Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HiddenWasp Malware Stings Targeted Linux Systems

intezer.com

Post reply on HN
Print view View original

21–30 of 42 posts

Re: HiddenWasp Malware Stings Targeted Linux Systems

#21

Post by saagarjha »

newnewpdro wrote: post #20
saagarjha wrote: post #19

Earlier quoted context omitted.

I don't think the article says this? > The malware will attempt to find the dynamic linker binary within these paths. The dynamic linker filename is usually prefixed with ld- .

'In addition, in order to check if your system is infected, you can search for “ld.so” files — if any of the files do not contain the string ‘/etc/ld.so.preload’, your system may be compromised.'

I think they're assuming that readers will excuse them for a bit of sloppiness for brevity's sake.

Re: HiddenWasp Malware Stings Targeted Linux Systems

#22

Post by xorcist »

_urga wrote: post #13

I work on an email startup in private beta. While developing our antivirus system, I was surprised to find that most email providers do not block ZIP attachments containing SH shell script files, nor ZIP attachments containing extension-less files with the executable bit set, nor ZIP attachments containing symlink traversal paths, nor any attachments which start with the shebang "#!" shell script signature, nor any w…

Is it really that strange? Windows email clients tend to run code in attachments just by clicking them (or, in some cases, just viewing them). So the risk factor in letting these emails in is quite large.

That's not as common with other platforms. Even the common GUI platforms on Linux would require the user to manually save the file and explicitly marking the file as executable. Nobody would conflate user friendliness with the ease of running untrusted code.

Defaults does make a difference. Even as these users are "left behind" in email filtering, we're seeing limited effects of malware with the more popular Linux platforms such as Android and the various desktops.

Re: HiddenWasp Malware Stings Targeted Linux Systems

#23

Post by skrebbel »

xorcist wrote: post #22
_urga wrote: post #13

I work on an email startup in private beta. While developing our antivirus system, I was surprised to find that most email providers do not block ZIP attachments containing SH shell script files, nor ZIP attachments containing extension-less files with the executable bit set, nor ZIP attachments containing symlink traversal paths, nor any attachments which start with the shebang "#!" shell script signature, nor any w…

Is it really that strange? Windows email clients tend to run code in attachments just by clicking them (or, in some cases, just viewing them). So the risk factor in letting these emails in is quite large. That's not as common with other platforms. Even the common GUI platforms on Linux would require the user to manually save the file and explicitly marking the file as executable. Nobody would conflate user friendline…

> Windows email clients tend to run code in attachments just by clicking them

Citation please? This is not my experience.

Re: HiddenWasp Malware Stings Targeted Linux Systems

#24

Post by _urga »

xorcist wrote: post #22
_urga wrote: post #13

I work on an email startup in private beta. While developing our antivirus system, I was surprised to find that most email providers do not block ZIP attachments containing SH shell script files, nor ZIP attachments containing extension-less files with the executable bit set, nor ZIP attachments containing symlink traversal paths, nor any attachments which start with the shebang "#!" shell script signature, nor any w…

Is it really that strange? Windows email clients tend to run code in attachments just by clicking them (or, in some cases, just viewing them). So the risk factor in letting these emails in is quite large. That's not as common with other platforms. Even the common GUI platforms on Linux would require the user to manually save the file and explicitly marking the file as executable. Nobody would conflate user friendline…

"Linux would require the user to manually save the file [...] explicitly marking the file as executable."

ZIP attachments preserve executable flags.

Also, symlink traversal attacks only require a ZIP attachment to be clicked. Apple patched macOS for this a little while ago, but it's probably still a thing on many systems - since most email providers know to detect ZIP directory traversals, but not ZIP symlink traversals.

There's also a range of other containers for macOS and Linux which will preserve executable flags if you ask them to.

And we have also seen simple character encoding attacks which can crash Apple Mail just on viewing the email.

Re: HiddenWasp Malware Stings Targeted Linux Systems

#25

Post by littlestymaar »

skrebbel wrote: post #23
xorcist wrote: post #22

Earlier quoted context omitted.

Is it really that strange? Windows email clients tend to run code in attachments just by clicking them (or, in some cases, just viewing them). So the risk factor in letting these emails in is quite large. That's not as common with other platforms. Even the common GUI platforms on Linux would require the user to manually save the file and explicitly marking the file as executable. Nobody would conflate user friendline…

> Windows email clients tend to run code in attachments just by clicking them Citation please? This is not my experience.

On windows, when you (double)click on an executable file it runs, because that's the default action for executables. On Unixes you need to mark the file as executable (with `chmod`) for this to happen.

Re: HiddenWasp Malware Stings Targeted Linux Systems

#26

Post by skrebbel »

littlestymaar wrote: post #25
skrebbel wrote: post #23

Earlier quoted context omitted.

> Windows email clients tend to run code in attachments just by clicking them Citation please? This is not my experience.

On windows, when you (double)click on an executable file it runs, because that's the default action for executables. On Unixes you need to mark the file as executable (with `chmod`) for this to happen.

In an email client? Without any warning of sorts?

Which email client is that?

Also, for many years already, Windows won't let you run an executable that you just downloaded from the internet just by double clicking, without first clicking through a warning dialog.

Re: HiddenWasp Malware Stings Targeted Linux Systems

#27

Post by neilv »

nils-m-holm wrote: post #16
neilv wrote: post #8

Earlier quoted context omitted.

1. They're mixing a Bourne-ism (backquotes) with a Bash-ism (dollar-parens). I don't know why. 2. This could be an attempt to normalize and reduce whitespace, including eliminating newlines (though you should prevent injection of arguments to `echo`): bash$ Temp=$(echo " a b c ") bash$ echo "[${Temp}]" [ a b c ] bash$ Temp=`echo $(echo " a b c ")` bash$ echo "[${Temp}]" [a b c] bash$ Temp=$(echo $(echo " a b c ")) ba…

The Bourne shell had $() before it had backquote. It's not a Bash-ism.

Thank you, I was mistaken to call it a Bash-ism. Bash's documentation said it's a Posix-ism:

> The POSIX $() form of command substitution is implemented (see Command Substitution), and preferred to the Bourne shell’s `` (which is also implemented for backwards compatibility).

https://www.gnu.org/software/bash/manual/html_node/Major-Dif...

Re: HiddenWasp Malware Stings Targeted Linux Systems

#28

Post by _urga »

skrebbel wrote: post #26
littlestymaar wrote: post #25

Earlier quoted context omitted.

On windows, when you (double)click on an executable file it runs, because that's the default action for executables. On Unixes you need to mark the file as executable (with `chmod`) for this to happen.

In an email client? Without any warning of sorts? Which email client is that? Also, for many years already, Windows won't let you run an executable that you just downloaded from the internet just by double clicking, without first clicking through a warning dialog.

Yes, but then again warning dialogs don't have much track record in preventing malware outbreaks.

For example, recent versions of Word won't run VBA macros by default without the user clicking through a warning dialog, and yet people fall for it all the time.

Malware authors don't mind either way.

Re: HiddenWasp Malware Stings Targeted Linux Systems

#29

Post by bayareanative »

Antivirus is always a "closing the barn door after the horse has left"... it's completely reactionary/inadequate as it almost always relies on other people reporting a problem, so it's always behind and a Tragedy of the Commons in that very little of actual malware is ever reported. HIDS isn't much better. NIDS is slightly more useful as it's independent of the endpoint, but can also be evaded to a degree. Both HIDS/NIDS aren't great on their own because they're really the last lines of defense to tell you you're pwned.

In previous life, I inherited a bunch of Win2k database servers that were running on unfiltered public IPs (yuck!).. and several of them had undetectable, stealth rootkit malware that wasn't economically-feasible to remove (Microsoft and Winternals were in the loop).. and because they "couldn't be reimagined," network rules were used to disconnect it from bot operations. Yuck. Don't put unsecured or fragile anything on public IPs because odds are they will be pwnes with variants of malware no AV has ever seen, and it will be a persistent threat (APT) that won't be evident until later.

The best defenses include, but aren't limited to:

- Never run untrusted code.

- Never allow untrusted write and execute.

- Don't do email / browser operations with admin credentials. Do it in a VM maybe or a separate machine as a normal, unprivileged user is best.

- Least privilege, all the things.

- Verify cryptographic signatures enforcing chain-/web-of-trust of source/binaries/packages.

- Holistic defense-in-depth.

- Minimalism/minimal attack surfaces.

- Don't run fragile, unconfigured OSes on unfiltered public IP's. (Please.)

Re: HiddenWasp Malware Stings Targeted Linux Systems

#30

Post by skrebbel »

_urga wrote: post #28
skrebbel wrote: post #26

Earlier quoted context omitted.

In an email client? Without any warning of sorts? Which email client is that? Also, for many years already, Windows won't let you run an executable that you just downloaded from the internet just by double clicking, without first clicking through a warning dialog.

Yes, but then again warning dialogs don't have much track record in preventing malware outbreaks. For example, recent versions of Word won't run VBA macros by default without the user clicking through a warning dialog, and yet people fall for it all the time. Malware authors don't mind either way.

I didn't say anything about that. I'm only refuting the claim that Windows email clients will run an executable just by clicking on them.
Post reply on HN