Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux ransomware in the wild

forums.gentoo.org

Post reply on HN
Print view View original

91–100 of 112 posts

Re: Linux ransomware in the wild

#91

Post by hawski »

yjftsjthsd-h wrote: post #75
hawski wrote: post #68

That is one of the reasons I am thinking about having /home on NILFS2 ([1] a log-structured file system) in my dabbing with my own Linux distribution. When you have constant snapshots then ransomware can't do much, can it? [1] https://en.wikipedia.org/wiki/NILFS

Only if the snapshots are read-only and/or invisible by default; some systems expose snapshots as additional directories under some mountpoint, in which case they just get encrypted as well.

Log-structured file systems work by treating disk space as circular log. They only append and then wrap around. Snapshots are natural consequence.

Re: Linux ransomware in the wild

#92

Post by hawski »

detaro wrote: post #78
hawski wrote: post #68

That is one of the reasons I am thinking about having /home on NILFS2 ([1] a log-structured file system) in my dabbing with my own Linux distribution. When you have constant snapshots then ransomware can't do much, can it? [1] https://en.wikipedia.org/wiki/NILFS

Depends on what permissions it has. If it runs as root, it probably could delete/mess up snapshots. If it's going to do so, especially for non-mainstream filesystems, is another question.

If it runs as root you have much more to worry about, but that's of course one of the problems.

Re: Linux ransomware in the wild

#93

Post by wallacoloo »

wrycoder wrote: post #59
chrisfosterelli wrote: post #54

Earlier quoted context omitted.

So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

Hm. How about ‘sudo’ ? i.e. quote the command?

If they have access to your .bashrc they can also alter your PATH and create a script named sudo somewhere they have write access to that carries the malicious payload. So you're not gaining much by adding the quotes.

Re: Linux ransomware in the wild

#94

Post by unkown-unknowns »

pbhjpbhj wrote: post #79

Hadn't thought of it before but it might be an idea to run my browser (Firefox, Kubuntu 17.04) under a separate user that doesn't have access to my main user files. Might be simplest to just create a user through the DE, then "su -c" from my main user to run the browser?

Out of the box it'll probably tell you "Client is not authorized to connect to server" if you try to run anything X11 as another user.

However it should be possible to configure your system such that it doesn't like such: https://wiki.archlinux.org/index.php/xorg#X_clients_started_...

Re: Linux ransomware in the wild

#95

Post by freeloop3 »

JTechno wrote: post #60
throwmenow_0140 wrote: post #50

Earlier quoted context omitted.

agree. ordinary user is absolutely sufficient. I'll now present a sophisticated privilege escalation method that most of us won't notice (me included, sarcasm off): alias sudo='/usr/bin/sudo echo something evil && /usr/bin/sudo' I don't think it matters that he used his root account. Edit: Maybe I'm wrong with my opinion, you can disable ASLR using your root rights... https://askubuntu.com/a/318476 Edit: Last exploit…

I'm going to make a separate account just to run the web browser, xhost +localhost && su -c web-browser unprivileged-user

If you're using xwindows they can just install a keylogger

Re: Linux ransomware in the wild

#96

Post by spydum »

wpietri wrote: post #9
joecool1029 wrote: post #2

Nice read but nothing particularly special here and it happened months ago. The title is alarmist. TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.

The title seems fine to me. I knew Linux ransomware was a theoretical possibility, but I didn't know it was out there in the world. Or, as they say, "in the wild".

stand up an old version of wordpress with poor admin/admin credentials on an external box, and wait a couple hours. You'll find all sorts of malware on a linux box. ransomware included. Pretty common, though it seems most people who compromise linux machines use them to launch further attacks, not ransomware. The ransomware linux variants I see all do about the same thing: wipe various /var/log/* logfiles, they encrypt all your mysql dbs, your homedir files, and your webserver docroot.

Re: Linux ransomware in the wild

#97

Post by incompatible »

jlgaddis wrote: post #89
throwmenow_0140 wrote: post #50

Earlier quoted context omitted.

agree. ordinary user is absolutely sufficient. I'll now present a sophisticated privilege escalation method that most of us won't notice (me included, sarcasm off): alias sudo='/usr/bin/sudo echo something evil && /usr/bin/sudo' I don't think it matters that he used his root account. Edit: Maybe I'm wrong with my opinion, you can disable ASLR using your root rights... https://askubuntu.com/a/318476 Edit: Last exploit…

There was a zero-day for Flash being exploited ITW just a few days ago.

I didn't think any browser on Linux still supported Flash.

Re: Linux ransomware in the wild

#98

Post by cesarb »

pbhjpbhj wrote: post #79

Hadn't thought of it before but it might be an idea to run my browser (Firefox, Kubuntu 17.04) under a separate user that doesn't have access to my main user files. Might be simplest to just create a user through the DE, then "su -c" from my main user to run the browser?

Another option would be a sandboxing system like xdg-app. AFAIK, there's already a xdg-app release of LibreOffice, and an experimental xdg-app build of Firefox.

And, of course, there's always the paranoid option of "run the browser within a virtual machine", so an attacker would have to break the browser, then get local root within the VM, and finally find an exploit for the VM, before getting to your files.

Re: Linux ransomware in the wild

#99

Post by xpaulbettsx »

Yes, I got hit by this on two separate machines in June or so, they'll break into one, steal all the SSH keys and look through your history looking for more machines to break into. It sucks ass. I suspect that my breakin was because of an outdated Wordpress installation I kept around.

This malware is super thorough and super obnoxious. Keep your machines up-to-date.

Re: Linux ransomware in the wild

#100

Post by checkyoursudo »

pletnes wrote: post #8
rjzzleep wrote: post #7

Earlier quoted context omitted.

I assumed that was implied for every HN reader. But even though I have noscript and ublock with a lot of things blocked you never have 100% coverage.

People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!

On my Linux desktop, I run firefox with uMatrix and if a page isn't readable without javascript then I don't bother, except a very few handful of sites that are whitelisted. If it's content that I really feel like I need to see, then I run chromium with just an ad blocker. They are each run from separate chroot instances, though with firefox container tabs that won't be as necessary anymore maybe.

On my macbook, I run Safari with no loading of JS or images at all, and firefox with uMatrix again. And again, if a page isn't readable without JS, then I don't read it, or I wait until I can use chromium on my desktop, assuming that I'm not going to allow the scripts in uMatrix, which I usually don't.

On my phone, I run Safari with JS always disabled, which is actually perhaps surprisingly fine for the vast majority of mobile websites.

And I run firefox for iOS with JS enabled if I really really need to look at something that doesn't work on non-JS Safari.

You get used to it. Most JS on the web is junk anyway. I don't have any FOMO by avoiding JS almost entirely, but maybe that's just me (and people like me)?

Post reply on HN