Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux Malware “Drovorub” developed by Russian exposed by NSA and FBI

nsa.gov

Post reply on HN
Print view View original

1–10 of 16 posts

Re: Linux Malware “Drovorub” developed by Russian exposed by NSA and FBI

#2

Post by svrb »

> kernel module

If you're running a module-enabled kernel then you were already pwned to begin with; nothing to see here. There is absolutely no need for modules except on live cds and the like. Of course, kernel configuration is another huge headache; don't get me wrong.

Re: Linux Malware “Drovorub” developed by Russian exposed by NSA and FBI

#3

Post by kakd »

svrb wrote: post #2

> kernel module If you're running a module-enabled kernel then you were already pwned to begin with; nothing to see here. There is absolutely no need for modules except on live cds and the like. Of course, kernel configuration is another huge headache; don't get me wrong.

Can you please explain the security issue with module-enabled kernels?

Re: Linux Malware “Drovorub” developed by Russian exposed by NSA and FBI

#5

Post by Pick-A-Hill2019 »

svrb wrote: post #2

> kernel module If you're running a module-enabled kernel then you were already pwned to begin with; nothing to see here. There is absolutely no need for modules except on live cds and the like. Of course, kernel configuration is another huge headache; don't get me wrong.

The Cybersecurity Advisory link in the first line of the article is worth a read for a greater insight as to why it might be more than just 'pfft, nothing to see here' regarding kernel modules

Re: Linux Malware “Drovorub” developed by Russian exposed by NSA and FBI

#6

Post by [deleted] »

kakd wrote: post #3
svrb wrote: post #2

> kernel module If you're running a module-enabled kernel then you were already pwned to begin with; nothing to see here. There is absolutely no need for modules except on live cds and the like. Of course, kernel configuration is another huge headache; don't get me wrong.

Can you please explain the security issue with module-enabled kernels?

[deleted]

Re: Linux Malware “Drovorub” developed by Russian exposed by NSA and FBI

#8

Post by renewiltord »

svrb wrote: post #2

> kernel module If you're running a module-enabled kernel then you were already pwned to begin with; nothing to see here. There is absolutely no need for modules except on live cds and the like. Of course, kernel configuration is another huge headache; don't get me wrong.

Can someone explain this? I have DKMS enabled because I use the proprietary nvidia drivers. Also all my drivers are kernel modules. I feel like I'm missing something here, though.

Re: Linux Malware “Drovorub” developed by Russian exposed by NSA and FBI

#9

Post by jmt_ »

iLemming wrote: post #4

Note that "drovorub" isn't even a Russian word, "drovosek" is. It means "woodcutter".

Why would a natively Russian speaking team misspell this word? Is it possible this software wasn't developed in Russia/by Fancy Bear or that it's some sort of play on words that I don't understand as an English speaker?
Post reply on HN