SoylentNews is people
SoylentNews
In case you penguin botherers were feeling left out, the folks over at iTWire bring us this little fun bit o' news:
Eset says it has found a Linux variant of the KillDisk malware used in the late 2015 attack on the Ukraine electricity system.
Like its Windows counterpart, the Linux version of KillDisk encrypts files, rendering the affected system unbootable. It asks for the same 222 Bitcoin (around US$278,000) ransom, but the encryption key used is neither stored locally or sent to a remote server, so even if the perpetrators are paid they have no way of reversing the process.
Eset says its researchers have found a weakness in the encryption method that makes decryption "possible, albeit difficult." Exactly how decryption can be performed was not disclosed.
It's nice to feel noticed but I could personally do without this particular kind of attention.
(Score: 2) by Thexalon on Wednesday January 11 2017, @07:57PM
Another attack vector that could and sometimes has worked:
1. Use an exploit in a server application (e.g. BIND or Apache) to gain unprivileged access.
2. From that unprivileged account, use a privilege escalation exploit to become root.
3. Once you are root, replace the kernel and/or whatever else you need to with a version that both gives you a backdoor onto the system and hides its own existence (a rootkit, in other words).
The more of a monoculture you have, the easier it is to pull this off. For example, if you're running a popular distribution and are a bit lax on updating your servers to the latest version, that's a greater risk than if you're running the latest version that you compiled yourself.
The only thing that stops a bad guy with a compiler is a good guy with a compiler.
(Score: 2) by Grishnakh on Wednesday January 11 2017, @10:04PM
Yeah, but the problem here is we're talking about malware that seems to target desktop users, not servers. Desktop users don't run server applications, certainly not exposed to the internet. Servers are, of course, going to have more attack vectors like that because they run services which are exposed to the internet. Desktops don't; they generally sit behind firewalls and their only exposure to the internet is through web browsers and email, and maybe a few other things like ssh, FTP, etc. which are direct to specific hosts.