'FIRST ever' Linux, Mac OS X-only password sniffing Trojan spotted
Windows? Who the hell uses that?
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Security researchers have discovered a potential dangerous Linux and Mac OS X cross-platform trojan.
Once installed on a compromised machine, Wirenet-1 opens a backdoor to a remote command server, and logs key presses to capture passwords and sensitive information typed by victims.
The program also grabs passwords submitted to Opera, Firefox, Chrome and Chromium web browsers, and credentials stored by applications including email client Thunderbird, web suite SeaMonkey, and chat app Pidgin. The malware then attempts to upload the gathered data to a server hosted in the Netherlands.
The software nastie was intercepted by Russian antivirus firm Dr Web, the company that carried out much of the analysis of the infamous Flashback trojan. Dr Web describes Wirenet-1 as the first Linux/OSX cross-platform password-stealing trojan.
Multi-platform virus strains that infect Windows, Mac OS X and Linux machines are extremely rare but not unprecedented. One example include the recent Crisis super-worm. Creating a strain of malware that infects Mac OS X and Linux machines but not Windows boxes seems, frankly, weird given the sizes of each operating system's userbase - unless the virus has been designed for some kind of closely targeted attack on an organisation that uses a mix of the two Unix flavours.
Analysis work on the Wirenet-1 is ongoing and for now it's unclear how the trojan is designed to spread. Once executed, it copies itself to the user's home directory, and uses AES to encrypt its communications with a server over the internet. ®
COMMENTS
Re: Had to happen
According to the site at the end of the link in the article:
"It's not clear yet how the Trojan, which was added to the Dr.Web virus database as BackDoor.Wirenet.1, spreads. This malicious program is a backdoor that can work under Linux as well as under Mac OS X.
When launched, it creates its copy in the user's home directory. The program uses the Advanced Encryption Standard (AES) to communicate with its control server whose address is 212.7.208.65."
So no details as to how it gets installed and no details as to how it's spread. Does this really merit an article? Because anybody can write a Linux virus - a shell script will do. The trick is getting it installed, giving it execute permissions and permissions to do its stuff.
I'll start to worry when I find out it exploits a weakness in the OS that allows it to install itself by stealth and then escalate its privileges. Or when it somehow gets added to the Ubuntu repositories, of course.
How it spreads...
"Dear friend
I hope you are well
Please to run "sudo dpkg -i install makemoneyandpenisfast" on attached.
For great money and health!
"
Nothing new here
Linux distributions already have regular security updates. I have heard Windows users complain that AV software smells of pooh so often that I am glad there is very little for Linux (There is some for filtering Microsoft malware out of email). In the Microsoft world, malware is installed and executed so it can hide and do damage before AV software can hunt for it. The rest of us don't run malware in the first place unless it is to test security.
I have tried installing some but the install scripts got tripped up by little things like mounting /tmp and /var/tmp noexec. Trivial changes to the configuration like that make most Linux boxes more trouble than they are worth. There are plenty of more complex options available for high value targets to ensure that viruses have to be targeted to a specific organisation or machine.
X86 is getting rare these days as much has been moved to AMD64, but my home also has MIPS and two incompatible flavours of ARM. Multiply that by the number of distributions and the users' choices about what software to use and you can see why Linux malware is just not as profitable as stuff for Microsoft even though some of the machines are very high value targets and Unix malware has been around longer:
This is the Unix e-mail virus. It works on the honour system. Please send copies of this e-mail to your friends then delete a few files.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
