From owner-freebsd-questions@freebsd.org Mon Nov 26 00:28:52 2018 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 8668F1148234 for ; Mon, 26 Nov 2018 00:28:52 +0000 (UTC) (envelope-from pschmehl_lists@tx.rr.com) Received: from dnvrco-cmomta03.email.rr.com (dnvrco-outbound-snat.email.rr.com [107.14.73.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "Client", Issuer "CA" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id F35027D945 for ; Mon, 26 Nov 2018 00:28:48 +0000 (UTC) (envelope-from pschmehl_lists@tx.rr.com) Received: from [192.168.0.9] ([70.121.63.82]) by cmsmtp with ESMTPA id R4iugiG04WnTiR4iygpqsU; Mon, 26 Nov 2018 00:26:05 +0000 Date: Sun, 25 Nov 2018 18:26:00 -0600 From: Paul Schmehl Reply-To: Paul Schmehl To: FreeBSD Subject: Re: New Virus that targets *.nix Message-ID: <948738C25BB780D76F9A2A5A@Pauls-MacBook-Pro.local> In-Reply-To: References: X-Mailer: Mulberry/4.0.8 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline X-CMAE-Envelope: MS4wfKxc9uX8FNtlHY04m7xfJFOqT8jiS1BRflFRcfj8n/TbNtZGjkW0y687pHeYAivLEIXNrwvyGVtRI2guE7MohhhfMQUwU7RTv4NdKjIGyGN1n6Y7M0Es xBA/A+95xCL36X1JcRAEx1H4EzIBK8cLYL51TWlm+j531T9EDn+X67WXqQIumtBRQnmcpNxPKh4hWg== X-Rspamd-Queue-Id: F35027D945 X-Spamd-Result: default: False [-2.74 / 15.00]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; HAS_REPLYTO(0.00)[pschmehl_lists@tx.rr.com]; FROM_HAS_DN(0.00)[]; R_SPF_ALLOW(-0.20)[+ip4:107.14.73.0/24]; TO_MATCH_ENVRCPT_ALL(0.00)[]; MIME_GOOD(-0.10)[text/plain]; DMARC_NA(0.00)[rr.com]; NEURAL_HAM_LONG(-0.97)[-0.967,0]; RCPT_COUNT_ONE(0.00)[1]; REPLYTO_EQ_FROM(0.00)[]; IP_SCORE(-0.32)[ipnet: 107.14.73.0/24(-0.84), asn: 7843(-0.67), country: US(-0.09)]; TO_DN_ALL(0.00)[]; MX_GOOD(-0.01)[dnvrco-cmedge01.email.rr.com,dnvrco-cmedge02.email.rr.com]; NEURAL_HAM_SHORT(-0.17)[-0.173,0]; RCVD_IN_DNSWL_NONE(0.00)[231.73.14.107.list.dnswl.org : 127.0.5.0]; NEURAL_HAM_MEDIUM(-0.97)[-0.971,0]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; RCVD_TLS_LAST(0.00)[]; ASN(0.00)[asn:7843, ipnet:107.14.73.0/24, country:US]; RCVD_COUNT_TWO(0.00)[2] X-Rspamd-Server: mx1.freebsd.org X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Nov 2018 00:28:52 -0000 Here's a copy of parts of the "virus": 1) It uses /bin/bash. Won't work on FreeBSD unless you've aliased /bin/bash to /usr/local/bin/bash. Why would you do that? 2) Uses yum and apt-get to installed needed utilities. Neither exists on FreeBSD. 3) Uses a number of other commands unique to Linux to run various things. Again, won't work on FreeBSD. 4) The script has to be installed on the server, which means the server first has to be hacked. At that point, the script is the least of your worries since you're already compromised. Doesn't look like a problem on FreeBSD to me. --On November 24, 2018 at 3:13:37 PM +0000 Carmel NY wrote: > This looks like a particularly nasty virus. > > https://www.zdnet.com/article/new-linux-crypto-miner-steals-your-root-pas > sword-and-disables-your-antivirus/ Paul Schmehl, Retired As if it wasn't already obvious, my opinions are my own and not those of my employer. ******************************************* "It is as useless to argue with those who have renounced the use of reason as to administer medication to the dead." Thomas Jefferson "There are some ideas so wrong that only a very intelligent person could believe in them." George Orwell