1) Flatten the server/VM/whatever
2) Load the last clean backup image
3) Apply updates made since the last backup
5) Carry on ....
You do have back ups don't you?
You do develop off-line and push deployments to servers don't you?
No? Then remember to renew the notice in the front window of your house telling the potential burglars you didn't lock the place up and there all the valuable are stored.
Encryption ransomware threatens Linux users
11–20 of 29 posts
Re: Encryption ransomware threatens Linux users
#12Exactly how is this being executed on Linux systems? Dr Web are selling anti-virus. I'd like more info on how it infects systems. Edit: You know, this is really ONLY being reported by Dr Web. Funny that.
We could try to get Linus to care more about the security of the kernel, but that's an impossible task, so I guess Linux users should soon start using anti-viruses, too.
Re: Encryption ransomware threatens Linux users
#13Not sure why this made it on the HN frontpage.
It seems its lacking any relevant information and is mostly some marketing for an antivirus vendor that tries to tell Linux users they need antiviruses, too.
Re: Encryption ransomware threatens Linux users
#14It is somewhat suspicious that their screenshot of the alleged ransom file appears to be taken from Notepad++, a text editor available only on Windows.
This, combined with the fact that so far only Dr. Web is reporting on it, makes it appear suspect.
Besides, once someone has root access to your *nix server, or at least privilege escalation (either of which would be required for this exploit to work), they already own you and can do whatever they want anyway. If you have a good backup scheme in place this is little more than a headache and a few hours of work to recover from. The only way I see this being a catastrophic exploit is if you end up with it on your home box with no offsite or air gapped backup. This holds true for Windows based ransomware attacks that do actually exist; nothing about this is unique, if it's even real.
Re: Encryption ransomware threatens Linux users
#15No information on how it spreads? "Once launched with administrator privileges, the Trojan loads into the memory of its process files containing cybercriminals' demands" This sounds like it needs to run as root, is there any vulnerability involved and do I need to patch things? Is it just a particularly crazy spam campaign that would somehow trick "website administrators" into running malware as root on their servers…
> No information on how it spreads?
If they are clever they would attack via wordpress and other systems that are unpatched and give shell access.
Re: Encryption ransomware threatens Linux users
#16No information on how it spreads? "Once launched with administrator privileges, the Trojan loads into the memory of its process files containing cybercriminals' demands" This sounds like it needs to run as root, is there any vulnerability involved and do I need to patch things? Is it just a particularly crazy spam campaign that would somehow trick "website administrators" into running malware as root on their servers…
> No information on how it spreads?
If they are clever they would attack via wordpress and other systems that are unpatched and give shell access.
Re: Encryption ransomware threatens Linux users
#17Not sure why this made it on the HN frontpage. It seems its lacking any relevant information and is mostly some marketing for an antivirus vendor that tries to tell Linux users they need antiviruses, too.
I just tried to look it up. Turns out the only announcements are from Dr. Web, a "famous" antivirus vendor, and techcrunch.com which quotes Dr. Web's announcement.
No word on how it spreads. Also, unsurprisingly:
> Once launched with administrator privileges, etc.
If you do that, you kind of deserve to get infected...
Re: Encryption ransomware threatens Linux users
#18Here's the Virustotal entry for one of the unpacked versions:
https://www.virustotal.com/en/file/18884936d002839833a537921...
Enough evidence for me to believe that the malware exists. Apparently it uses mbed TLS for encryption and communicates via UDP.
Re: Encryption ransomware threatens Linux users
#19No information on how it spreads? "Once launched with administrator privileges, the Trojan loads into the memory of its process files containing cybercriminals' demands" This sounds like it needs to run as root, is there any vulnerability involved and do I need to patch things? Is it just a particularly crazy spam campaign that would somehow trick "website administrators" into running malware as root on their servers…
On one hand there are many open source software that are installed by piping a file into sudo; on the other the upside of open source is the ability to trace who tricked you into running that command.
Re: Encryption ransomware threatens Linux users
#20Lively discussion over on reddit: https://www.reddit.com/r/linux/comments/3rv78j/linux_ransomw...