Linux and BSD Web Servers at Risk of Sophisticated Mumblehard Infection

Posted by simas on Thursday April 30, 2015 @12:14PM
from the eset.com dept.

( 7 comments | 14 points | on HN )

Re:Linux and BSD Web Servers at Risk of Sophisticated Mumble... by noonespecial on Thursday April 30, 2015 @05:24PM (#9467751)

That pirated copy of DirectMailer that you loaded onto your server also sends spam?! Whoda thunk it?

[ Parent | on HN ]

Re:Linux and BSD Web Servers at Risk of Sophisticated Mumble... by tux1968 on Thursday April 30, 2015 @05:54PM (#9467911)

I know what you're saying... but this is odd:

"... we found that IP addresses hard-coded in the malware are closely tied to those of Yellsoft"

[ Parent | on HN ]

Re:Linux and BSD Web Servers at Risk of Sophisticated Mumble... by cruelfate on Thursday April 30, 2015 @10:01PM (#9468959)

Learned a couple of things from linked research paper like always mount /tmp and /var/tmp as noexec, and some `dig` fu.

[ Parent | on HN ]

Re:Linux and BSD Web Servers at Risk of Sophisticated Mumble... by feld on Thursday April 30, 2015 @10:29PM (#9469053)

noexec can break a lot of things so please be mindful

[ Parent | on HN ]

Re:Linux and BSD Web Servers at Risk of Sophisticated Mumble... by cruelfate on Thursday April 30, 2015 @11:00PM (#9469131)

Ya, was wondering about package install scripts.

[ Parent | on HN ]

Re:Linux and BSD Web Servers at Risk of Sophisticated Mumble... by kjs3 on Friday May 01, 2015 @11:53AM (#9472263)

You can remount those dirs without noexec when you need to do a legitimate install.

[ Parent | on HN ]

Re:Linux and BSD Web Servers at Risk of Sophisticated Mumble... by badalex on Thursday April 30, 2015 @04:37PM (#9467489)

8,500 unique IP addresses during 7 months. How is this not trivial?

[ Parent | on HN ]