Powerful, highly stealthy Linux trojan may have infected victims for years
1–10 of 103 posts
Re: Powerful, highly stealthy Linux trojan may have infected victims for years
#2Is there a quick and dirty script/one liner I can run to check my VPS right now?
Re: Powerful, highly stealthy Linux trojan may have infected victims for years
#3[deleted]
Re: Powerful, highly stealthy Linux trojan may have infected victims for years
#4Details via:
https://securelist.com/blog/research/67962/the-penquin-turla...
Notably, the C&C domain has been sinkholed by Kaspersky.
This has been linked to the complex "Turla" industrial espionage malware, as it shares a C&C server. (Turla: http://securelist.com/analysis/publications/65545/the-epic-t... )
Re: Powerful, highly stealthy Linux trojan may have infected victims for years
#5I concede that it's not a panacea, but I really do feel like filtering outbound requests is going to be one of the best defences we have against stuff like this going forward.
It protects you against:
- viruses / trojans that try to call out
- ad tracking (and ads in general, if you want)
- intrusive analytics
- suspect consumer devices (TVs that transmit live audio, network cameras that connect to the cloud even though the cloud feature is disabled, content players that try to report your activity)
Edit: formatting
Re: Powerful, highly stealthy Linux trojan may have infected victims for years
#6I concede that it's not a panacea, but I really do feel like filtering outbound requests is going to be one of the best defences we have against stuff like this going forward. It protects you against: - viruses / trojans that try to call out - ad tracking (and ads in general, if you want) - intrusive analytics - suspect consumer devices (TVs that transmit live audio, network cameras that connect to the cloud even tho…
Only if you filter outgoing requests from a different box. If the attacker owns your kernel they can bypass the filtering.
A nice OpenBSD box as an outbound filter does make sense though, with a different control mechanism.
Re: Powerful, highly stealthy Linux trojan may have infected victims for years
#7I concede that it's not a panacea, but I really do feel like filtering outbound requests is going to be one of the best defences we have against stuff like this going forward. It protects you against: - viruses / trojans that try to call out - ad tracking (and ads in general, if you want) - intrusive analytics - suspect consumer devices (TVs that transmit live audio, network cameras that connect to the cloud even tho…
Only if you filter outgoing requests from a different box. If the attacker owns your kernel they can bypass the filtering. A nice OpenBSD box as an outbound filter does make sense though, with a different control mechanism.
What about connecting the suspect device to a switch and filtering all of the outbound requests on that switch. If request is approved, forward it to the internet?
Re: Powerful, highly stealthy Linux trojan may have infected victims for years
#8I concede that it's not a panacea, but I really do feel like filtering outbound requests is going to be one of the best defences we have against stuff like this going forward. It protects you against: - viruses / trojans that try to call out - ad tracking (and ads in general, if you want) - intrusive analytics - suspect consumer devices (TVs that transmit live audio, network cameras that connect to the cloud even tho…
One kind of neat thing I do is filter outbound traffic based on the user. If you're using s newish distro like centos7/rhel7 or a newer ubuntu, you can filter packets with ip tables based on the user.
I force the apps in various docker containers to run as different users (one per major app or major suite of apps), and use up tables to lock those bits down. My wordpress got owned and there was a little perl script attempting to contact the C&C server, which ip tables happily blocked. It isn't a panacea, but security works best in multiple overlapping layers.
Re: Powerful, highly stealthy Linux trojan may have infected victims for years
#9How can it run packet dumping as a non-root user?
Re: Powerful, highly stealthy Linux trojan may have infected victims for years
#10What a worthless article.