6 ms·

Nice read but nothing particularly special here and it happened months ago. The title is alarmist. TL;DR: The user ran firefox as root and the attack happened

Nice read but nothing particularly special here and it happened months ago. The title is alarmist. TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.

waynecochran 9y ago
First time I've seen ransomware on Linux though ... maybe I'm not paying attention...
- jcun4128 9y ago
  Yeah I thought I was doing alright dual adblock and virtual box.
rjzzleep 9y ago
Isn't that how most ransomware spreads? Here's a detailed view on Angler exploit kit which spreads through ad networks[1]. What's a good way to browse safely without using something like tails? There's firejail[2] and obviously I can run it as a different user [1]: https://news.sophos.com/en-us/2015/07/21/a-closer-look-at-the-angler-exploit-kit/ https://news.sophos.com/en-us/2015/07/21/a-closer-look-at-th... [2]: https://firejail.wordpress.com/ https://firejail.wordpress.com/
- microcolonel 9y ago
  Also, don't run ads (at least not without protection).
  - rjzzleep 9y ago
    I assumed that was implied for every HN reader. But even though I have noscript and ublock with a lot of things blocked you never have 100% coverage.
    - pletnes 9y ago
      People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!
      - 0XAFFE 9y ago
        You learn with the time and also sometimes when its not so obvious, what to activate and what not, I just close the tab and don't bother with the content.
      - dhimes 9y ago
        It is tedious, but I do it. If I ever get lazy I always select "temporarily add..."
      - rjzzleep 9y ago
        For the most part here are some patterns I've noticed: 1. when pages don't work at all, try looking for cloudflare links. They might have their JS and CSS hosted there 2. When you want to play videos or audio look for *cdn domains (aliexpress has alicdn for example). These ones I tend to add to my whitelist. 3. If you have something like google apis you can add it to the whitelist and add a sitespecific conditional in adblock or ublock.
      - freedomben 9y ago
        It can be tedious; but so can waiting for somebody's poorly written javascript to lag your browser. I started blocking all JS by default for security, but I've actually found it to be a much better user experience as well. You deal with the annoyance of having to whitelist domains, and sure a lot of SPAs don't work at all until you enable JS for the client-side rendering, but many, many websites work far better because all the content I care about is server-side rendered and JS is used to load ads that disrupt the experience (this is especially true on mobile. For that I highly recommend the Brave browser). You'd be surprised how much better it can make parts of the web tho to have no JS :-)
      - disconnected 9y ago
- fulafel 9y ago
  Chrome has a better sandbox than Firefox, for one. A notch better would be running Qubes OS.
wpietri 9y ago
The title seems fine to me. I knew Linux ransomware was a theoretical possibility, but I didn't know it was out there in the world. Or, as they say, "in the wild".
- spydum 9y ago
  stand up an old version of wordpress with poor admin/admin credentials on an external box, and wait a couple hours. You'll find all sorts of malware on a linux box. ransomware included. Pretty common, though it seems most people who compromise linux machines use them to launch further attacks, not ransomware. The ransomware linux variants I see all do about the same thing: wipe various /var/log/* logfiles, they encrypt all your mysql dbs, your homedir files, and your webserver docroot.
freedomben 9y ago
I'm not sure I agree with your anlaysis. True the user ran Firefox as root (which is terrible practice), but also had the same problems on a different system that never ran firefox: > Interesting to note that another system, also a sister, seems to have caught the same, and I can't recall ever having run anything but VirtualBox VMs on that one, it's turned off right now until I figure out a recovery plan, so at least 2 systems to recover, and have one clean one to do so from. That said, it could easily be explained if SSH private keys weren't encrypted (passphrase protected) and allowed an easy hop from infected to sister. And if somebody is running Firefox as root, it doesn't seem too extreme to assume they might have unencrypted private keys... So it may just be from running Firefox as root, but it's still possible it could be from other things.
avian 9y ago
Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory. If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.
- pedrocr 9y ago
  There may be things an exploit can do as root that wouldn't work under your user to break out of the adobe flash "sandbox". But yeah, the real recommendation is to get rid of flash and kill it with fire. The security of free software isn't fullproof but good riddance from the web to that particular closed source blob.
  - pjmlp 9y ago
    It will come back as WebAssembly.
    - pedrocr 9y ago
      What makes you think that? WebAssembly will at least not be single implementation, closed-source, no-maintenance like Flash.
      - pjmlp 9y ago
        I am betting someone will bother to create a SWF to WebAssembly translator, maybe even Adobe.
- 4lch3m1st 9y ago
  The whole point of security and good practices is to make harder for those arbitrary codes to be executed (or for whatever other flaws to be exploited, until they're fixed). Running a browser as root is not good practice. Doesn't mean that something bad will happen, but it's more or less line laying the cheese on the ground and expecting mice not to go after it. Even if you have none around, you just shouldn't risk it. At all. Unless you know exactly what you're doing.
deleted 9y ago
[deleted]
joshstrange 9y ago
> TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack. That has been speculated but far from proven. On the last page they are still talking about the point of entry and how they are in no way convinced it was FF/Flash.
ryanlol 9y ago
>TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack. While possible, this sounds so spectacularly unlikely that I can’t help but think that you’re just speculating.
- Filligree 9y ago
  The article itself mentions running Firefox as root, but there's no way the user can be sure that's the infection vector.

waynecochran 9y ago

First time I've seen ransomware on Linux though ... maybe I'm not paying attention...

jcun4128 9y ago
Yeah I thought I was doing alright dual adblock and virtual box.

rjzzleep 9y ago

Isn't that how most ransomware spreads? Here's a detailed view on Angler exploit kit which spreads through ad networks[1]. What's a good way to browse safely without using something like tails? There's firejail[2] and obviously I can run it as a different user [1]: https://news.sophos.com/en-us/2015/07/21/a-closer-look-at-the-angler-exploit-kit/ https://news.sophos.com/en-us/2015/07/21/a-closer-look-at-th... [2]: https://firejail.wordpress.com/ https://firejail.wordpress.com/

microcolonel 9y ago
Also, don't run ads (at least not without protection).
- rjzzleep 9y ago
  I assumed that was implied for every HN reader. But even though I have noscript and ublock with a lot of things blocked you never have 100% coverage.
  - pletnes 9y ago
    People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!
    - 0XAFFE 9y ago
      You learn with the time and also sometimes when its not so obvious, what to activate and what not, I just close the tab and don't bother with the content.
    - dhimes 9y ago
      It is tedious, but I do it. If I ever get lazy I always select "temporarily add..."
    - rjzzleep 9y ago
      For the most part here are some patterns I've noticed: 1. when pages don't work at all, try looking for cloudflare links. They might have their JS and CSS hosted there 2. When you want to play videos or audio look for *cdn domains (aliexpress has alicdn for example). These ones I tend to add to my whitelist. 3. If you have something like google apis you can add it to the whitelist and add a sitespecific conditional in adblock or ublock.
    - freedomben 9y ago
      It can be tedious; but so can waiting for somebody's poorly written javascript to lag your browser. I started blocking all JS by default for security, but I've actually found it to be a much better user experience as well. You deal with the annoyance of having to whitelist domains, and sure a lot of SPAs don't work at all until you enable JS for the client-side rendering, but many, many websites work far better because all the content I care about is server-side rendered and JS is used to load ads that disrupt the experience (this is especially true on mobile. For that I highly recommend the Brave browser). You'd be surprised how much better it can make parts of the web tho to have no JS :-)
    - disconnected 9y ago
fulafel 9y ago
Chrome has a better sandbox than Firefox, for one. A notch better would be running Qubes OS.

wpietri 9y ago

The title seems fine to me. I knew Linux ransomware was a theoretical possibility, but I didn't know it was out there in the world. Or, as they say, "in the wild".

spydum 9y ago
stand up an old version of wordpress with poor admin/admin credentials on an external box, and wait a couple hours. You'll find all sorts of malware on a linux box. ransomware included. Pretty common, though it seems most people who compromise linux machines use them to launch further attacks, not ransomware. The ransomware linux variants I see all do about the same thing: wipe various /var/log/* logfiles, they encrypt all your mysql dbs, your homedir files, and your webserver docroot.

freedomben 9y ago

I'm not sure I agree with your anlaysis. True the user ran Firefox as root (which is terrible practice), but also had the same problems on a different system that never ran firefox: > Interesting to note that another system, also a sister, seems to have caught the same, and I can't recall ever having run anything but VirtualBox VMs on that one, it's turned off right now until I figure out a recovery plan, so at least 2 systems to recover, and have one clean one to do so from. That said, it could easily be explained if SSH private keys weren't encrypted (passphrase protected) and allowed an easy hop from infected to sister. And if somebody is running Firefox as root, it doesn't seem too extreme to assume they might have unencrypted private keys... So it may just be from running Firefox as root, but it's still possible it could be from other things.

avian 9y ago

Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory. If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.

pedrocr 9y ago
There may be things an exploit can do as root that wouldn't work under your user to break out of the adobe flash "sandbox". But yeah, the real recommendation is to get rid of flash and kill it with fire. The security of free software isn't fullproof but good riddance from the web to that particular closed source blob.
- pjmlp 9y ago
  It will come back as WebAssembly.
  - pedrocr 9y ago
    What makes you think that? WebAssembly will at least not be single implementation, closed-source, no-maintenance like Flash.
    - pjmlp 9y ago
      I am betting someone will bother to create a SWF to WebAssembly translator, maybe even Adobe.
4lch3m1st 9y ago
The whole point of security and good practices is to make harder for those arbitrary codes to be executed (or for whatever other flaws to be exploited, until they're fixed). Running a browser as root is not good practice. Doesn't mean that something bad will happen, but it's more or less line laying the cheese on the ground and expecting mice not to go after it. Even if you have none around, you just shouldn't risk it. At all. Unless you know exactly what you're doing.

deleted 9y ago

[deleted]

joshstrange 9y ago

> TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack. That has been speculated but far from proven. On the last page they are still talking about the point of entry and how they are in no way convinced it was FF/Flash.

ryanlol 9y ago

>TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack. While possible, this sounds so spectacularly unlikely that I can’t help but think that you’re just speculating.

Filligree 9y ago
The article itself mentions running Firefox as root, but there's no way the user can be sure that's the infection vector.