4 ms·
Linux devices are under attack by a never-before-seen worm
- moose_man 3y agoOf course it's a crypto mining worm. Crypto is poison.
- fsflover 3y agoFortunately, I'm using Qubes OS, which would make the attack easily detectable and curable on my system.
- peddling-brink 3y agoIf your externally accessible ssh root password is changeme, even qubes won’t save you.
- fsflover 3y agoIt will save me, since you will only get access to a single VM on my system.
- peddling-brink 3y agoIt was a joke. This is spreading via a rudimentary password list. https://github.com/akamai/akamai-security-research/blob/main/malware/noabot/credentials/noa_pass_set.txt https://github.com/akamai/akamai-security-research/blob/main... My implication was that if you've managed to set up qubes so wrong that you would be affected by this, there's a good chance that you've made other massive mistakes too, making your qubes usage meaningless. That being said. Qubes is an excellent piece of software and you are correct in your statements.
- fsflover 3y agoI see, thanks for clarifying.
- ThinkBeat 3y agoWhenever I see a story like this I just feel how f**d we are. When you can waste an exploit like this on installing crypto Whatever NSA and other advanced nation states have is magnitudes next level. NSO Group sells some advanced stuff, but again what Israel keeps behind locked doors again have to be magnitudes next level.
- themoonisachees 3y agoThere is nothing of substance to this attack? Just ssh credential stuffing and $env overwriting is the only "novel" evasion technique and it's really not that bad, EDR software can easily detect that this is happening and it likely only happens on malware.
- Zetobal 3y agoI mean if you use ssh with password auth and a weak password in production you kinda deserve it.
- morserer 3y agoSpreads via password authenticated SSH, which is the first thing you disable when you set up an SSH server. Doesn't hide its CPU usage. Does a few mildly crafty things to prevent reverse engineering, but overall this "worm" just seems like it's picking low-hanging fruit. This doesn't seem serious at all, nor difficult to detect. Am I missing something?
- themoonisachees 3y agoSame. It has some nicer evasion techniques but nothing out of the ordinary, to me this seems like a guy bought a malware suite that's above his pay grade and sent it off on ssh scans.
- guenthert 3y agoYeah, I was surprised that this is still a thing in 202x, but then, there are many devices out there, which run a ssh server, which one wouldn't have 'installed'. Seems it targets IoT devices. Rather than (intentionally) causing DDoS, it mines cryptocoins (with great patience, I suppose), so it's more like a parasite, siphoning electricity and doing it's part to warm the globe.
- huytersd 3y agoWait, if you disable password authenticated SSH, how do you log into the server?
- jxcl 3y agoPublic key authentication, with your private keys in your .ssh folder and your public key in the server’s .ssh/authorized_keys file
- gumby 3y agoYou can have a password on the client end to unlock access to the keys, if you like. The point of ssh is to use the keys for authentication. Having the ssh server permit password login is a back-compatible legacy from the telnet days and has been functionally obsolete for decades.
- n8henrie 3y ago> Akamai has been monitoring NoaBot for the past 12 months in a honeypot that mimics real Linux devices to track various attacks circulating in the wild. To date, attacks have originated from 849 distinct IP addresses This doesn't sound particularly new or concerning. Right?
- dizhn 3y agoThat number sounds really low to me.
- ranguna 3y agoAttack on weak ssh passwords. I'd say it's a good thing these viruses are going around, it serves as a good reminder to either switch to public key auth or use strong passwords.