Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encryption ransomware threatens Linux users

news.drweb.com

Post reply on HN
Print view View original

21–29 of 29 posts

Re: Encryption ransomware threatens Linux users

#21

Post by wila »

hannob wrote: post #13

Not sure why this made it on the HN frontpage. It seems its lacking any relevant information and is mostly some marketing for an antivirus vendor that tries to tell Linux users they need antiviruses, too.

Exactly that.

> Doctor Web security researchers presume that at least tens of users have already fallen victim to this Trojan.

"presume" .. tens of users ..

Right, a bit more details on the infection vector would have helped to properly validate the concerns. But when you start presuming and pull numbers out of a high hat I'm almost ready to discard it.

The only thing we know now is that "something" needs to be run with admin privileges.

Just make sure your backups are OK.

Re: Encryption ransomware threatens Linux users

#23

Post by hwh »

This reminds me of my first mention in a Linux kernel commit message: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.... It's the fix for a bug I found in the kernel. This sounds quite boring, but the fun part is the background story: Antivirus vendor X (actually forgot which one) bragged about a new, dangerous virus that can spread on Windows as well as Linux platforms. Joe Barr reported on that for NewsForge, claiming that the Virus didn't work at all (on Linux). I jumped in and tested too, and found that it wouldn't work (meaning: infect other binaries) on newer kernels since there was an actual bug in the kernel preventing it from doing so.

Why I'm reciting that story is this: It is perfectly fine for a binary to write executable code to other files. Your typical compiler does. The kernel isn't there to prevent that. The kernel is supposed to prevent it if you configure a security policy that forbids it - starting with things as simple as file ownership and permissions. This is pretty much clear for anyone who knows some things about what the computer does. For people who only have some fuzzy ideas, fixing the Linux kernel to make (in this case) a virus work again sounded a bit weird.

Well, ransomware is in the news these days because of the raid in the Netherlands, and here there's another "security specialist" trying to use this for its PR. But again there is nothing that indicates that this is all about standard functionality. Yes, you can encrypt all your own files on a typical machine. Yes, a piece of software can do it for you. Yes, you can run such software. And if you're careless and follow orders easily, someone else might give you the software to do it.

Re: Encryption ransomware threatens Linux users

#24

Post by chris_wot »

zyztem wrote: post #6
chris_wot wrote: post #2

Exactly how is this being executed on Linux systems? Dr Web are selling anti-virus. I'd like more info on how it infects systems. Edit: You know, this is really ONLY being reported by Dr Web. Funny that.

There is more technical details at http://vms.drweb.com/virus/?i=7704004&lng=en

It doesn't give much info.

Re: Encryption ransomware threatens Linux users

#25

Post by enginnr »

tux3 wrote: post #4

No information on how it spreads? "Once launched with administrator privileges, the Trojan loads into the memory of its process files containing cybercriminals' demands" This sounds like it needs to run as root, is there any vulnerability involved and do I need to patch things? Is it just a particularly crazy spam campaign that would somehow trick "website administrators" into running malware as root on their servers…

"Once launched with administrator privileges" which is very difficult unless the soft goes out of its way to ask, and most open source software doesn't ask

Re: Encryption ransomware threatens Linux users

#27

Post by w8rbt »

squidlogic wrote: post #22

Unlike a lot of other malware out there, crypto lockers don't require privlidge escalation to be effective. Got to hand it to them, its actually a pretty cool attack vector.

A lot of attacks don't require root/admin to be effective. Some Key stroke loggers run entirely in user space.

    edit: https://github.com/w8rbt/keycap

Re: Encryption ransomware threatens Linux users

#29

Post by squidlogic »

w8rbt wrote: post #27
squidlogic wrote: post #22

Unlike a lot of other malware out there, crypto lockers don't require privlidge escalation to be effective. Got to hand it to them, its actually a pretty cool attack vector.

A lot of attacks don't require root/admin to be effective. Some Key stroke loggers run entirely in user space. edit: https://github.com/w8rbt/keycap

Good point, you're right that gaining root/admin isn't the only way to ruin someone's day.
Post reply on HN