Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux ransomware in the wild

forums.gentoo.org

Post reply on HN
Print view View original

41–50 of 112 posts

Re: Linux ransomware in the wild

#41

Post by Crontab »

pletnes wrote: post #8
rjzzleep wrote: post #7

Earlier quoted context omitted.

I assumed that was implied for every HN reader. But even though I have noscript and ublock with a lot of things blocked you never have 100% coverage.

People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!

Running NoScript is a real eye-opener, even if you don't stick with it, because the about of bullshit that is pulled down from visiting a common website is incredible.

Re: Linux ransomware in the wild

#42

Post by pjmlp »

pedrocr wrote: post #28
avian wrote: post #20

Earlier quoted context omitted.

Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory. If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.

There may be things an exploit can do as root that wouldn't work under your user to break out of the adobe flash "sandbox". But yeah, the real recommendation is to get rid of flash and kill it with fire. The security of free software isn't fullproof but good riddance from the web to that particular closed source blob.

It will come back as WebAssembly.

Re: Linux ransomware in the wild

#43

Post by fulafel »

avian wrote: post #20
joecool1029 wrote: post #2

Nice read but nothing particularly special here and it happened months ago. The title is alarmist. TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.

Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory. If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.

Firefox has some sandboxing on Linux, though it's quite recent.

Re: Linux ransomware in the wild

#44

Post by pjmlp »

abrowne wrote: post #13

Not trying to blame the user, just trying to understand: why would someone ever run a web browser as root? A text editor to edit system files, ok, but a browser?

It is quite common among normal users trying to use more secure OSes.

Not sure if this is still a thing, but I remember Apple forums used to have people asking how to do that.

Re: Linux ransomware in the wild

#45

Post by zanny »

avian wrote: post #20
joecool1029 wrote: post #2

Nice read but nothing particularly special here and it happened months ago. The title is alarmist. TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.

Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory. If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.

This is why I wish people took mandatory access control more seriously. But to make it really pervasive and useful you need something like what Android has, where the file format mandates MAC profiles for the app. Even Red Hat cannot maintain SELinux profiles for every package in every repo, and even then third parties would complain about having to write the profiles just for RHEL / Fedora packages.

It is something the entire ecosystem would have to, at once, agree to make happen, and then standardize mandated MAC profiles in every package format. So basically never.

Re: Linux ransomware in the wild

#46

Post by joshstrange »

joecool1029 wrote: post #2

Nice read but nothing particularly special here and it happened months ago. The title is alarmist. TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.

> TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.

That has been speculated but far from proven. On the last page they are still talking about the point of entry and how they are in no way convinced it was FF/Flash.

Re: Linux ransomware in the wild

#47

Post by jorvi »

zokier wrote: post #32
ddevault wrote: post #17

It doesn't seem to have been mentioned on the forums, which is alarming, but the correct response to finding out your machine has been owned is to shut it the fuck down . Right away. Then boot up a rescue CD, which will have a known working system (read: not compromised), from which you can do some forensic work to find out how you were owned and what data is recoverable. Take the data you can recover offline and the…

> from which you can do some forensic work to find out how you were owned It's worth noting that if you are really serious about doing forensics and investigating the attack, then shutting down can be pretty destructive. > what data is recoverable. Another point I'd make is that try to recover as little as possible from the infected system and prefer using clean backups instead. I agree on the overall sentiment thoug…

I may be wrong, but these days doesn't malware have a loader (which has a hook in the boot cycle at some point) and a payload (which usually poses as an innocent file tucked away on your system somewhere). Even if you wholesale recover your data and include the payload, there is no loader hooked into your newly-installed system, rendering the payload a digital bullet without a corresponding gun. As far as I'm aware, infecting your MP3s or JPEGs was more something ye olde worms did, no?

Re: Linux ransomware in the wild

#48

Post by saltcured »

jorvi wrote: post #47
zokier wrote: post #32

Earlier quoted context omitted.

> from which you can do some forensic work to find out how you were owned It's worth noting that if you are really serious about doing forensics and investigating the attack, then shutting down can be pretty destructive. > what data is recoverable. Another point I'd make is that try to recover as little as possible from the infected system and prefer using clean backups instead. I agree on the overall sentiment thoug…

I may be wrong, but these days doesn't malware have a loader (which has a hook in the boot cycle at some point) and a payload (which usually poses as an innocent file tucked away on your system somewhere). Even if you wholesale recover your data and include the payload, there is no loader hooked into your newly-installed system, rendering the payload a digital bullet without a corresponding gun. As far as I'm aware,…

Trying to make distinctions like this gets you back to "figuring out how you were owned", i.e. determining the transmission vectors and threats.

The reality is that decoders for complex file formats often have buffer overrun and code execution flaws. If such mechanisms were used in the original attack or if the malware has worm-like abilities to extend the attack from your compromised machine, then wouldn't it me likely that more such corrupted data is also being staged to your machine?

Also, a very real risk would be the huge number of little scripts and configuration files which offer embedded scripting syntaxes. A naive victim might think they can install a new OS and just "recover their custom configuration files", but they are really recovering the attacker's configuration which can include the actual malware activation or other fail-safe reinfection mechanisms.

Re: Linux ransomware in the wild

#49

Post by fulafel »

rjzzleep wrote: post #4
joecool1029 wrote: post #2

Nice read but nothing particularly special here and it happened months ago. The title is alarmist. TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.

Isn't that how most ransomware spreads? Here's a detailed view on Angler exploit kit which spreads through ad networks[1]. What's a good way to browse safely without using something like tails? There's firejail[2] and obviously I can run it as a different user [1]: https://news.sophos.com/en-us/2015/07/21/a-closer-look-at-th... [2]: https://firejail.wordpress.com/

Chrome has a better sandbox than Firefox, for one.

A notch better would be running Qubes OS.

Re: Linux ransomware in the wild

#50

Post by throwmenow_0140 »

avian wrote: post #20
joecool1029 wrote: post #2

Nice read but nothing particularly special here and it happened months ago. The title is alarmist. TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.

Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory. If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.

agree. ordinary user is absolutely sufficient. I'll now present a sophisticated privilege escalation method that most of us won't notice (me included, sarcasm off):

  alias sudo='/usr/bin/sudo echo something evil && /usr/bin/sudo'
I don't think it matters that he used his root account.

Edit: Maybe I'm wrong with my opinion, you can disable ASLR using your root rights... https://askubuntu.com/a/318476

Edit: Last exploit for Linux remote exploitation with Flash is from 2015 https://www.rapid7.com/db/modules/exploit/multi/browser/adob... or did I miss something here?

Post reply on HN