is Linux.DDoS.93 unable to work?

is Linux.DDoS.93 unable to work?

[ng0]

https://vms.drweb.com/virus/?_is=1&i=8598428

As far as I see it, Guix as GuixSD and systems with just Guix but with
software/files which is coming from Guix assumed by this trojan to exist in
'normal' locations should not be able to get infected,
is this observation correct? I did not feel like this is a case which
should go to the -security list, as it's a general question.

Re: is Linux.DDoS.93 unable to work?

[Leo Famulari]

On Fri, Sep 30, 2016 at 05:47:35PM +0000, ng0 wrote:
> https://vms.drweb.com/virus/?_is=1&i=8598428
> 
> As far as I see it, Guix as GuixSD and systems with just Guix but with
> software/files which is coming from Guix assumed by this trojan to exist in
> 'normal' locations should not be able to get infected,
> is this observation correct? I did not feel like this is a case which
> should go to the -security list, as it's a general question.

I don't know what "Linux.DDoS.93" is. Can you copy and paste the
relevant text into an email reply?

Re: is Linux.DDoS.93 unable to work?

[ng0]

Leo Famulari <leo@famulari.name> writes:

> On Fri, Sep 30, 2016 at 05:47:35PM +0000, ng0 wrote:
>> https://vms.drweb.com/virus/?_is=1&i=8598428
>> 
>> As far as I see it, Guix as GuixSD and systems with just Guix but with
>> software/files which is coming from Guix assumed by this trojan to exist in
>> 'normal' locations should not be able to get infected,
>> is this observation correct? I did not feel like this is a case which
>> should go to the -security list, as it's a general question.
>
> I don't know what "Linux.DDoS.93" is. Can you copy and paste the
> relevant text into an email reply?

Oh, sorry. I thought this was obvious from it's name and that I
mentioned it is a trojan.
I got the link to the drweb.com page from https://archive.fo/8LmBS which
is a copy of a short article in softpedia.
The Website I initially linked seems to hold a copy of one version of
the trojan's source code or some relevant/important part of it. Knowing
Germanys weird position on exploits, virus, etc I will not copy anything
from there in the email for my own legal safety.

softpedia quotes:
Dr.Web security researchers, the ones who have discovered this threat,
say the trojan seems to infect Linux machines via the Shellshock
vulnerability, still unpatched in a large number of devices.

The trojan, going by the generic name of Linux.DDoS.93, will first and
foremost modify the /var/run/dhcpclient-eth0.pid file in such a way that
its process is started with every computer boot. If the file doesn't
exist, the trojan will create it itself.


drweb.com:
The Trojan for Linux designed to carry out DDoS attacks. It is spread
presumably via ShellShock vulnerabilities.

At launching, it checks for the presence of
/var/run/dhcpclient-eth0.pid. file. If the Trojan cannot find this file,
it attempts to register itself in autorun.

-- 

Re: is Linux.DDoS.93 unable to work?

[Leo Famulari]

On Fri, Sep 30, 2016 at 06:19:17PM +0000, ng0 wrote:
> > On Fri, Sep 30, 2016 at 05:47:35PM +0000, ng0 wrote:
> >> https://vms.drweb.com/virus/?_is=1&i=8598428
> >> 
> >> As far as I see it, Guix as GuixSD and systems with just Guix but with
> >> software/files which is coming from Guix assumed by this trojan to exist in
> >> 'normal' locations should not be able to get infected,
> >> is this observation correct? I did not feel like this is a case which
> >> should go to the -security list, as it's a general question.

I'd like <guix-security@gnu.org> to be used for bugs that must be
reported privately. This choice is up to the bug reporter. If a bug is
already known publicly, we should discuss it openly on guix-devel.

> softpedia quotes:
> Dr.Web security researchers, the ones who have discovered this threat,
> say the trojan seems to infect Linux machines via the Shellshock
> vulnerability, still unpatched in a large number of devices.

If the attack vector is the Bash Shellshock bug (CVE-2014-6271), then we
should be safe. As far as I can tell, we patched our Bash package
against that vulnerability with "gnu: bash: Apply patch series up to 25
[CVE-2014-6271]." (c1fe82d5866b).

Is there something else we need to worry about here?