FBI and NSA Expose New Linux Malware Drovorub, Used by Russian State Hackers (zdnet.com) 72
The FBI and NSA have published today a joint security alert containing details about a new strain of Linux malware that the two agencies say was developed and deployed in real-world attacks by Russia's military hackers. From a report: The two agencies say Russian hackers used the malware, named Drovorub, was to plant backdoors inside hacked networks. Based on evidence the two agencies have collected, FBI and NSA officials claim the malware is the work of APT28 (Fancy Bear, Sednit), a codename given to the hackers operating out of military unity 26165 of the Russian General Staff Main Intelligence Directorate (GRU) 85th Main SpecialService Center (GTsSS). Through their joint alert, the two agencies hope to raise awareness in the US private and public sectors so IT administrators can quickly deploy detection rules and prevention measures.
Re: (Score:1)
He did his best, do not judge too hard.
Re: (Score:1, Troll)
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
The Mueller Reports states explicitly - in plain, small words that even you should be able to understand - that no collusion took place. Whatever foreign interference there was was done for both sides.
Re: (Score:2)
Re: (Score:1)
Allow me to teach you, how to make a citation on Slashdot.
Re: (Score:2)
that no collusion took place. Whatever foreign interference there was was done for both sides.
What an interesting non-sequitur. It is entirely possible for interference to be done for both sides and for there still to be collusion. In fact, there could be collusion without any interference taking place. And there can be interference without any collusion. Having interference for both sides doesn't erase the collusion for one or either.
Re: (Score:1)
" It is entirely possible for interference to be done for both sides and for there still to be collusion. "
And that is exactly what the Mueller Report and the foreign prosecutions that came from the Mueller investigation says happened. Foreign actors interfered on both sides but neither candidate or their campaigns knew about it or helped in any way (i.e. "colluded"). Those responsible were simply trying to cause chaos.
Re: (Score:1)
Please, cite the relevant parts.
Note, that any follow-ups not containing the requested citations will be returned unopened.
Re: (Score:2)
...The investigation culminated with the Mueller Report which concluded that — though the Trump campaign welcomed Russian interference and expected to benefit from it — there was insufficient evidence to bring any conspiracy charges against Trump or his associates. The Report did not reach a conclusion about possible obstruction of justice, citing a Justice Department guideline that prohibits the federal indictment of a sitting president
A Justice Department guideline that was written by William Barr by the way, because William Barr wants the president of your country to be a king.
The report concluded that the Internet Research Agency's social media campaign supported Trump's presidential candidacy while attacking Clinton's, and Russian intelligence hacked and released damaging material from the Clinton campaign and various Democratic Party organizations.
Re: (Score:1)
You're citing Wikipedia, not Mueller's report, which — according to DogDude [slashdot.org] — "confirmed" Russian collusion.
You've used up your sole free reply. Further follow-ups not containing the requested citation(s) will be returned unopened.
Re: (Score:2)
Find me some evidence!
No, not that evidence!
Lalala! I can't hear you!
Idiot.
Re: (Score:2)
I break it down for you:
Dogdude: "Russian collusion was confirmed by the Mueller investigation"
Mi: "Please, cite the relevant parts."
You: "Wikipedia! DOJ guidelines!! MY FEELINGS!!!" (Where is the Muller investigation?)
It is simple: Muller specifically investigated the claims of Russian collusion, but in the end his report could not confirm them. Wikipedia did not. The DOJ guidelines neither.
Re: (Score:2)
...The investigation culminated with the Mueller Report which concluded that — though the Trump campaign welcomed Russian interference and expected to benefit from it — there was insufficient evidence to bring any conspiracy charges against Trump or his associates. The Report did not reach a conclusion about possible obstruction of justice, citing a Justice Department guideline that prohibits the federal indictment of a sitting president
The report concluded that the Internet Research Agency's social media campaign supported Trump's presidential candidacy while attacking Clinton's, and Russian intelligence hacked and released damaging material from the Clinton campaign and various Democratic Party organizations.
Or was that too hard?
Not sure what my feelings have to do with anything.
Re: (Score:2)
Is it hard to understand that he wanted the actual citations from the report and _not_ some random interpretations that fit a given narrative?
For example:
Russian intelligence hacked and released damaging material from the Clinton campaign and various Democratic Party organizations
is a false statement, regarding the Muller report.
Re: (Score:2)
That is the actual report. Its a PDF, but it is searchable.
At the sametime that the IRA operation began to focus on supporting candidate Trump in early 2016, the Russian government employed a second form of interference: cyber intrusions (hacking)and releases of hacked materials damaging to the Clinton Campaign. The Russian intelligence service known as the Main Intelligence Directorate of the General Staff of the RussianArmy (GRU) carried out these operations.
Is a quote from the executive summary. Page 4.
You can find your own references from there, if you want.
Drovorub? (Score:5, Funny)
Sounds like a muscle cream.
Re: (Score:1)
Re: (Score:3)
it really doesn't - the rub part is pronounced as roob, but shorter.
the whole word is either a kenning for a lumberjack or a splitting axe.
probably a bilingual pun about hacking.
Re: (Score:2)
they recommend linux-3.7 or newer (Score:5, Informative)
Re: (Score:1)
Don't spoil. Let axe-handlers enjoy. They tried so hard.
Re: (Score:2, Informative)
Re: (Score:1)
11g (Score:2)
Yes, this is still in extended support.
$ uname -r
/etc/redhat-release /etc/oracle-release
/nolog
2.6.18-419.0.0.0.2.el5PAE
$ cat
Red Hat Enterprise Linux Server release 5.11 (Tikanga)
Oracle Linux Server release 5.11
$ $ORACLE_HOME/bin/sqlplus
SQL*Plus: Release 11.2.0.4.0 Production on Fri Aug 14 13:32:43 2020
Copyright (c) 1982, 2013, Oracle. All rights reserved.
SQL>
Re: (Score:2, Informative)
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
Um, yo, CentOS 7 (RHEL 7), current kernel, which I just updated last night, is 3.10.
I love seeing all the white wing trolls, complaining about slashdot not being news for nerds.
So, what are they recommending to try to detect the malware? The one thing I saw in the article has it using mysql, so does that mean that if mysql isn't running, or is not installed, the malware can't run?
Re: they recommend linux-3.7 or newer (Score:2)
Oracle Linux has newer kernels than Red Hat (Score:2)
The Unbreakable Enterprise Kernel is supported on RedHat. It also works on CentOS.
$ rpm -qa | grep ^kernel | sort
kernel-3.10.0-1127.18.2.el7.x86_64
kernelcare-2.32-1.el7.x86_64
kernel-devel-3.10.0-1127.18.2.el7.x86_64
kernel-headers-3.10.0-1127.18.2.el7.x86_64
kernel-tools-3.10.0-1127.18.2.el7.x86_64
kernel-tools-libs-3.10.0-1127.18.2.el7.x86_64
kernel-uek-5.4.17-2011.5.3.el7uek.x86_64
kernel-uek-devel-5.4.17-2011.5.3.el7uek.x86_64
They also return support for many drivers that RedHat removes, both drive
Re: (Score:2)
-rwxr-xr-x. 1 root root 6761064 Jul 26 11:31
Kernel 3.7 - 2012 (Score:3, Interesting)
Wow, THANK YOU FBI and NSA for being so TRANSPARENT and HELPFUL to tell us about something the Linux kernel resolved 8 years ago.
Maybe in 2028 you'll tell us what threats we're facing today, you useless fucks.
E
Re:Kernel 3.7 - 2012 (Score:5, Insightful)
You are aware that linux is embedded in a lot of devices, not just your computer, right? There's tons of equipment out there from home routers to printers to IoT devices that are plugged into the net and never getting an update?
So sure, a modern desktop is likely not going to be running such an old kernel. But what about that camera you just plugged in? Or your internet provider's hardware sitting between you and the net?
Re: (Score:1, Insightful)
You are aware that you can't upgrade most IoT kernels, right?
You were in SUCH A RUSH to correct me, because slashdot.
Next time focus on the meat, not how to show yourself to be smarter because you found an edge case, junior.
E
Re:Kernel 3.7 - 2012 (Score:4, Insightful)
Both of you are right and wrong. (kids etc)
Why don't we all focus on securing our systems and those of our nearest and dearest, if we have the skills.
I have an awful lot of of equipment running on my home and work and my customer's networks that might be considered a bit IoT. However those devices such as cameras etc are on their own VLANs. At home I have two IoT VLANS: THINGS and SEWER. Sewer is for those devices I am really, really scared of!
No doubt my firewalls may have some snags somewhere but I do not allow access to the GUI from just anywhere. I generally allow a minimal access except for icmp echo request and a few other icmp things that are handy. You can ping me and DOS me but you probably wont get in.
Must work on that probably thing ...
Re: (Score:2)
You are aware that you can't upgrade most IoT kernels, right?
You were in SUCH A RUSH to correct me, because slashdot.
Next time focus on the meat, not how to show yourself to be smarter because you found an edge case, junior.
E
Sure you can. Once you learn about the threat, You unplug the bad device and replace it with a new one that doesn't have that threat exposure. Otherwise, you throw it in the trash.
Re: (Score:2)
My reply wasn't posted as a rush, nor because of slashdot, nor did it ignore the "meat" of your original post.
You were trying to say the FBI and NSA were late to the game pointing at kernel vulnerabilities 8 years ago.
As if it was not at all a current problem or concern to any person, business or government entity, that 3.7 kernel series is not going to be found anywhere in the wild.
And I'm sorry if you think that routers, switches, gateways, cable/fiber/etc modems using some version of Linux are all consid
Re: (Score:1)
You know the way the system works. They project, the projection here an announcement by the NSA that they are no longer using that vector for attacks and are now closing it but Russia, Russia, Russia (as they are no longer using it, they warn people about it, they very people they were attacking surreptitiously). So now they are using a different vector to attack Linux servers, which they will announce when they stop using it, that 'er' 'um', the Chinese, yes, this time the Chinese are using it and the Iran
Quick Check (Score:5, Informative)
My goodness, a stack of articles, press releases , FAQ's and a 40-page advisory.
Check your machines quickly before GRU pushes out an update:
https://bfccomputing.com/quick... [bfccomputing.com]
Re: (Score:3)
Thank you for the simple instructions. Much obliged. +1, Informative.
Best post this story.
Re: Quick Check (Score:2)
I'm just glad the nightmare is over (Score:1)
Re: (Score:2)
Previet, tavarish!
New strain of Linux malware ? (Score:1)
“The two agencies say Russian hackers used the malware, named Drovorub, was to plant backdoors inside hacked networks”
slashdot: enough with this neocon cyber BS. And you're quiting zdnet, zdnet
Re: (Score:1)
ninjas
Re: (Score:2)
How does this âoenew strain of Linux malwareâ get onto your computer without clicking on a malicous URL or opening a malicous email attachment?
There have been remote root holes on Linux systems before.
You're right that not mentioning this is bullshit, though.
Kernel 3.7 (Score:2)
I'm curious how much is still running on Linux 3.6 or earlier. I imagine the big issue is routers and switches that never get updated.
vector (Score:1)
Drovorub (Score:3)
Drovorub sounds like the happy ending you get from a Russian masseuse. I suspect it doesn't have a happy ending, though.
AIDE (Score:2)
Re: (Score:2)
If you are running an old enough Linux Kernel for this exploit to work, you are either running an embedded system you can't install AIDE on, or you really should have updated your system sometime in the last 8 years ...
Re: (Score:2)
I don't believe you. (Score:2)
Like I would believe anything the fbi or nsa say. They probably developed it themselves but have since come up with something better so are using it in another anti-russia campaign.