Re:Linux ransomware in the wild
by freedomben on Saturday October 21, 2017 @10:43AM
(#15521979)
I'm not sure I agree with your anlaysis. True the user ran Firefox as root (which is terrible practice), but also had the same problems on a different system that never ran firefox:
> Interesting to note that another system, also a sister, seems to have caught the same, and I can't recall ever having run anything but VirtualBox VMs on that one, it's turned off right now until I figure out a recovery plan, so at least 2 systems to recover, and have one clean one to do so from.
That said, it could easily be explained if SSH private keys weren't encrypted (passphrase protected) and allowed an easy hop from infected to sister. And if somebody is running Firefox as root, it doesn't seem too extreme to assume they might have unencrypted private keys...
So it may just be from running Firefox as root, but it's still possible it could be from other things.
> Interesting to note that another system, also a sister, seems to have caught the same, and I can't recall ever having run anything but VirtualBox VMs on that one, it's turned off right now until I figure out a recovery plan, so at least 2 systems to recover, and have one clean one to do so from.
That said, it could easily be explained if SSH private keys weren't encrypted (passphrase protected) and allowed an easy hop from infected to sister. And if somebody is running Firefox as root, it doesn't seem too extreme to assume they might have unencrypted private keys...
So it may just be from running Firefox as root, but it's still possible it could be from other things.