Felix Miata wrote:

On 2012/09/01 00:03 (GMT-0400) Greg Freemyer composed:

...

http://www.forbes.com/sites/anthonykosner/2012/08/31/new-trojan-backdoor-mal...

...

Is openSUSE susceptible?

That page says to block IP 212.7.208.65. How does one "block" an IP?

How about: iptables -A INPUT -s 212.7.208.65 -j DROP iptables -A INPUT -d 212.7.208.65 -j DROP -- Per Jessen, Zürich (10.9°C) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

"Cristian Rodríguez" wrote:

El 01/09/12 02:00, David Haller escribió:

...

WTF? ONE specific IP in a virus? That resolves to a polish operated host in the Netherlands attached to a router in the Netherlands? (c.f. 'whois 212.7.208.65' and 'traceroute 212.7.208.65' and a whois on the second to last hop).

And _NOTHING_ about method of attack / propagation??? Via Flash / JS^WECMA Script / Java / browser-specific bugs, or whatever???

Fishy!

I'd stay wary and follow this a bit, watch CERT announcements etc., but it has a more than just a hint of a hoax / scareware ...

Looks like a pretty amateurish thing to use one IP address

Most malware has a series of backup IPs. But modern malware uses internal encryption to hide its internal info such as backup command and control IPs. Static analysis/disassembly can be almost useless in trying to find the backup IPs. Better is to let it run, then get a memory dump. But the bad guys know this, so they only unencrypt functionality and data as they need it. Malware analysts in turn use VMs to fake out the malware (using fake clocks etc.) and try to trigger the malware to use additional functionality/data. The malware writers work hard to detect the malware is being analysed and shutdown. A friend of mine has estimated 80% of malware in 2011 looked to see if it was running in a VM and terminated itself if it was. That only one IP is provided likely just means the virus writer was better than the anlysis tools used to analyse it. As to where the IP is, that means little. Bad guys typically hack systems around the world and then use them as command and control systems. Greg -- Sent from my Android phone with K-9 Mail. Please excuse my brevity. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 09/02/2012 08:17 AM, Felix Miata wrote:

On 2012/09/02 08:02 (GMT-0400) Greg Freemyer composed:

...

As to where the IP is, that means little. Bad guys typically hack systems around the world and then use them as command and control systems.

So maybe the best thing to do until someone comes up with a better idea is to create ~/WIFIADAPT and ~/ WIFIADAPT and make them inaccessible with chmod 000 and/or chattr +i?

Is there something I'm missing here. In order for this malware to work wouldn't the user have to enter the admin password? Surely even the greenest Linux user would know that if they aren't intentionally installing something they don't enter the admin password for something to install. -- A veteran is someone who, at one point in their life, wrote a blank check made payable to ‘The United States of America’ for any amount, up to and including their life. _ _... ..._ _ _._ ._ ..... ._.. ... .._ -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Felix Miata wrote:

So maybe the best thing to do until someone comes up with a better idea is to create ~/WIFIADAPT and ~/ WIFIADAPT and make them inaccessible with chmod 000 and/or chattr +i?

Or perhaps link them to /dev/null. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Sat, Sep 1, 2012 at 3:15 AM, Christofer C. Bell wrote:

On Fri, Aug 31, 2012 at 11:03 PM, Greg Freemyer wrote:

...

http://www.forbes.com/sites/anthonykosner/2012/08/31/new-trojan-backdoor-mal...

Is openSUSE susceptible?

In a nutshell, if you are using Oracle Java 7, then yes. If you are using any version of OpenJDK, or any other version of Oracle Java (other than 7), then no.

Good luck!

-- Chris -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Guys, A couple things. You can do the iptables as stated. Or you can use route route -v add -host 212.7.208.65 reject inferno:~# route -v add -host 212.7.208.65 reject inferno:~# route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 212.7.208.65 - 255.255.255.255 !H 0 - 0 - Here are some tips to search for it find / -name WIFIADAPT netstat -tap | grep 212.7.208.65 But to be honest, the people that -- Terror PUP a.k.a Chuck "PUP" Payne (678) 636-9678 ----------------------------------------- Discover it! Enjoy it! Share it! openSUSE Linux. ----------------------------------------- openSUSE -- en.opensuse.org/User:Terrorpup openSUSE Ambassador/openSUSE Member Community Manager -- Southeast Linux Foundation (SELF) skype,twiiter,identica,friendfeed -- terrorpup freenode(irc) --terrorpup/lupinstein Register Linux Userid: 155363 Have you tried SUSE Studio? Need to create a Live CD, an app you want to package and distribute , or create your own linux distro. Give SUSE Studio a try. www.susestudio.com. See you at Southeast Linux Fest, June 8-10, 2012 in Charlotte, NC. www.southeastlinuxfest.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org