Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux ransomware in the wild

forums.gentoo.org

Post reply on HN
Print view View original

71–80 of 112 posts

Re: Linux ransomware in the wild

#71

Post by runeks »

zython wrote: post #29
ddevault wrote: post #17

It doesn't seem to have been mentioned on the forums, which is alarming, but the correct response to finding out your machine has been owned is to shut it the fuck down . Right away. Then boot up a rescue CD, which will have a known working system (read: not compromised), from which you can do some forensic work to find out how you were owned and what data is recoverable. Take the data you can recover offline and the…

well, when wannacry was around, you could "salvage" the decryption key from an infected machine before it was rebooted. not saying your idea is bad advice but you need the full picture to counter ransomware attacks

Ironically, /dev/mem has been disabled to counter malware, otherwise you could do

    dd if=/dev/mem of=~/mem.img
to obtain an image dump which may contain the decryption key.

Re: Linux ransomware in the wild

#72

Post by michaelmrose »

avian wrote: post #20
joecool1029 wrote: post #2

Nice read but nothing particularly special here and it happened months ago. The title is alarmist. TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.

Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory. If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.

Its possible to run firefox with fewer privileges so that the only thing it could delete are your recent downloads.

Re: Linux ransomware in the wild

#75

Post by yjftsjthsd-h »

hawski wrote: post #68

That is one of the reasons I am thinking about having /home on NILFS2 ([1] a log-structured file system) in my dabbing with my own Linux distribution. When you have constant snapshots then ransomware can't do much, can it? [1] https://en.wikipedia.org/wiki/NILFS

Only if the snapshots are read-only and/or invisible by default; some systems expose snapshots as additional directories under some mountpoint, in which case they just get encrypted as well.

Re: Linux ransomware in the wild

#76

Post by yjftsjthsd-h »

cisanti wrote: post #57
pritambaral wrote: post #34

Earlier quoted context omitted.

Lots of servers run Linux. Lots of data to hold ransom on lots of servers running Linux.

But who runs flash on server as root?! If this was the source..

It's a multi-stage thing, first stage gets into a system by browser exploit, then it uses SSH keys to get everywhere else

Re: Linux ransomware in the wild

#77

Post by bogomipz »

tedunangst wrote: post #51
jorvi wrote: post #47

Earlier quoted context omitted.

I may be wrong, but these days doesn't malware have a loader (which has a hook in the boot cycle at some point) and a payload (which usually poses as an innocent file tucked away on your system somewhere). Even if you wholesale recover your data and include the payload, there is no loader hooked into your newly-installed system, rendering the payload a digital bullet without a corresponding gun. As far as I'm aware,…

The loader hook could well be in your .profile. Or the infection vector could be a naughty PDF just waiting to be thumbnailed again after a reinstall.

Could you elaborate are you referring to a specific PDF vulnerability? Could you share a link to it? Thanks.

Re: Linux ransomware in the wild

#78

Post by detaro »

hawski wrote: post #68

That is one of the reasons I am thinking about having /home on NILFS2 ([1] a log-structured file system) in my dabbing with my own Linux distribution. When you have constant snapshots then ransomware can't do much, can it? [1] https://en.wikipedia.org/wiki/NILFS

Depends on what permissions it has. If it runs as root, it probably could delete/mess up snapshots. If it's going to do so, especially for non-mainstream filesystems, is another question.

Re: Linux ransomware in the wild

#79

Post by pbhjpbhj »

Hadn't thought of it before but it might be an idea to run my browser (Firefox, Kubuntu 17.04) under a separate user that doesn't have access to my main user files.

Might be simplest to just create a user through the DE, then "su -c" from my main user to run the browser?

Re: Linux ransomware in the wild

#80

Post by fghtr »

Crontab wrote: post #41
pletnes wrote: post #8

Earlier quoted context omitted.

People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!

Running NoScript is a real eye-opener, even if you don't stick with it, because the about of bullshit that is pulled down from visiting a common website is incredible.

Try RequestPolicy and you will see the other 80% of crap...
Post reply on HN