Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 25 Nov 2018 18:26:00 -0600
From:      Paul Schmehl <pschmehl_lists@tx.rr.com>
To:        FreeBSD <freebsd-questions@freebsd.org>
Subject:   Re: New Virus that targets *.nix
Message-ID:  <948738C25BB780D76F9A2A5A@Pauls-MacBook-Pro.local>
In-Reply-To: <DM5PR20MB210207A5208820C5F435CC1580D50@DM5PR20MB2102.namprd20.prod.outlook.com>
References:  <DM5PR20MB210207A5208820C5F435CC1580D50@DM5PR20MB2102.namprd20.prod.outlook.com>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
Here's a copy of parts of the "virus": 
<https://vms.drweb.com/virus/?i=17645163>;

1) It uses /bin/bash. Won't work on FreeBSD unless you've aliased /bin/bash 
to /usr/local/bin/bash. Why would you do that?
2) Uses yum and apt-get to installed needed utilities. Neither exists on 
FreeBSD.
3) Uses a number of other commands unique to Linux to run various things. 
Again, won't work on FreeBSD.
4) The script has to be installed on the server, which means the server 
first has to be hacked. At that point, the script is the least of your 
worries since you're already compromised.

Doesn't look like a problem on FreeBSD to me.

--On November 24, 2018 at 3:13:37 PM +0000 Carmel NY 
<carmel_ny@outlook.com> wrote:

> This looks like a particularly nasty virus.
>
> https://www.zdnet.com/article/new-linux-crypto-miner-steals-your-root-pas
> sword-and-disables-your-antivirus/



Paul Schmehl, Retired
As if it wasn't already obvious, my opinions
are my own and not those of my employer.
*******************************************
"It is as useless to argue with those who have
renounced the use of reason as to administer
medication to the dead." Thomas Jefferson
"There are some ideas so wrong that only a very
intelligent person could believe in them." George Orwell




Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?948738C25BB780D76F9A2A5A>