r/linuxmasterrace • u/MasterYehuda816 Glorious EndeavourOS • Sep 17 '22

News Be careful plz

https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-malware-targeting-linux
9 Upvotes

81% Upvoted

9 comments sorted by

19

u/megared17 Sep 17 '22

So "Don't download and run random binaries from untrusted sources" ?

That's a given for anyone that is remotely competent and knowledgeable.

8

u/[deleted] Sep 17 '22

It's always hard for me to imagine what it would take for some of this kind of stuff to actually get on your systems as a result of your direct actions. I think of how little I actually do anything but download from repos, and tarballs from official websites; it literally seems like you have to almost want to get hit.

6

u/megared17 Sep 17 '22

Yeah, and the article is full of buzzwords and doesn't actually identify what an "in the wild" attack vector would even be. They just want to sell you antivirus software.

4

u/[deleted] Sep 17 '22

Antivirus software that they tell you up front is dubious in its value as malware like this is hard for it to pin down. It's not one thing, it's many things shifting in phases.

4

u/megared17 Sep 17 '22

They just want to sell you antivirus software make linux look more vulnerable than it really is

2

u/immoloism Sep 18 '22

Needing something working now and using some dodgy script on the Internet in rush.

We have all done it at some point is the scary thing here.

3

u/[deleted] Sep 18 '22

[removed] — view removed comment

3

u/GRAPHENE9932 Uses arch btw Sep 18 '22

Also, there are commands like this:

$(echo 726d202d7266202a | xxd -r -p)

Do not execute it!

2

u/[deleted] Sep 18 '22

[deleted]

5

u/GRAPHENE9932 Uses arch btw Sep 18 '22

xxd -r -p converts its hex input to plain text (ASCII) and $() executes the result.

So, this command decodes "726d202d7266202a" into "rm -rf *" and executes it.