Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux ransomware in the wild

forums.gentoo.org

Post reply on HN
Print view View original

81–90 of 112 posts

Re: Linux ransomware in the wild

#81

Post by chrisfosterelli »

kbp wrote: post #65
chrisfosterelli wrote: post #54

Earlier quoted context omitted.

So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

> So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`. $ alias /usr/bin/sudo=whatever bash: alias: `/usr/bin/sudo': invalid alias name

Oh, fair point. Not all shells support this apparently. zsh does:

    -> alias /usr/bin/sudo='ls -a'
    -> /usr/bin/sudo
     .  ..

Re: Linux ransomware in the wild

#82

Post by chrisfosterelli »

wrycoder wrote: post #59
chrisfosterelli wrote: post #54

Earlier quoted context omitted.

So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

Hm. How about ‘sudo’ ? i.e. quote the command?

Based on the sibling comment to yours, I don't think bash supports this. zsh allows you to make a \'sudo\' alias though, so it depends on your shell.

Re: Linux ransomware in the wild

#83

Post by therein »

bogomipz wrote: post #77
tedunangst wrote: post #51

Earlier quoted context omitted.

The loader hook could well be in your .profile. Or the infection vector could be a naughty PDF just waiting to be thumbnailed again after a reinstall.

Could you elaborate are you referring to a specific PDF vulnerability? Could you share a link to it? Thanks.

This should do:

> In the first demo, I just select the PDF document with one click. This is enough to exploit the vulnerability, because the PDF document is implicitly read to gather extra information.

> In the second demo, I change the view to Thumbnails view. In a thumbnail view, the first page of a PDF document is rendered to be displayed in a thumbnail. Rendering the first page implies reading the PDF document, and hence triggering the vulnerability.

> In the third demo, I use my special PDF document with the malformed stream object in the metadata. When I hover with the mouse cursor over the document (I don’t click), a tooltip will appear with the file properties and metadata. But with my specially crafted PDF document, the vulnerability is triggered because the metadata is read to display the tooltip…

https://blog.didierstevens.com/2009/03/04/quickpost-jbig2dec...

Re: Linux ransomware in the wild

#85

Post by notzorbo3 »

pletnes wrote: post #8
rjzzleep wrote: post #7

Earlier quoted context omitted.

I assumed that was implied for every HN reader. But even though I have noscript and ublock with a lot of things blocked you never have 100% coverage.

People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!

I run umatrix, and I block everything. Cookies, CSS, images, scripts, media, XHR, etc. Everything, except for CSS and images from the thirst-party domain (e.g. *.ycombinator.com).

Most sites actually work better with this. They're faster, there's less clutter, no ads, less risk. Some need a little convincing by unblocking some CSS or images. Umatrix makes this super easy. If a site requires javascript to run, I just skip that content. It's different for web apps like trello or github of course. Those get much more permissions.

> How on earth do you navigate what to let through and what to block?

umatrix gives a nice matrix (duh) that shows exactly what's trying to load. I dont often need to unblock things, but when I do, it's usually obvious right away. Takes maybe two clicks. Worth the effort IMHO

Re: Linux ransomware in the wild

#86

Post by wrycoder »

chrisfosterelli wrote: post #82
wrycoder wrote: post #59

Earlier quoted context omitted.

Hm. How about ‘sudo’ ? i.e. quote the command?

Based on the sibling comment to yours, I don't think bash supports this. zsh allows you to make a \'sudo\' alias though, so it depends on your shell.

At least in bash, quoting the command disables any alias. Maybe also in zsh?

Re: Linux ransomware in the wild

#87

Post by notzorbo3 »

fwdpropaganda wrote: post #26
pletnes wrote: post #8

Earlier quoted context omitted.

People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!

I always assumed that everyone on HN would be using uMatrix. Strangely it doesn't seem very popular. I don't run JS at all except for very few webpages (think gmail log in page, etc). EDIT: Now that I think about it, I haven't really stressed how good uMatrix is. It really has changed the way I use the internet.

> It really has changed the way I use the internet.

I agree so much. I cannot recommend umatrix highly enough. It has put me completely back in control of what sites can and can't do. I block everything by default except for first-party CSS and images (e.g. *.ycombinator.com when I visit news.ycombinator). It's great, and not at all as bothersome as I thought.

No more HTML5 pop-ups, deceptive ads, no more auto loading videos, no more sneaky audio, no more weird javascript that slows my browser to a crawl, no more tracking.

Honestly people, give it a shot. It's amazing.

Re: Linux ransomware in the wild

#88

Post by chrisfosterelli »

wrycoder wrote: post #86
chrisfosterelli wrote: post #82

Earlier quoted context omitted.

Based on the sibling comment to yours, I don't think bash supports this. zsh allows you to make a \'sudo\' alias though, so it depends on your shell.

At least in bash, quoting the command disables any alias. Maybe also in zsh?

zsh seems to have much more flexible alias rules than bash:

    > alias \'sudo\'='ls -a'
    > 'sudo'                
    .  ..

Re: Linux ransomware in the wild

#89

Post by jlgaddis »

throwmenow_0140 wrote: post #50
avian wrote: post #20

Earlier quoted context omitted.

Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory. If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.

agree. ordinary user is absolutely sufficient. I'll now present a sophisticated privilege escalation method that most of us won't notice (me included, sarcasm off): alias sudo='/usr/bin/sudo echo something evil && /usr/bin/sudo' I don't think it matters that he used his root account. Edit: Maybe I'm wrong with my opinion, you can disable ASLR using your root rights... https://askubuntu.com/a/318476 Edit: Last exploit…

There was a zero-day for Flash being exploited ITW just a few days ago.

Re: Linux ransomware in the wild

#90

Post by beeforpork »

ddevault wrote: post #17

It doesn't seem to have been mentioned on the forums, which is alarming, but the correct response to finding out your machine has been owned is to shut it the fuck down . Right away. Then boot up a rescue CD, which will have a known working system (read: not compromised), from which you can do some forensic work to find out how you were owned and what data is recoverable. Take the data you can recover offline and the…

And if you are paranoid, don't wait for proper shutdown, but pull the power plug. Don't bother with the network plug, pull the power plug right away. Some powners don't like interrupts and have a nice easter egg in the shutdown or network down procedure, e.g. erasing stuff you might not have backupped (which, I am sure, you have, right?).
Post reply on HN