"Linux users targeted by password-stealing Wirenet Trojan"

onebuck · 09-03-2012, 09:48 AM

Hi,

Linux users targeted by password-stealing Wirenet Trojan is a article that some may find interesting;

Quote:

Malware writers are interested in Linux after all. Russian security firm Dr Web has reported finding a shadowy Trojan that sets out to steal passwords on the open source platform as well as OS X.
Technical details of Wirenet.1’s operation and technique for spreading are sparse for now, but the company reports that the backdoor program targets browser passwords for Opera, Firefox, Chrome, Chromium, and as well as applications such as Thunderbird, SeaMonkey, Pidgin.

Dr Web has reported;

Quote:

The first Trojan in history to steal Linux and Mac OS X passwords August 22, 2012
Russian anti-virus company Doctor Web is reporting the emergence of the first cross-platform backdoor to run under Linux and Mac OS X. This malicious program is designed to steal passwords stored by a number of popular Internet applications. BackDoor.Wirenet.1 is the first such Trojan capable of running under any of these operating systems.
It's not clear yet how the Trojan, which was added to the Dr.Web virus database as BackDoor.Wirenet.1, spreads. This malicious program is a backdoor that can work under Linux as well as under Mac OS X.
When launched, it creates its copy in the user's home directory. The program uses the Advanced Encryption Standard (AES) to communicate with its control server whose address is 212.7.208.65.

Hopefully users/members will read the above linked pages.

Other useful links in Links for Helpful Linux articles & books

jefro · 09-03-2012, 10:55 AM

Cross platform may be only because of an issue that is common to these. "Opera, Firefox, Chrome, Chromium, and as well as applications such as Thunderbird, SeaMonkey, Pidgin." And that the call or program is calls is in both OSx and Linux. So the issue is more the applications are at fault.

GazL · 09-03-2012, 11:10 AM

The H article on this is worth a read:
http://www.h-online.com/security/new...n-1697425.html

Don't think there is much to worry about for anyone who follows sensible precautions.

H_TeXMeX_H · 09-03-2012, 12:58 PM

Quote:

Originally Posted by GazL

The H article on this is worth a read:
http://www.h-online.com/security/new...n-1697425.html

Don't think there is much to worry about for anyone who follows sensible precautions.

That describes much better what it is. It is interesting, but I'm not sure it is a major threat. I can't find whether clamav detects it or not.

NyteOwl · 09-03-2012, 01:56 PM

Habitual · 09-03-2012, 03:38 PM

Quote:

Originally Posted by H_TeXMeX_H

...I can't find whether clamav detects it or not.

Seems not.
https://www.virustotal.com/file/1c4b...is/1346436576/

dugan · 09-03-2012, 04:31 PM

Previous thread:
http://www.linuxquestions.org/questi...ux-4175425165/

Gazl: Thanks for posting the H article. Before I read it, I was ready to dismiss this as an outright lie fabricated by DrWeb. If every story I read about this "malware" used DrWeb as its source, what else was I supposed to conclude?

onebuck · 09-03-2012, 06:20 PM

Hi,

Personally, I believe that everyone should be aware of potential problems instead of sticking their heads in the sand. It is just a matter of time before someone will take advantage of someone using OSX or a Gnu/Linux. Protection is very important no matter which OS you are using. The old thought was that Gnu/Linux is safe. We are aware of rootkits and now the possibilities of malware via our browsers.

Users should be careful and set their systems up securely and use good password protections along with good system practices.

The presented sites do have some questionable information but we should not flat out ignore. Verify it! No FUD.

H_TeXMeX_H · 09-04-2012, 12:44 PM

It's too bad clamav can't detect it. Any other way to detect it ?

sundialsvcs · 09-04-2012, 01:13 PM

Onebuck's comments deserve to be read and re-read dozens of times. Bear in mind that the most easily-exploited computer around is the one that's located in-between two earlobes. But you can very easily stymie any sort of rogue program simply by exercising a thimble-ful of common sense ... which is the one thing that "wetwear" (i.e. your brain) has in abundance, of which a digital computer has none at all.

ReaperX7 · 09-06-2012, 10:08 PM

Hmmm...

k3lt01 · 09-06-2012, 10:27 PM

Quote:

Originally Posted by sundialsvcs

Onebuck's comments deserve to be read and re-read dozens of times. Bear in mind that the most easily-exploited computer around is the one that's located in-between two earlobes. But you can very easily stymie any sort of rogue program simply by exercising a thimble-ful of common sense ... which is the one thing that "wetwear" (i.e. your brain) has in abundance, of which a digital computer has none at all.

+1 common sense is the key. Ignoring things or, on the opposite end of the scale, spreading FUD does not help anyone.

rootaccess · 09-09-2012, 05:59 AM

No offense but I believe developers of this trojan sure are laughing at posts/mentality of people inquiring of antivirus programs such as ClamAV being able to detect it. Let's face it. Unix, being the first OS has been compromised, I believe, since the 80s, when rootkits began. Or was it the early 90s. Either way, there is no such thing as security..anywhere, even physical security...just LAYERS of security. The more layers, the harder it is to get in. In the past, we didn't have internet browsers and GUIs. Unix was just a terminal, offering whatever application that ran on there. Now its Linux. Its better but the end user is now able to become root since everyone owns a laptop and/or a desktop. Back then there was only 1 main machine being root with no internet browsing, GUI, etc and that was hard to compromise but not impossible. If you are an end user using Linux as a desktop, it's not all different than windows when browsing/downloading. Assume you will get a trojan or a rootkit installed without warning. That's my mentality. Even banks get hacked and they probably have the most secure system around so i doubt your latest ubuntu, centos or debian GUI is any safer.

Are you afraid now? Were you hoping Linux would never get hacked? The question is...what do YOU have that attackers want? Credit cards? Bank info? The real solution is..to mitigate these possible areas of interest the other way. Don't bank online. Disable debit/ATM cards linked to your main account. Don't allow outbound transfers without first contacting you. Add some additional security to your accounts. Open another bank account with a debit card, and keep 1-2k in it MAX, depending on your level of finance. If you're rich and spend $100k a day, you shouldn't be reading this in the first place. I had an unauthorized charge on my card and I thought I was super secure. Guess what? You swiped that card at the gas station or grocery store? It was the guy at the gas station or grocery store who stole your identity, used your card fraudulently or whatever. We have too much technology and way too many hackers. Criminals moved from the streets to the computers. If you have EXTREMELY sensitive MILITARY/GOVT stuff on your computer, it shouldn't even be connected to the internet to begin with!