3 ms·
The title is quite clickbaity I think, because of this: > Occurred no later than August 12, 2011, and wasn't detected for another 17 days which also had a dis
by skilled 2y ago
The title is quite clickbaity I think, because of this:
> Occurred no later than August 12, 2011, and wasn't detected for another 17 days
which also had a discussion on HN in 2013:
Who rooted kernel.org servers two years ago? (https://news.ycombinator.com/item?id=6438326 https://news.ycombinator.com/item?id=6438326) - Sep 2013 (45 comments)
The article from ESET is here,
Ebury is alive but unseen: 400k Linux servers compromised for cryptocurrency theft and financial gain (https://www.welivesecurity.com/en/eset-research/ebury-alive-unseen-400k-linux-servers-compromised-cryptotheft-financial-gain/ https://www.welivesecurity.com/en/eset-research/ebury-alive-...) - May 2024
but the article itself only serves as an introduction to the PDF:
https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-alive-but-unseen.pdf https://web-assets.esetstatic.com/wls/en/papers/white-papers...
- rezonant 2y agoWhat's new (versus when the story broke years ago) is: > A 47-page report summarizing Ebury's 15-year history said that the infection hitting the kernel.org network began in 2009, two years earlier than the domain was previously thought to have been compromised. I think you grok that, but I don't think the title is clickbait.
- yjftsjthsd-h 2y agoI read the arstechnica post and didn't grok that at all; thanks for explaining. I spent the whole article wondering what prompted them to report on something that happened over a decade ago now.
- rezonant 2y agoIt definitely buries the lede and is overcomplicated