Ransomware now targetting Linux servers

Kropotkin · 11-09-2015, 02:46 AM

Hi all,

There is a new blog post by Brian Krebs about how ransomware is now targetting Linux servers, and he refers to a case of a site that was attacked via a Magento vulnerability:

Quote:

This latest criminal innovation, innocuously dubbed “Linux.Encoder.1” by Russian antivirus and security firm Dr.Web, targets sites powered by the Linux operating system. The file currently has almost zero detection when scrutinized by antivirus products at Google’s Virustotal.com, a free tool for scanning suspicious files against dozens of popular antivirus products.

Typically, the malware is injected into Web sites via known vulnerabilities in site plugins or third-party software — such shopping cart programs. Once on a host machine, the malware will encrypt all of the files in the “home” directories on the system, as well backup directories and most of the system folders typically associated with Web site files, images, pages, code libraries and scripts.

http://krebsonsecurity.com/2015/11/r...our-web-sites/

I get the feeling that Krebs doesn't know much about Linux, as in when he refers to the malware needing "administrator" access to the OS to work. Aside from terminology, who runs Apache as root anyway? I would be interested in hearing from others here who have more Linux-specific experience with security on the issues related to malware that targets Linux OS.

Thanks

berndbausch · 11-09-2015, 02:52 AM

From the article:

Quote:

ramsomware infected a server used professional Web site designer Daniel Macadar

and

Quote:

Macadar was behind on backing up the site and the server

I guess there is something we can learn from this.

EDIT: It's true that the article mentions the need for good backups. But a "professional website designer" that runs a web shop should know this.

Kropotkin · 11-09-2015, 03:19 AM

Well, it seems that not only was Macadar behind on backups, he was also behind in applying security updates to Magento, also a real no-no.

allend · 11-09-2015, 03:47 AM

From https://news.drweb.com/show/?i=9686&lng=en

Quote:

Once launched with administrator privileges, the Trojan dubbed Linux.Encoder.1 downloads files...

Same old story, the bad actor needs root.

Sefyir · 11-11-2015, 03:32 PM

Quote:

It’s worth noting that the malware requires the compromised user account on the Linux system to be an administrator; operating Web servers and Web services as administrator is generally considered poor security form, and threats like this one just reinforce why.

Worth noting? I'd say so. It's the theme of every linux "exploit".

This reminds me of users who "fix linux problems" by chmod -R 777 everything or run everything as root.

As for backing up, there shouldn't be "getting behind". They should always be automatic.

Quote:

However, not everything worked the way it should have.

You can say that again.. the person in this example paid the decryption - reinforcing more of this in the future.

Habitual · 11-11-2015, 03:39 PM

Linux Ransomware Debut Fails on Predictable Encryption Key

metaschima · 11-15-2015, 11:51 AM

Quote:

We realized that, rather than generating secure random keys and IVs, the sample would derive these two pieces of information from the libc rand() function seeded with the current system timestamp at the moment of encryption. This information can be easily retrieved by looking at the file’s timestamp. This is a huge design flaw that allows retrieval of the AES key without having to decrypt it with the RSA public key sold by the Trojan’s operator(s).

Classic. Well, this is not the first time crypto ransomware designers have done this. Clearly and luckily, most of them are amateurs.