38 ms·

Not a single mention of Linux. Hope the windows community comes together and finds ways to harden these exploits

by cookieperson 3y ago

supriyo-biswas 3y ago
Run a SSH honeypot. You can capture plenty of Linux malware.
- cookieperson 3y ago
  Oh for sure. Just saying in this specific bulletin there's no mention of Linux or macos targets.
- some_random 3y ago
  Yeah lots of really, really low quality malware
waihtis 3y ago
the cynic in me thinks the bad linux activity is there, but the targets do not have any kind of linux monitoring in place to spot activity
- SoftTalker 3y ago
  If you're just running a random linux server that isn't an otherwise "interesting" target the only times I've seen those get compromised is by some ludicrously dumb configuration mistakes, such as running databases with a default admin password and no firewall, etc.
- cookieperson 3y ago
  It's a less interesting target for a lot of widespread attacks. Consider the surface area of Linux machines vs Windows? Most big corporations run on windows, even if devs rock Linux, that's not usually what these types of attacks are after. That said you are right. Most Linux users ride on insecure machines. I remember talking to someone who had no idea they had to set up a firewall. They had switched from Linux 2 years prior under the guise that it was more secure than windows out of the box. I wish Linux security was talked about more. The people who know how to do it assume everyone does, and the people who don't... don't know what they don't know.
belltaco 3y ago
There are mentions of Linux right at the beginning: >The actor has leveraged compromised small office/home office (SOHO) network devices as intermediate infrastructure to obscure their activity by having much of the command and control (C2) traffic emanate from local ISPs in the geographic area of the victim. None of those devices are running Windows.
- cookieperson 3y ago
  All of the recommendations I saw were based on windows

Not a single mention of Linux. Hope the windows community comes together and finds ways to harden these exploits

supriyo-biswas 3y ago

Run a SSH honeypot. You can capture plenty of Linux malware.

cookieperson 3y ago
Oh for sure. Just saying in this specific bulletin there's no mention of Linux or macos targets.
some_random 3y ago
Yeah lots of really, really low quality malware

waihtis 3y ago

the cynic in me thinks the bad linux activity is there, but the targets do not have any kind of linux monitoring in place to spot activity

SoftTalker 3y ago
If you're just running a random linux server that isn't an otherwise "interesting" target the only times I've seen those get compromised is by some ludicrously dumb configuration mistakes, such as running databases with a default admin password and no firewall, etc.
cookieperson 3y ago
It's a less interesting target for a lot of widespread attacks. Consider the surface area of Linux machines vs Windows? Most big corporations run on windows, even if devs rock Linux, that's not usually what these types of attacks are after. That said you are right. Most Linux users ride on insecure machines. I remember talking to someone who had no idea they had to set up a firewall. They had switched from Linux 2 years prior under the guise that it was more secure than windows out of the box. I wish Linux security was talked about more. The people who know how to do it assume everyone does, and the people who don't... don't know what they don't know.

belltaco 3y ago

There are mentions of Linux right at the beginning: >The actor has leveraged compromised small office/home office (SOHO) network devices as intermediate infrastructure to obscure their activity by having much of the command and control (C2) traffic emanate from local ISPs in the geographic area of the victim. None of those devices are running Windows.

cookieperson 3y ago
All of the recommendations I saw were based on windows