having /home on NILFS2 ([1] a log-structured file system) in my dabbing with my own Linux distribution. When you have constant snapshots then ransomware can't do much, can it? [1] https://en.wikipedia.org/wiki/NILFS https://en.wikipedia.org/wiki/NILFS
- yjftsjthsd-h 9y agoOnly if the snapshots are read-only and/or invisible by default; some systems expose snapshots as additional directories under some mountpoint, in which case they just get encrypted as well.
- hawski 9y agoLog-structured file systems work by treating disk space as circular log. They only append and then wrap around. Snapshots are natural consequence.
- detaro 9y agoDepends on what permissions it has. If it runs as root, it probably could delete/mess up snapshots. If it's going to do so, especially for non-mainstream filesystems, is another question.
- hawski 9y agoIf it runs as root you have much more to worry about, but that's of course one of the problems.
- czep 9y ago> "Yeah, I'm guilty of running FireFox as root." Noooooooooooooo!
- deleted 9y ago[deleted]
- pbhjpbhj 9y agoHadn't thought of it before but it might be an idea to run my browser (Firefox, Kubuntu 17.04) under a separate user that doesn't have access to my main user files. Might be simplest to just create a user through the DE, then "su -c" from my main user to run the browser?
- unkown-unknowns 9y agoOut of the box it'll probably tell you "Client is not authorized to connect to server" if you try to run anything X11 as another user. However it should be possible to configure your system such that it doesn't like such: https://wiki.archlinux.org/index.php/xorg#X_clients_started_with_.22su.22_fail https://wiki.archlinux.org/index.php/xorg#X_clients_started_...
- pbhjpbhj 9y agoI currently run my kids browsers under my user by doing "xhost +local:; su -l -c /usr/bin/firefox $USERNAME" where USERNAME is the kids login. I may have made changes to enable that, don't recall sorry.
- digi_owl 9y agoAn extra layer of protection may be offered by using the likes of xpra. https://xpra.org/ https://xpra.org/
- 482794793792894 9y agoUploading files would become a chore, as you'd always have to copy them over from your actual Home-directory to that Firefox-user's, but yeah, it would add another thick layer that attackers would have to get through. Mind that Firefox is also getting sandboxed tabs as we speak, so yet another layer that attackers would have to get through, which wasn't in place at the time of this attack.
- pbhjpbhj 9y agoCan make the user have read access to specified folders on the main user, seems easy enough.
- xpaulbettsx 9y agoYes, I got hit by this on two separate machines in June or so, they'll break into one, steal all the SSH keys and look through your history looking for more machines to break into. It sucks ass. I suspect that my breakin was because of an outdated Wordpress installation I kept around. This malware is super thorough and super obnoxious. Keep your machines up-to-date.