4 ms·

Thousands of Linux systems infected by stealthy malware since 2021

34 points by lisper 2y ago

ddtaylor 2y ago
This article is written so poorly or targeted at the most unknowing user most of the information has been watered down to be useless.
- bookofjoe 2y ago
  This comment troubles me because of this: >Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. Dan is based in San Francisco. Follow him at @dangoodin on Mastodon. Contact him on Signal at DanArs.82. With the credentials of the author being seemingly impeccable, how can his article be so bad?
  - ddtaylor 2y ago
    I have no idea why, but I can elaborate a bit. Here are some highlights: > Using a Unix socket over TOR for external communications This is being said under the implication of sophistication. Using TOR for exfiltration or C2 related activities is amateur as it obviously will be detected. A minimum standard in this category for malware is something that makes use of primary gadgets of trusted hosts like Google, Microsoft or Apple. A more sophisticated area of this are various abuses of DNS and other accepted protocols where data can be stuffed into "trusted" records by places like Cloudflare. > Stopping activities that are easy to detect when a new user logs in This and a few other "points" like this seem like filler. This has been a thing malware does since the beginning and is the most basic anti-detection "technique" possible. > Manipulating the Linux process pcap_loop through a technique known as hooking to prevent admin tools from recording the malicious traffic At least he mentions the specific thing being hooked here, but again, the idea that malware would override the system or an API in some way to lie to the rest of the system is one of the most fundamental things a malware can do. > It gets installed by exploiting more than 20,000 common misconfigurations That's probably a very long-winded and hand-wavy way to say they are probably using Metasploit or similar.
hyperman1 2y ago
It seems windows is committing suicide, and just by being the one not gone insane, Linux on the desktop has gone mainstream the last few years. Which is unfortunate, because all the windows nastys are comming to us, and Linux is woefully underprepared. For all the damage antivirus does, it still delivers some value. And we need equivalents for that value, or the mcafees will take over by default.
- ratg13 2y ago
  Microsoft’s defender for endpoint supports Linux.
- shiroiushi 2y ago
  McAfee software is, and I quote, "the worst software on the planet". This was said by none other than John McAfee himself, sometime before he died. He was the founder of McAfee software, his namesake, so that's good enough for me to believe him.
  - talldayo 2y ago
    While I happen to agree with McAfee on this topic, before he died the guy was basically an international pariah and violent criminal ringleader. McAfee said a lot of things you shouldn't believe, including "I now predict Bircoin at $1 million by the end of 2020. I will [...] eat my dick if wrong."[0] Unfortunately for McAfee, Bitcoin did not reach $1 million by 2020. Unfortunately for us, he didn't eat his dick either. [0] https://x.com/officialmcafee/status/935900326007328768 https://x.com/officialmcafee/status/935900326007328768
    - Jerrrrrrry 2y ago
      Bitcoin could had easily reached $1m in 2020. half of the worlds money was printed in the first 90 days of that year. you dont think that could had caused a FOMO panic too viral for the mainstream attention apparatus to handle? they couldnt even handle the (incredibly obvious, glaring) gamestop fiasco; the price of BTC could had literally reached $10m in Jan2020 if the right cataclysm of media, social issue wedging, economic woes, political bile, macro-financial fuckery, and a globally-proliferated bio-weap had happened to all strike just in a closer timeframe.
sierra1011 2y ago
This is a duplicate of https://news.ycombinator.com/item?id=41736470 https://news.ycombinator.com/item?id=41736470 , but the worst kind of duplicate; same topic, rewritten [read: worse] prose

34 points by lisper 2y ago

This article is written so poorly or targeted at the most unknowing user most of the information has been watered down to be useless.

bookofjoe 2y ago
This comment troubles me because of this: >Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. Dan is based in San Francisco. Follow him at @dangoodin on Mastodon. Contact him on Signal at DanArs.82. With the credentials of the author being seemingly impeccable, how can his article be so bad?
- ddtaylor 2y ago
  I have no idea why, but I can elaborate a bit. Here are some highlights: > Using a Unix socket over TOR for external communications This is being said under the implication of sophistication. Using TOR for exfiltration or C2 related activities is amateur as it obviously will be detected. A minimum standard in this category for malware is something that makes use of primary gadgets of trusted hosts like Google, Microsoft or Apple. A more sophisticated area of this are various abuses of DNS and other accepted protocols where data can be stuffed into "trusted" records by places like Cloudflare. > Stopping activities that are easy to detect when a new user logs in This and a few other "points" like this seem like filler. This has been a thing malware does since the beginning and is the most basic anti-detection "technique" possible. > Manipulating the Linux process pcap_loop through a technique known as hooking to prevent admin tools from recording the malicious traffic At least he mentions the specific thing being hooked here, but again, the idea that malware would override the system or an API in some way to lie to the rest of the system is one of the most fundamental things a malware can do. > It gets installed by exploiting more than 20,000 common misconfigurations That's probably a very long-winded and hand-wavy way to say they are probably using Metasploit or similar.

hyperman1 2y ago

It seems windows is committing suicide, and just by being the one not gone insane, Linux on the desktop has gone mainstream the last few years. Which is unfortunate, because all the windows nastys are comming to us, and Linux is woefully underprepared. For all the damage antivirus does, it still delivers some value. And we need equivalents for that value, or the mcafees will take over by default.

ratg13 2y ago
Microsoft’s defender for endpoint supports Linux.
shiroiushi 2y ago
McAfee software is, and I quote, "the worst software on the planet". This was said by none other than John McAfee himself, sometime before he died. He was the founder of McAfee software, his namesake, so that's good enough for me to believe him.
- talldayo 2y ago
  While I happen to agree with McAfee on this topic, before he died the guy was basically an international pariah and violent criminal ringleader. McAfee said a lot of things you shouldn't believe, including "I now predict Bircoin at $1 million by the end of 2020. I will [...] eat my dick if wrong."[0] Unfortunately for McAfee, Bitcoin did not reach $1 million by 2020. Unfortunately for us, he didn't eat his dick either. [0] https://x.com/officialmcafee/status/935900326007328768 https://x.com/officialmcafee/status/935900326007328768
  - Jerrrrrrry 2y ago
    Bitcoin could had easily reached $1m in 2020. half of the worlds money was printed in the first 90 days of that year. you dont think that could had caused a FOMO panic too viral for the mainstream attention apparatus to handle? they couldnt even handle the (incredibly obvious, glaring) gamestop fiasco; the price of BTC could had literally reached $10m in Jan2020 if the right cataclysm of media, social issue wedging, economic woes, political bile, macro-financial fuckery, and a globally-proliferated bio-weap had happened to all strike just in a closer timeframe.

sierra1011 2y ago

This is a duplicate of https://news.ycombinator.com/item?id=41736470 https://news.ycombinator.com/item?id=41736470 , but the worst kind of duplicate; same topic, rewritten [read: worse] prose