An In-depth Analysis of Linux/Ebury

http://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/

 

http://www.welivesecurity.com/2014/...er-side-credential-stealing-malware-campaign/

 

http://www.welivesecurity.com/2014/03/18/attack-unix-operation-windigo/

 

Thanks, SweX, I'll make sure some people I know see this.

 

You're welcome GJ

 

Malware Attack Infected 25,000 Linux/UNIX Servers

http://blog.eset.ie/2014/03/18/oper...000-unix-servers-hijacked-by-backdoor-trojan/

 

http://blog.sucuri.net/2014/03/windigo-linux-analysis-ebury-and-cdorked.html

 

10,000 Linux servers hit by malware serving tsunami of spam and exploits.

-- Tom

 

Lovely. I would hope that all the presumably stolen credentials have been revoked by now...

 

Re: Malware Attack Infected 25,000 Linux/UNIX Servers

From *ESET Ireland* - >
OPERATION WINDIGO: Malware Used To Attack Over 500,000 Computers Daily After 25,000 UNIX Servers Hijacked By Backdoor Trojan

From Dan Goodin at ARS (more or less a re-hash of the above with some embellishment)
http://arstechnica.com/security/201...malware-serving-tsunami-of-spam-and-exploits/

 

I'd say, it's the mother of all malware if it can infect people.
(Couldn't resist, )

edit: On topic, gruesome infection but the initial vector was rather simple, password theft.

 

Re: Malware Attack Infected 25,000 Linux/UNIX Servers

The Linux security spell is broken

http://www.infoworld.com/t/cringely/the-linux-security-spell-broken-238717

 

Ick. Where to start...

- Linux has never been truly secure on desktops *or* servers; just more secure than some of the competition, some of the time.

- Linux is still pretty safe from desktop malware. That is completely different from being theoretically secure in any way.

- There have been compromised Linux servers galore for ages.

- If a server is compromised by brute-forcing the SSH password from a remote IP, that is purely the sysadmin's fault. (In fact that juxtaposition of the words "SSH", "password", and "remote" should set off alarm bells right away.)

 

Re: Malware Attack Infected 25,000 Linux/UNIX Servers

Linux and botnets: It's not Linux's fault!

http://www.zdnet.com/linux-and-botnets-its-not-linuxs-fault-7000027538/

 

Re: Malware Attack Infected 25,000 Linux/UNIX Servers

Attackers Picking Off Websites Running 7-Year-Old Unsupported Versions of Linux

http://threatpost.com/attackers-pic...year-old-unsupported-versions-of-linux/104957

 

Ars Technica and Cisco Provide Another Example of Bad Security Reporting link

Big quote, it's all there.
No, linux isn't perfect, impenetrable, 100% safe etc but the Cisco blog and ensuing article(s) are at least dubious.

edit;
Information on Cisco Blog has been corrected.
Lots of text about linux/linux kernel 2.6 striked link

 

http://www.welivesecurity.com/2014/04/10/windigo-not-windigone-linux-ebury-updated/

 

http://www.eset.com/int/about/press...r-windigo-paper-at-virus-bulletin-conference/

 

Operation Windigo: “Good job, ESET!” says malware author

http://www.welivesecurity.com/2014/10/15/operation-windigo-good-job-eset-says-malware-author/

 

Malware coders adopt DevOps to target smut sites

http://www.theregister.co.uk/2015/01/12/linux_vxers_hit_devs_where_it_hurts_p0rn_sites/