Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux ransomware in the wild

forums.gentoo.org

Post reply on HN
Print view View original

21–30 of 112 posts

Re: Linux ransomware in the wild

#21

Post by CJefferson »

abrowne wrote: post #13

Not trying to blame the user, just trying to understand: why would someone ever run a web browser as root? A text editor to edit system files, ok, but a browser?

Seeing as the user's main problem is their home directory was encrypted, the root doesn't seem like it would make any difference...

Better would be easier ways to run browsers (and all applications) inside protected systems of some kind, so even if they are hacked they can't touch anything outside their own cache directory, and creating downloaded files.

Re: Linux ransomware in the wild

#22

Post by lstyls »

abrowne wrote: post #13

Not trying to blame the user, just trying to understand: why would someone ever run a web browser as root? A text editor to edit system files, ok, but a browser?

It's pretty common for noobs to do this when they have messed up permissions, because permissions errors magically go away.

The OP on the Gentoo thread seems more than competent enough to know how to fix permissions issues though, so I agree it's a headscratcher.

Re: Linux ransomware in the wild

#24

Post by microcolonel »

pletnes wrote: post #8
rjzzleep wrote: post #7

Earlier quoted context omitted.

I assumed that was implied for every HN reader. But even though I have noscript and ublock with a lot of things blocked you never have 100% coverage.

People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!

I use the built-in script blocking in Chrome, it's fairly quick to whitelist any scripts i actually want to run. It's by domain though, so not really perfect. I also block ad servers at the DNS level, and run an an blocker. Until recently I didn't need the blocker, but ad networks have gotten better at serving from legitimate hosts, so I can't just block them anymore.

There are lots of services I would be glad to outright pay for, or have some sort of flattr-type service attached to. I don't feel one iota guilty for blocking ads, given the risks and costs.

Re: Linux ransomware in the wild

#25

Post by mcjiggerlog »

ddevault wrote: post #17

It doesn't seem to have been mentioned on the forums, which is alarming, but the correct response to finding out your machine has been owned is to shut it the fuck down . Right away. Then boot up a rescue CD, which will have a known working system (read: not compromised), from which you can do some forensic work to find out how you were owned and what data is recoverable. Take the data you can recover offline and the…

Even better - make sure that everything is under version control or backed up so that in such a situation you can just reinstall from scratch without introducing the possibility of "recovering" infected files.

Re: Linux ransomware in the wild

#26

Post by fwdpropaganda »

pletnes wrote: post #8
rjzzleep wrote: post #7

Earlier quoted context omitted.

I assumed that was implied for every HN reader. But even though I have noscript and ublock with a lot of things blocked you never have 100% coverage.

People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!

I always assumed that everyone on HN would be using uMatrix. Strangely it doesn't seem very popular.

I don't run JS at all except for very few webpages (think gmail log in page, etc).

EDIT: Now that I think about it, I haven't really stressed how good uMatrix is. It really has changed the way I use the internet.

Re: Linux ransomware in the wild

#27

Post by arca_vorago »

pletnes wrote: post #8
rjzzleep wrote: post #7

Earlier quoted context omitted.

I assumed that was implied for every HN reader. But even though I have noscript and ublock with a lot of things blocked you never have 100% coverage.

People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!

Its a worthy of the time endeavor, trust me. White listing very carefully over time enhances the browser experience, but you are right there are sites that go excessive on the off-domain js callS, but I choose to just get content elsewhere. Its time people were pickier about this stuff and pushed back more to the companies.

Re: Linux ransomware in the wild

#28

Post by pedrocr »

avian wrote: post #20
joecool1029 wrote: post #2

Nice read but nothing particularly special here and it happened months ago. The title is alarmist. TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.

Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory. If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.

There may be things an exploit can do as root that wouldn't work under your user to break out of the adobe flash "sandbox". But yeah, the real recommendation is to get rid of flash and kill it with fire. The security of free software isn't fullproof but good riddance from the web to that particular closed source blob.

Re: Linux ransomware in the wild

#29

Post by zython »

ddevault wrote: post #17

It doesn't seem to have been mentioned on the forums, which is alarming, but the correct response to finding out your machine has been owned is to shut it the fuck down . Right away. Then boot up a rescue CD, which will have a known working system (read: not compromised), from which you can do some forensic work to find out how you were owned and what data is recoverable. Take the data you can recover offline and the…

well, when wannacry was around, you could "salvage" the decryption key from an infected machine before it was rebooted.

not saying your idea is bad advice but you need the full picture to counter ransomware attacks

Re: Linux ransomware in the wild

#30

Post by ricardobeat »

mcjiggerlog wrote: post #25
ddevault wrote: post #17

It doesn't seem to have been mentioned on the forums, which is alarming, but the correct response to finding out your machine has been owned is to shut it the fuck down . Right away. Then boot up a rescue CD, which will have a known working system (read: not compromised), from which you can do some forensic work to find out how you were owned and what data is recoverable. Take the data you can recover offline and the…

Even better - make sure that everything is under version control or backed up so that in such a situation you can just reinstall from scratch without introducing the possibility of "recovering" infected files.

There’s still the possibility that the infected files have been already committed to version control or backups, before it activated.
Post reply on HN