Re:HiddenWasp Malware Stings Targeted Linux Systems
by jorangreef on Saturday June 01, 2019 @01:04AM
(#20067350)
If your email firewall allows random .sh attachments, then you are vulnerable to at least two attacks:
1. Someone targets you specifically, knowing you are a software developer, by impersonating a trusted third-party contact and sending you a ZIP attachment with the contents of an open source project you are known to work on. ZIP attachments preserve the executable bit, and you wouldn't see any .sh extension because it would be an extension-less shell script. It would probably just look like a binary you are used to clicking.
2. Someone impersonates a trusted third-party contact, sending you a ZIP attachment with a symlink traversal to overwrite your .bashrc as soon as you unzip the attachment with a double-click, or as soon as unpatched middleware unzips it for you.
1. Someone targets you specifically, knowing you are a software developer, by impersonating a trusted third-party contact and sending you a ZIP attachment with the contents of an open source project you are known to work on. ZIP attachments preserve the executable bit, and you wouldn't see any .sh extension because it would be an extension-less shell script. It would probably just look like a binary you are used to clicking.
2. Someone impersonates a trusted third-party contact, sending you a ZIP attachment with a symlink traversal to overwrite your .bashrc as soon as you unzip the attachment with a double-click, or as soon as unpatched middleware unzips it for you.