Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Looking At The New Linux Trojan

Posted by Hemos on Sat Sep 08, 2001 03:09 AM
from the peering-under-the-hood dept.
Software Linux
Da Schmiz writes: "Security firm Qualys discovered a new Linux trojan on Saturday ... details can be found on their website.. Vnunet picked up the story earlier today, and then followed up with more details. They're comparing the potential impact to Code Red or worse, since more servers run Linux / Apache than NT / IIS. I don't think it's that bad, since the infection can be easily detected, but it certainly isn't good." Update: 09/08 11:58 AM GMT by H : Of course, as Kurt Siefried pointed out in e-mail: "The trojan has nothing to do with Apache. The virus attaches itself to an executable, which you must run to infect other binaries (i.e. you must run this as root). This means that infection vectors include, but are not limited to email attachments, but you must of course save the binary, then set it executable, and then run it, as root, to do any real damage. Alternatively you must download binary software and run it (again as root to do any real damage). In other words someone must run binaries of unknown origin as root, and if this is common practice then you have larger policy and education problems to deal with." So - comparing it to Code Red is a bit dubious.
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Looking At The New Linux Trojan 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Technical detail: (Score:4, Informative)

    by AMuse (121806) <{slashdot-amuse} {at} {foofus.com}> on Saturday September 08 2001, @03:14AM (#2266510) Homepage
    It installs a backdoor which listens for incoming connections on UDP port 5503 or higher, and allows remote attackers to connect to, and take control of, an infected system.

    Unless it also reconfigures my firewall to allow incoming traffic to port 5503 and higher and fiddles with my hosts.allow file, I'm not particularly concerned. Anyone who fails to have more than one layer of precaution on their system has a bit more to worry about.

    • Partial isinformation (Score:5, Informative)

      by sigwinch (115375) on Saturday September 08 2001, @03:46AM (#2266558) Homepage
      Unless it also ... fiddles with my hosts.allow file, I'm not particularly concerned.


      Whoa, cowboy! /etc/hosts.allow only affects friendly programs that bother to parse it (e.g., inetd, or programs that use tcpwrappers). An unfriendly program is free to ignore it.

      However, your advice to use kernel firewalling is sound. 'Defense in depth' is the only way to go.

    • A lot of computers are set up with loose UDP. All those computers, which are quite a few, would let incoming traffic go to 5503 if a local program opened the port.
    • "Anyone who fails to have more than one layer of precaution on their system has a bit more to worry about."

      Except if it's a home machine with no personal/financial information on it, is connected to a cable line that can't do any damage sending data up its 128K upstream, and is running a few rudimentary firewall, you don't have much to worry about. Some people take their security WAY too seriously.

  • This could be interesting- It'll be interesting to see if just because there are more linux/apache servers out there, that means this thing will spread more and do more damage than Code Red. Or perhaps the linux machines will be better maintained than the NT machines.. We'll see.

      • I agree. Even the article tried to hint that this could be as bad as Code Red, but that's simply bogus...

        Code Red required no action on the part of the user/administrator other than having an unpatched system. This requires someone to be careless.

        This is further mitigated by the fact that, likely, the majority of infected machines won't be infected with full root access, rather it would be some random unpriveleged user who infected the machine.

        And even further, compare a typical Linux administrator to a typical NT administrator. 'nuff said. We patch our boxes, read security bulletins, run firewalls, and don't run random attachments.
        • No kidding!
          The article even mentioned (more than once) Apache and how many servers on the net run it.
          So what? Unless I missed a paragraph, Apache has nothing to do with it!
        • Security is hard stuff to get right no matter how diligent you are. Let's not overestimate the average Linux admin. I've got examples (myself included) of people who hadn't learned everything they needed to know before putting a Linux box into a dangerous position. However, I will grant you that Linux is just by nature harder to exploit with this sort of thing. I almost have to think this is a proof of concept to demonstrate to the world how ineffective an email-based virus is on a Linux platform.
          • Waitaminute-

            1) Why use Mac OS X as root? It sets you up as Administrator (less than root) and allows you to create lesser user accounts.

            2) My Mac OS X box talks to my cable modem just fine, and did so at installation time when I told it I would like to connect to the internet.

            So either you're a super-troll and I've just fed you, or you're smart enough to get root on OS X (no easy task) but dumb enough to not get the cable modem up and running with one click.
  • I'm just waiting for the first linux worms which install a trojaned copy of gcc (see "trusting trust").
    • Original here: http://www.acm.org/classics/sep95/
      Description here: http://www.tuxedo.org/jargon/jargon.html#back door

      BTW, why is slashcode telling me I've violated the postercomment compression filter when I attempt links?
  • Come on, the impact will be minimal or not at all. Although theoretically you COULD run this email attachment if you receive it, how many Linux users are stupid enough to do that? Technically Linux is just as susceptible to these things as M$ Windows, but we have one big advantage: the majority of Linux users are not morons around computers.
          • A dumb person may play chutes and ladders for fun, while a smarter person might play chess. Just because you have to be smart in order to play chess does not make chess bad.

            The same is true in operating systems. Just because it is easy doesn't make it good.

  • What file did they find did this trojan infect? (Score:5, Interesting)

    by BrookHarty (9119) on Saturday September 08 2001, @03:25AM (#2266529) Homepage Journal
    It says initially surfacing in the /bin directory, ok what file? What distro? What rpm? What .tgz do I have to watch out for? Little more info please. I don't know that any unix admin who would run /bin utilities that they get off the Internet, maybe source, but not binaries.

    This is no way as bad as Code Red, Code red self replicated on unpatched servers. This trojan will not replicate without a user doing it. Sheesh, bad journalism.
      • that would imply that the debian servers were some how compromised. this is not impossible, but fairly unlikely.

        that would be like installing a patch from microsoft that was infected with a virus.

        most people have to trust someone and for those who dont there is always the sourcecode.

  • a similar story in history (Score:5, Funny)

    by Tregod (441880) on Saturday September 08 2001, @03:26AM (#2266531)
    "...a guard at the top of the castle gates spots something in the distance, just beyond the walls. What could it be? Its...a giant wooden penguin! Imediatly, guards from different corridors of the castle rush to percieve what appeared to be a gift from the gods. All at once, they hoisted the behemoth bird onto a make shift wagon and hauled it within the castle. After much celebration and talk of good tidings, the kingdom lay it's head to rest. Later on that night, the wooden bird's bottom opened, releasing thousands upon thousands of Bill Gates' shock troops, sent to terrorize the castle and townspeople."
    • Of course. Being paranoid bastards, the open source inspired defenders of the castle take one look at the wooden penguin and burn it to the ground, crying, "I'm not taking that until I read the EULA!", "Where're the blueprints?", and "Bah! I hate precompiled statues."

  • Cute kittens (Score:3, Insightful)

    by Graymalkin (13732) on Saturday September 08 2001, @03:31AM (#2266541) Homepage
    The problem with saying "oh yeah this is easy to detect/fix" is that you're not looking from the standpoint of non-linux geeks. I've never really had a problem with trojans or virii on any of my Windows machines because I know how not to pick them up. They're headaches because most people don't know how to avoid them. The same goes with all the people who picked up a copy of RedHat and run around as root because they don't know any better. Linux is only as secure and efficient as the people using it. Weenie.
    • I have seen less and less people trying to IRC as root, trying to use root all the time, etc... The distribs I have used in recent years RH and Debian (don't remember what Slack did) ask you to create a user and that you use that...

      People running around as root are probably not going to get an email attachment, change it to a binary and run it... I would wonder if they would even know how to do that.

      The other point is that most of the Linux community is well informed. It would be a lot less of a problem b/c we know what the hell is going on. If you see something odd happening you would immediately fix it.

      Knowing what port is runs on, etc is all helpful information that will stop most of the attacks from happening.
      • You make good points but none of them are worth a shit. You do not take into account all of the people who watch TechTv and were told by Leo Laporte that running Linux was a cool and smart thing to do. These people know shit about computers but found themselves a Linux for Dummies book and actually got RedHat or Mandrake installed on their system. I don't give a fuck about this particular trojan but I was making a point about all of the linux users that DON'T know something odd is happening. Do you really know what every single line in /var/log/messages actually means? And saying the linux community is well informed is the most bullshit thing I have ever heard of. The people that run around in root will find a way to run some foreign program that they got in their mail. The next trojan will be sent as an RPM or be in a tar.gz that gets included by a rogue header. You wouldn't recognize a trojan out of thousands of lines of code, don't give yourself that much credit. The Linux community is the most pompous overzealous group of computer users I have seen in a long time. They are NOT well informed they are well hyped.

    • Whatever! (Score:3, Interesting)

      by Jason Earl (1894)

      In other words this trojan is likely to affect the vast hordes of Linux users that always log in as root, use their Linux box to read email, and who automatically install and run binaries that the receive off the Internet.

      All five of them.

      Seriously speaking, this is one of those areas where Windows users see how easy it is to use email to trick Windows users into triggering trojans and they figure that Linux must be similarly vulnerable. It isn't.

      First of all, most Linux users, even new Linux users, don't do much of their work logged in as root. In Linux it is trivial to use su or sudo to become root as necessary, and this particularly trick is one of the first that most Linuxers learn. Second of all, Linux does not make it easy to run foreign executables. No Linux client I can think of allows you to simply click on an attachment and automatically run it. Besides that, even if the person does run the executable how does it spread. Windows email viruses rely on the fact that they can programatically access the Outlook address book. Even Windows users who use Eudora or Netscape Messenger are immune to this trick. Under Linux the question of how the trojan is going to email itself to my friends is even more difficult. There are literally hundreds of mail clients that see active use. Your trojan would need to parse many different kinds of text based address books (heck, there are probably three different Emacs packages that one could use as an address book).

      And when all was said and done the chance of this trojan spreading are nearly nil. After all, even if one Linux user got infected, and the trojan successfully mailed itself to 200 of his closest friends chances are good that very few of these friends would be running Linux, and chances are even better that none of those friends running Linux would be similarly vulnerable (or nearly as dense). The trojan would refuse to spread, and that would be the end of it.

      Comparing this trojan to the Code Red worm is laughable.

  • This explains a lot... (Score:5, Funny)

    by ASCIIMan (47627) on Saturday September 08 2001, @03:40AM (#2266554)
    Now we know why slashdot has been down so much the last couple days.

  • At this time, the Remote Shell Trojan source code is not known to be available.

    This...thing violates the GPL and everything Open Source stands for! They could sell it commercially, and not even contribute back to the code base! That's just so, so, so non-Stallman that it makes my middle finger itch!

  • Don't worry, this is no Linux Code Red (Score:5, Informative)

    by Xenna (37238) on Saturday September 08 2001, @03:48AM (#2266562)
    For starters to get infected with this animal requires activity on the part of a user on the Linux box.

    Code Red required no user activity at all. A typical orphaned Linux box standing around in a corner would not be at risk, the same machine running IIS would have been a sitting duck for CR. There are a lot of orphaned servers out there with standard Redhat or IIS installs. These are the real danger. Any remote-root security holes on these popuplations are cause for real concern.

    I don't know if I'm typical or not, but where I work, Linux is used on servers (yup, I'm responsible for that) but we hardly ever read our mail on a Linux box. We use a Windows platform for that. So -> no risk.

    I'm thinking a Linux desktop user would be a better victim for this. Fortunately, hardly anyone uses Linux on the desktop so we're all safe!

    Regards,
    Xenna
    • I'm thinking a Linux desktop user would be a better victim for this. Fortunately, hardly anyone uses Linux on the desktop so we're all safe!

      They'd also need to be running as root.
        • At uni most people that wouldnt know a mouse from a monitor happily use webmail (minerva.ex.ac.uk) on their personal computers - check out that. I dont know anyone using outlook - and this is normal people like history students, not comp sci*.

          When they are actually on campus, they have a choice of eudora, simeon (I think), elm (ssh/telnet into an irix server), or webmail.

          Why use outlook?

          (* the majority of Exeter, UK's comp sci students dont know a mouse from a monitor either!)
  • void main() {

    doTrojan();
    doMainApp();

    }

    There, I just wrote myself a new "Linux Trojan". The thing is, a "New Trojan" is actually nothing new at all. Basically, all you need is a bit of code that seems userful to the user, a bit of code that the user never gets to see, and a user to run it. I can write a perl script that will happy crank out "New" trojans by the trillions. Disk space is the pure limit to the number of perfectly unique "Linux Trojans" I can make.

    I know a lot of people will use FUD like this to point out that Linux has it's flaws too, but that is complete garbage. A trojan is not a threat to a competent user on a machine with even the barest levels of user authentication and security. It is only a threat to the naive or the foolish.
      • Nice point. Now tell me if you can see this difference: Running a "trojan" as a non-root user on a Linux machine vs. running a trojan as any user on a windows 9x machine. Which one is going to cause more damage?

        Unless the Linux user has done a chmod -R 777 / recently, the windows user is going to be in serious trouble while the Linux user is fine. Why is that? Because Microsoft has some serious mental problems when it comes to security in thier non-NT environments.

        A trojan is not news. Horribly gaping flaws in security models may be, but the trojan itself is one out of a hundred trillion million trojans just like it.
      • Of course. All programs run with permisions set to read-all and write-all in Windows 9x.


        Now for the obligatory aergument by analogy:


        The Linux filesystem and user permision are like a government. What they set up is a something akin to a "legal system" in the computer. Sure, malicious programs can try subvert that (which this program TRIES TO BE, BUT IS NOT SUBTLE ENOUGH). When such a rogue program is detected, this system can help you to diagnose programs, isolate the infected binaries and "jail" them. In Windows 9x, there is no government, there is only chaos.

  • Give me a break... (Score:3, Interesting)

    by toupsie (88295) on Saturday September 08 2001, @03:59AM (#2266578) Homepage
    I have 12 to 24 hits a day from unique IPs that are Code II/III probes (hundreds all combined). To compare this worm/virus/trojan to Code Red is just plain old marketing hype. Linux to me is a server OS (quickly ducks). I use Mac OS X as my desktop OS -- its a personal thing (Darwin + Quartz + Aqua + X > Linux + X). The last thing I would do is open an e-mail attachment on a server that doesn't receive or need e-mail (duh). Code Red didn't need e-mail, it just needed a newbie with Windows NT/2000 w/ an unpatched IIS installed to spread -- which most of my probes come from (at least what nmap tells me).

    This really is a non-story. Anyone that has the skill to install Linux would know better than to execute this sort of attachment.

    Offtopic: We need a Slashdot Virus Pool for the first distributed threat to Apple's Mac OS X. I am guessing May 16, 2006.

  • Just pointing out the obvious for those of you who might have been fooled by the summary's language:
    Contrarily to what the summary hints at through the mention of Code Red, and Apache, this is not an Apache worm. It's a trojan that you actually have to execute yourself in order to be infected. Thus, if you don't blindly execute e-mail attachments, and download programs from untrusted sources, you should be safe. Moreover, the trojan is rather primitive and doesn't try to manipulate the file modification dates to hide its presence. Thus a simple ls -ltrc /bin and ls -ltr /bin should reveal its presence.

  • These journalists must be desperate for attention. (Score:5, Insightful)

    by hebble (35128) on Saturday September 08 2001, @04:17AM (#2266604)
    First: why is Apache mentioned AT ALL? It sounds like this thing only "spreads" (if you can even call it that) when someone is brain-dead enough to READ their EMAIL as a user who can WRITE to IMPORTANT BINARIES! That has nothing whatsoever to do with Apache. Is it just to support the idea that there are a lot of Linux servers?

    As virii go, this is pretty pathetic, and prompts one to question the competence of anyone who thinks it is significant. The email-vector mechanism can't even take advantage of address books, since Unix mail clients are so far from standardized.

  • I don't have much faith in the analysis (Score:3, Informative)

    by phaze3000 (204500) on Saturday September 08 2001, @04:24AM (#2266615) Homepage
    It also installs a backdoor in the infected host, listening on UDP port 5503 or higher. An attacker could connect to this port via TCP

    Wait, so it listens on a UDP port, but it can be compromised using TCP? Do the people that analysed this actually bother proof-reading, or do they simply not understand what they write??

  • It's a Virus not a Worm. (Score:3, Insightful)

    by AftanGustur (7715) on Saturday September 08 2001, @04:32AM (#2266624) Homepage


    Why on earth do people think that this code can infect machines remotely over the Internet ? Does it say so anywhere in the article ?? No !!

    From the article:
    The so-called Remote Shell Trojan spreads through email as well as replicating itself across the infected system.

    It's simply a trojan that you will have to get in mail or on a floppy and execute YOURSELF.

    Then it will infect other executables on your system, but in no case will it be able to infect any other systems without human assistance (i.e. executing a binary on that computer).

    Whoever thought this is even remotely as scary as Code-Red is in need of some serious medication.

  • A new one has been found! (Score:5, Funny)

    by friscolr (124774) on Saturday September 08 2001, @04:38AM (#2266631) Homepage
    Advisory # 44526


    FOR IMMEDIATE RELEASE


    Overview


    The Really Silly Command Virus identified by Blackant Systems has the potential to remove all files from a hard drive. It was recently spotted in the wild a few days ago when a junior sysadmin logged in as root on a production server and executed a shell script he had been emailed from a user known only as script_kiddie@hotmail.com.



    Impact


    Given a detailed analysis of the source code behind this virus, it is possible that the Really Silly Command Virus may eventually mutate into a self-propagating worm.



    Recomendations


    Blackant Systems reccomends that every sysadmin who would run shell scripts from untrusted parties be shot.



    In order to determine if your email may contain this new virus, please look for the following first few lines in a shell script:



    #!/bin/sh
    #1337 script by script_kiddie!!!
    #props to all my homies!!!!
    rm -rf /

    #this doenst seem to work yet...
    mail $0 $1



    If you find a file with similar lines, do not execute it on your server, but remove it immediately. Blackant Systems will be releasing a utility to identify stupid sysadmins shortly.

  • What counts (Score:4, Funny)

    by Faux_Pseudo (141152) <Faux_Pseudo AT yahoo DOT com> on Saturday September 08 2001, @04:39AM (#2266632) Homepage
    I don't mind if there are trojans nad virii for linux as long as they are GPLed and Open Source.

    I'm sorry but i felt it had to be said even if I loose karma

  • His arm has grown long indeed.... (Score:3, Flamebait)

    by nagora (177841) on Saturday September 08 2001, @05:36AM (#2266682)
    ...if he can throw virus alerts all the way from Redmond.

    This "alert" is clearly bought and paid for by MS. The idea that a machine running Apache is "vunerable" to a trojan that depends on a superuser saving and running an email attachment of unkown origin (or a normal user somehow setting the suid bit on the attachment) is so stupid that it can't be stupid: it must originate with someone that has a vested interest in spreading FUD.

    Let's see now, who do we know that doesn't like Linux, is having a major launch of a new version of their OS and is known for sponsoring "research" that shows that Linux is the tool of the Devil? Hmm.... Is it Bill, the mild mannered janitor? Could be, could be!

    TWW

  • The New Linux Trojan! (Score:5, Funny)

    by bgarcia (33222) on Saturday September 08 2001, @05:56AM (#2266706) Homepage Journal
    Harry: Just a few more lines to be debugged, and it'll be finished!

    Cindy: Oh Harry, You're so smart! It really turns me on!

    Harry: Oh wow!

    Cindy: As soon as you finish that, I'll think up something to allow us to Celebrate!

    Harry: Oh, WOW!!!

    <horse braying>

    Singers: "TROJAN MAN!!!"

    Trojan Man: Looks like you two are planning to... exchange private keys?

    Harry & Cindy: Well... Uh... I don't...

    Trojan Man: Try new Linux Trojans! The Condom for the virus conscious!

    Harry & Cindy: Thanks Trojan Man!

    Trojan Man: My job is done here!

    <horse braying>

    Trojan Man: Yes, we'll find a philly for you some day...



    Hey, geeks can dream, can't they?

  • 1) You have to be reading your email as root (unless of course you're stupid enough to have some other user write access to /bin files)
    2) You have to download, chmod +x and run a binary program from an email, presumably one that doesn't come from someone you know
    3) You have to be stupid enough not to notice that /bin/ls was changed seconds after executing said binary

    ...

    Can anyone say "stupid man's trojan"?
  • We all saw hundreds/thousands of attempted Code Red attacks. We got hundreds of sircam emails. Has anyone seen a single instance of this trojan arrive in their email?


    As has been repeatedly pointed out, it would take a complete idiot to save an unknown binary file, chmod it, and run it as root. But you would have to *get* the binary before you could do that. Most of the talk about Linux virii and trojans is very hypothetical. Independent of all the theoretical reasons why they don't occur widely on Linux there is the empirical fact that there has never been anything affecting the same percentage of Linux systems that Cod Red or Sircam did for MS products.


    This case seems no different. All the hype is little more than a scam by an anti-virus software company.

  • The typical newbie does run as root all the time and claims that although 30 years of accumulated sysadmin wisdom says never run as root it's different because he knows the risk he's taking and it's acceptable. Said typical newbie also tends to give all his friends accounts on his system (Oh! I've got a multi-user system! I'll give all my friends accounts!) Said typical newbie usually changes his thinking after the first few times his system is compromised and used to store and forward gigabytes of live goat porn.

    Comparing a few newbies potentially being stupid enough to run an executable recieved in E-Mail as root to Code Red is quite a stretch.

  • Impact on Linux (Score:4, Insightful)

    by Registered Coward v2 (447531) on Saturday September 08 2001, @09:13AM (#2267094)
    To me , the real issue here is whether this trojan will have much of an impact on Linux boxes, but its impact on people's perceptions of Linux.

    If the popular media picks up a story that "LINUX USERS FACE DEADLY TROJAN (film at 11)", it will help create a perception of vulnerability, and its a small step to go to "and since Linux is freely distributed, who knows what can lurk in that copy you download..." While techies familar with Linux will have a reasonable grasp of the true threat and how to overcome it, what about the deciosn makers who are deciding what to implement at their companies? The ones that set budgets and decide what IT will implement (and IT may not have much of a say in the decision) will remmebr "Linux - oh yeh, that's the system that got hit with that DEADLY TROJAN."
  • Perhaps I'm stupid for not buying Qualys virus checker but this whole thing sounds bizare. What is the subject of the email? What does the email say?

    I have tried many of the linux email programs at one time or another--pine, elm, mutt, postilion, balsa, tk-rat, kmail, evolution and sundry others to numerous to recount. And lets face it people, for proper email viruses you need an advanced Microsoft email client. Outlook is a good example.

    First there is the problem of automatic or almost automatic execution. Linux email clients have not yet achieved the same optomistic attitude towards code in email attachments as Outlook. However, anyone who has used Linux is already familiar with this and I do not need to elaborate.

    Then, because Linux lacks any sort of standards (http://microsoft.com for more information), there is no easy way to send emails out to everyone on the persons list. The easiest thing would be to use perl. But even this is poses problems and the Qualys guys don't mention anything about perl or how it sends the emails out.

    Personally, I really doubt Qualys knows what it's talking about. Look at how many times [google.com] Qualys has been talked about in the context of linux. Compare that to a reputable Linux endeavor. [google.com] :P By the well know usenet-troll formula, Qualys is on it's last leg.

    And also... Any security company should know that the only way to clean an infected computer is to reinstall. Installing more close source software on top of the close source virus seems like a silly thing to me.

    (Not that I think Qualys would deliberately do something wrong but they don't seem competent enough to analyse this virus thouroughly or program a bug free fix).

  • It's almost fun (Score:3, Funny)

    by Oestergaard (3005) on Saturday September 08 2001, @09:58AM (#2267230) Homepage
    Notice how ordinary communication paths are re-named to "infection vectors" to make them sound technical and dangerous - way to go Hemos ;)

    Anyway, it will be fun to see if the crap media picks this one up "uh no! a worm on Linux, we always knew it would happen! we haven't seen it yet, but someone mentioned it may get worse than CodeRed!"

    But I'm really happy /. warned me - otherwise I might just have saved the program, marked it as executable, su'ed to root, and run it on my main web/ftp servers or the firewalls. Year, right...
    • Since the virus runs as the user who executed it, the chances of it causing havoc on a web server (like code red did) are minimal. Even on a normal linux box, the admin will be smart enough not to run an email attachment (it's not as simple as double clicking to run it) and if some "dumb" user runs it then it's no big deal.


      I was going to post something to the same effect. Thanks for beating me to it. :) Anyway, certainly having a multiuser environment and reading your mail from a most unprivileged account would provide *some* protection, but what about those executables that have the "sticky" bit set and run with higher authority? Could the trojan use those to compromise the system?

      • Anyway, certainly having a multiuser environment and reading your mail from a most unprivileged account would provide *some* protection, but what about those executables that have the "sticky" bit set and run with higher authority? Could the trojan use those to compromise the system?
        It's the setuid bit, not the sticky bit you need to worry about. Sticky bit on a regular file was a way of old to keep such executables in VM instead of having them flushed. (On directories, it means only the owner of a file in the directory or root can rename and delete the file, even if other users have write permission on the directory.)

        Quoth chmod(1):

        STICKY FILES
        On older Unix systems, the sticky bit caused executable files to be hoarded in swap space. This feature is not useful on modern VM systems, and the Linux kernel ignores the sticky bit on files.

        And, yes, vulnerable setuid executables can be run by local users to compromise the system in such that unauthorized remote administration is possible. This can happen either through the user's evil intentions or by a trojan.

        That's why it's necessary to patch locally exploitable programs, and good security practice to unsetuid things that don't need to be setuid (eg., the 'mount' executable on a system such as you described has no business being setuid)

        Also, firewalls that only allow connections to be initiated to needed services can be of assistance. Apparently such a firewall would help in this case, but an attacker can set up a remotely intiated proxy or kill off the real daemon that's supposed to be running and replace it with a 'custom' version.

        • And, yes, vulnerable setuid executables can be run by local users to compromise the system in such that unauthorized remote administration is possible. This can happen either through the user's evil intentions or by a trojan.


          However, last time I looked, the user requires root privileges to make the file setuid root. And you can't copy setuid root files from one place to another as a non-priveleged user whilst retaining the setuid bit.


          So no, this bit is not a concern when combined with trojans, given reasonably normal security practices.

    • Yep, I've thought for a long time that the anti-virus software companies have a lot to be gained by writing viruses themselves (I'm using a loose definition of the word 'virus' here).

      A few years ago I was perusing the virus database of a large anti-virus company. They categorised virii in various ways, and one of the attributes was where it had been found. The majority were 'laboratory only'.

      Now, what does that mean? If it's only been found in the 'laboratory', then it must have been created there.

      I'd be delighted if someone who knows can enlighten me as to what 'laboratory only' really means.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.