6 ms·

But how does it spread?

• Deukhoofd 4y ago
  That's my exact question. This requires getting a .so on a device, and setting an environment variable for all users. The malware itself isn't too interesting, however clever they managed to hide it, but how they actually got it on the computers is.
• iso1631 4y ago
  Presumably an RCE or trojan to infect the first machine, then once you have a foothold on the network and are capturing credentials you can move laterally and spread it using authorised access (perhaps including priv elevation)
• midislack 4y ago
  They admitted in the article that it doesn't. It's a "malware sample."
• bregma 4y ago
  It's very much a classic "if someone can get root access to your system and is given the ability to install software, they can install this rootkit and do very bad things" type of malware. That part is glossed over completely in the article(s) and the focus is on the "do very bad things" because it sells eyeballs and clicks. After a while, in security, the blog posts, adverts, and scanners are the malware that's taking our time and money.
  • superjan 4y ago
    But then it is total nonsense to call this a “Linux backdoor”. A linux backdoor should mean a planted vulnerability in Linux itself.
    • prvit 4y ago
      No, this is widely accepted terminology. What you're trying to argue here is total nonsense.