Linux ransomware in the wild • Hacker News Board

Re: Linux ransomware in the wild

#61

Post by pedrocr » Sat, Oct 21, 2017, 5:16 PM UTC

pjmlp wrote: post #42

pedrocr wrote: post #28

Earlier quoted context omitted.

There may be things an exploit can do as root that wouldn't work under your user to break out of the adobe flash "sandbox". But yeah, the real recommendation is to get rid of flash and kill it with fire. The security of free software isn't fullproof but good riddance from the web to that particular closed source blob.

It will come back as WebAssembly.

What makes you think that? WebAssembly will at least not be single implementation, closed-source, no-maintenance like Flash.

Re: Linux ransomware in the wild

#62

Post by Filligree » Sat, Oct 21, 2017, 5:18 PM UTC

ryanlol wrote: post #52

joecool1029 wrote: post #2

Nice read but nothing particularly special here and it happened months ago. The title is alarmist. TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.

>TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack. While possible, this sounds so spectacularly unlikely that I can’t help but think that you’re just speculating.

The article itself mentions running Firefox as root, but there's no way the user can be sure that's the infection vector.

Re: Linux ransomware in the wild

#63

Post by segmondy » Sat, Oct 21, 2017, 5:23 PM UTC

This is 7 months old. From March. Title makes it sound like breaking news.

Re: Linux ransomware in the wild

#64

Post by LinuxBender » Sat, Oct 21, 2017, 5:26 PM UTC

throwmenow_0140 wrote: post #50

avian wrote: post #20

Earlier quoted context omitted.

Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory. If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.

agree. ordinary user is absolutely sufficient. I'll now present a sophisticated privilege escalation method that most of us won't notice (me included, sarcasm off): alias sudo='/usr/bin/sudo echo something evil && /usr/bin/sudo' I don't think it matters that he used his root account. Edit: Maybe I'm wrong with my opinion, you can disable ASLR using your root rights... https://askubuntu.com/a/318476 Edit: Last exploit…

As an attacker, I test for sudo -n. If it succeeds, I have root. In most cases I do not need it however. SSH key trusts, SSH multiplexing and bad posix permissions are more than enough to get me anywhere and grab anything.

Re: Linux ransomware in the wild

#65

Post by kbp » Sat, Oct 21, 2017, 5:31 PM UTC

chrisfosterelli wrote: post #54

wrycoder wrote: post #53

Earlier quoted context omitted.

I use /usr/bin/sudo

So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

> So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

    $ alias /usr/bin/sudo=whatever
    bash: alias: `/usr/bin/sudo': invalid alias name

Re: Linux ransomware in the wild

#66

Post by binaryapparatus » Sat, Oct 21, 2017, 5:36 PM UTC

There is trend of insecurity/vulnerabilities that seems to gain in speed in recent months. Not trying to sound ominous and nothing to really point finger to but it seems like a thing.

Since few months ago I do almost all browsing in carefully set w3m. No javascript at all of course and certainly no flash. I am typing this in vim which is set as default form editor in w3m for me.

Edit: if you are wondering if w3m can work well try looking at HN using w3m, its a real beauty.

Re: Linux ransomware in the wild

#67

Post by [deleted] » Sat, Oct 21, 2017, 5:53 PM UTC

zokier wrote: post #32

ddevault wrote: post #17

It doesn't seem to have been mentioned on the forums, which is alarming, but the correct response to finding out your machine has been owned is to shut it the fuck down . Right away. Then boot up a rescue CD, which will have a known working system (read: not compromised), from which you can do some forensic work to find out how you were owned and what data is recoverable. Take the data you can recover offline and the…

> from which you can do some forensic work to find out how you were owned It's worth noting that if you are really serious about doing forensics and investigating the attack, then shutting down can be pretty destructive. > what data is recoverable. Another point I'd make is that try to recover as little as possible from the infected system and prefer using clean backups instead. I agree on the overall sentiment thoug…

[deleted]

Re: Linux ransomware in the wild

#68

Post by hawski » Sat, Oct 21, 2017, 5:56 PM UTC

That is one of the reasons I am thinking about having /home on NILFS2 ([1] a log-structured file system) in my dabbing with my own Linux distribution. When you have constant snapshots then ransomware can't do much, can it?

[1] https://en.wikipedia.org/wiki/NILFS

Re: Linux ransomware in the wild

#69

Post by analogic » Sat, Oct 21, 2017, 5:58 PM UTC

abrowne wrote: post #13

Not trying to blame the user, just trying to understand: why would someone ever run a web browser as root? A text editor to edit system files, ok, but a browser?

well i'm usually just logged in as root anyway to get rid of those pesky password promts

Re: Linux ransomware in the wild

#70

Post by thaumasiotes » Sat, Oct 21, 2017, 6:08 PM UTC

ddevault wrote: post #17

It doesn't seem to have been mentioned on the forums, which is alarming, but the correct response to finding out your machine has been owned is to shut it the fuck down . Right away. Then boot up a rescue CD, which will have a known working system (read: not compromised), from which you can do some forensic work to find out how you were owned and what data is recoverable. Take the data you can recover offline and the…

> It doesn't seem to have been mentioned on the forums, which is alarming

Really?

>> Best thing to do when dealing with this kind of stuff is disconnect the network, cold reboot off a livecd and and go from there.

>> That means that they got root. You can't clean that up, its a reinstall. [...] If you want to do forensics, make a disc image of the install and work on that. You need the filesystem free space too, as that's where the interesting stuff will be.