Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux ransomware in the wild

forums.gentoo.org

Post reply on HN
Print view View original

51–60 of 112 posts

Re: Linux ransomware in the wild

#51

Post by tedunangst »

jorvi wrote: post #47
zokier wrote: post #32

Earlier quoted context omitted.

> from which you can do some forensic work to find out how you were owned It's worth noting that if you are really serious about doing forensics and investigating the attack, then shutting down can be pretty destructive. > what data is recoverable. Another point I'd make is that try to recover as little as possible from the infected system and prefer using clean backups instead. I agree on the overall sentiment thoug…

I may be wrong, but these days doesn't malware have a loader (which has a hook in the boot cycle at some point) and a payload (which usually poses as an innocent file tucked away on your system somewhere). Even if you wholesale recover your data and include the payload, there is no loader hooked into your newly-installed system, rendering the payload a digital bullet without a corresponding gun. As far as I'm aware,…

The loader hook could well be in your .profile. Or the infection vector could be a naughty PDF just waiting to be thumbnailed again after a reinstall.

Re: Linux ransomware in the wild

#52

Post by ryanlol »

joecool1029 wrote: post #2

Nice read but nothing particularly special here and it happened months ago. The title is alarmist. TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.

>TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.

While possible, this sounds so spectacularly unlikely that I can’t help but think that you’re just speculating.

Re: Linux ransomware in the wild

#53

Post by wrycoder »

throwmenow_0140 wrote: post #50
avian wrote: post #20

Earlier quoted context omitted.

Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory. If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.

agree. ordinary user is absolutely sufficient. I'll now present a sophisticated privilege escalation method that most of us won't notice (me included, sarcasm off): alias sudo='/usr/bin/sudo echo something evil && /usr/bin/sudo' I don't think it matters that he used his root account. Edit: Maybe I'm wrong with my opinion, you can disable ASLR using your root rights... https://askubuntu.com/a/318476 Edit: Last exploit…

I use /usr/bin/sudo

Re: Linux ransomware in the wild

#54

Post by chrisfosterelli »

wrycoder wrote: post #53
throwmenow_0140 wrote: post #50

Earlier quoted context omitted.

agree. ordinary user is absolutely sufficient. I'll now present a sophisticated privilege escalation method that most of us won't notice (me included, sarcasm off): alias sudo='/usr/bin/sudo echo something evil && /usr/bin/sudo' I don't think it matters that he used his root account. Edit: Maybe I'm wrong with my opinion, you can disable ASLR using your root rights... https://askubuntu.com/a/318476 Edit: Last exploit…

I use /usr/bin/sudo

So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

Re: Linux ransomware in the wild

#55

Post by KGIII »

Hmm... I half expected this to be a joke and the post about how they had to compile it themselves and were trying to get the dependencies squared away.

Friends don't let friends run Flash. Does Gentoo have Firejail readily available? That would have prevented this, I'm pretty sure.

Re: Linux ransomware in the wild

#56

Post by kuschku »

jorvi wrote: post #47
zokier wrote: post #32

Earlier quoted context omitted.

> from which you can do some forensic work to find out how you were owned It's worth noting that if you are really serious about doing forensics and investigating the attack, then shutting down can be pretty destructive. > what data is recoverable. Another point I'd make is that try to recover as little as possible from the infected system and prefer using clean backups instead. I agree on the overall sentiment thoug…

I may be wrong, but these days doesn't malware have a loader (which has a hook in the boot cycle at some point) and a payload (which usually poses as an innocent file tucked away on your system somewhere). Even if you wholesale recover your data and include the payload, there is no loader hooked into your newly-installed system, rendering the payload a digital bullet without a corresponding gun. As far as I'm aware,…

There were wormable vulns in both ffmpeg-thumbnailer and Gnome’s thumbnailer in the past months.

So you shouldn’t trust that this doesn’t happen again.

Re: Linux ransomware in the wild

#57

Post by cisanti »

pritambaral wrote: post #34
cisanti wrote: post #14

I don't understand from this post why run Firefox as root and why have in addition flash enabled on Linux. But it's still interest that they bother with making ransomware the first place for Linux.

Lots of servers run Linux. Lots of data to hold ransom on lots of servers running Linux.

But who runs flash on server as root?! If this was the source..

Re: Linux ransomware in the wild

#58

Post by jerheinze »

fulafel wrote: post #43
avian wrote: post #20

Earlier quoted context omitted.

Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory. If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.

Firefox has some sandboxing on Linux, though it's quite recent.

It had level 2 content sandboxing from FF54, and level 3 (which has write and read access restrictions) with FF57. https://wiki.mozilla.org/Sandbox#Current_Status https://wiki.mozilla.org/Sandbox#Content_Levels_2

Re: Linux ransomware in the wild

#60

Post by JTechno »

throwmenow_0140 wrote: post #50
avian wrote: post #20

Earlier quoted context omitted.

Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory. If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.

agree. ordinary user is absolutely sufficient. I'll now present a sophisticated privilege escalation method that most of us won't notice (me included, sarcasm off): alias sudo='/usr/bin/sudo echo something evil && /usr/bin/sudo' I don't think it matters that he used his root account. Edit: Maybe I'm wrong with my opinion, you can disable ASLR using your root rights... https://askubuntu.com/a/318476 Edit: Last exploit…

I'm going to make a separate account just to run the web browser, xhost +localhost && su -c web-browser unprivileged-user
Post reply on HN