Linux Ransomware

This, kids, is why distros audit their packages and tell you that you may be hacked if you use something external

[@nathanlamaire]

Sometimes even official repo can be hacked, it just have to happen much less likely. Linux Mint had the experience that hacker successfully hacked a main server and serve malicious disk images, luckily moderator found out in 2 hours (IIRC) and put them down. Some of Git server were hacked, or owner had intentionally added malicious code to the repo.

@@nathanlamaire yes, Mint had the entire ISO hacked lol

[@shoukokomi8081]

@ you mean the website? that happen years ago? try to research dumb wincrap user

[@shoukokomi8081]

@@szymex8341 Oh yes I know but the problem only last for hours not even a day

[@pyxl77]

having all files on home folder encrypted (as long as you have your backup) is better in comparing to unseen threat and malicious software running on background like what happend on windows. I'm not afraid of malicious program on linux.

[@FakhryHTatanaki]

Never assume any system is perfectly secure, the sys admin also has a great responsibility to ensure that a system is secure because no matter how secure your OS is, bad practices (like mindlessly giving programs high privileges, downloading from untrusted sources, leaving unused services open, running outdated software, etc.. ) will lead to trouble.

[@ashwinrawat9622]

Thats Fakhing true.

[@tobznoobs]

as I've said before, part of my job was to delete viruses from CentOS servers, and we also got a ransomware 10 yrs later in another company, and it targeted a linux fileserver and windows sap server. all those who say linux doesn't get infected are pseudo techie guys who have not dealt with linux servers in their lives.

[@pikaa-si9ie]

Just use temple OS for your server

[@Masaliantiikeri]

Have you ever heard of Linode or KernelCare?

[@superslimanoniem4712]

Everything gets infected at some point, but it's probably more rare than windows viruses

[@stefansuch1588]

A lot of people presumably don't write viruses for Linux because there are a lot of people who don't use it, but yeah Linux computers and fileservers can get viruses

[@lilysansetsukonnoriri3612]

@@superslimanoniem4712 it's much more rare because a lot more people uses windows. Wait till linux gets super popular and easier to use, then you'll see more viruses

[@aymanhassan8178]

The reason why linux is called the unhackable os is because 90% of the time your only pkgs are coming from your distro maintainers' server And the other 10% are from building an open source projects.

[@jyow-xe7pw]

Which is why I stick to debian and use official websites when I have to add to the software store. The AUR, I'm sure is fine but when anyone can add packages in, seems like it would be easy for something to "slip through the cracks"

[@IIGrayfoxII]

And those open source projects on Git are easily viewable, you can also view changes done.

[@jyow-xe7pw]

@@IIGrayfoxII I'm not that technically gifted lol

[@MBaltz]

It's wrong I think, look the archlinux with the AUR.

[@jyow-xe7pw]

@Watcher oh ok, I didn't know. Like I said I've been on debian.

[@fatinebadr7244]

as long date user of linux ,you don't need a virus or ransom to break the system, you can easly break the system (if you use wrong command , or inappropriate one ,there also dependecies knowns problems that can sometimes do serious dmg if you try to solve them with wrong commands)

[@nerv4316]

A person who never used Linux for a month talking about Linux users.

[@fatinebadr7244]

@@nerv4316 btw i use arch now, and i don't know what are you talking about, (if i did say something wrong ,feel free to say what wrong )

[@ArmiaKhairy]

@@fatinebadr7244 I believe ```sudo rm /``` used to wipe the system.

[@Cybersharky_]

@Polaris Lakewell d egenerate

[@math001]

You can do that to Windows as well. What are you on about

[@sugaryhull9688]

I can't imagine that this would be likely to affect users installing from official repos

[@giuseppe4870]

Or npm

[@kquote03]

True. However your should always check when updating/installing on a production environment. I dont recall the exact name or event, but some company that used npm got hacked because someone pushed a malicious package to the official repos that had an extremely similar name to another package.

[@daemonace5910]

@Dailox At the end of the day, linux is more "secure" because of the user behaviour tendencies instead of the actual system capability

[@ArthursHD]

They could still find a way in and run it by themselves.

[@kquote03]

@@daemonace5910 I mean if that were true then everyone would be using windows server instead ;)

[@kquote03]

Can you do linux hardening tutorials? (It seems youtube deleted my comment, sorry for posting twice)

[@patricklechner190]

+2

[@tom-mo-]

+3

[@kiiiburn]

Maybe because of the hardening comment...

[@philcooper9225]

@@kiiiburn yeah KZbin is soft

[@alex15095]

I recently found a post on the void linux subreddit about PlagueOS which seems to be an ongoing project to make a hardened Linux distro. It might be interesting to check out

[@markusTegelane]

This is why we say that you should always avoid downloading an executable and running it, whenever possible in Linux

[@daemonace5910]

Because it's much safer to do that in windows?

[@markusTegelane]

@@daemonace5910 No, it's just that it is about as unsafe as doing it in Windows

[@Why72833]

Gets error about musl... I see this as an absolute win

[@superslimanoniem4712]

Yeah, go through trusted repos if possible

[@MaksKCS]

@@markusTegelane yeah just don't use your computer, then you can't get infected...

[@ExtromniaStudios]

How do you not have so much more subs, I’ve been watching you for a very long time, and I think that you deserve more.

[@BoredKevin]

Everyone else talking about cyber security but nobody talks about why he records his videos at 12.00 AM which is almost certainly past his bedtime

[@rajat0610]

maybe he runs a vm and does not set the time, so it looks like he is recording at 00:xx

[@hrsh042]

@@rajat0610 doesn't happen normally

[@orkhepaj]

boring

[@HCG]

Because no one gives a fuck.

[@ygjt76v0-----]

Legend 🤣😅

[@janialander414]

Well of course Linux can run malicious software, it is after all General Purpose Operating System. But...when it comes to that example: First you needed to download that, outside from package repository, not very many Linux users do so...then you needed to set that file executable...and then you needed to run it...and of course from user account having valuable stuff writable for said malware...

[@vaisakh_km]

Or you need to find a zero day.... In a code base which people from around the globe simultaneously missed....

[@raphaelcardoso7927]

It could be in an installation script of something else. A wget then chmod then run

[@janialander414]

@@raphaelcardoso7927 Anyways, you'll need to download stuff from outside source...

[@SnowyRVulpix]

The important thing here is you didn’t run that command as sudo or superuser, meaning the damage it can do is very limited.

[@lilith1504]

Unless some virus can affect to root without password, everything can fix easily

[@injamul]

Ransomware targets user data and user-data exists in non-root directory....

[@speedibusrex]

The command shown in this video was not executed as a superuser, and encrypted the entire home dir of the user.

[@gonzalolog]

Why would be harmful to run it with root when it encrypts YOUR files, if it destroyed OS files, reinstall and you're done

[@deletevil]

Even more important thing was he ran the program in a virtualized Ubuntu. Even with sudo, I suspect zero important files could be damaged.

[@mehdi7586]

keep in mind that this wouldn't be able to encrypt and alter any files outside the home directory of the user that ran the malware, if a user got infected with such malware it won't affect other users, in the case of a server you usually have your database and important files stored outside the home directory, and everyone is advised against using the root user directly or even allowing root login in ssh. so in most cases on you will be fine on a server

[@mehdi7586]

@@regallomo you could do that but it would be cumbersome. I just keep a backup of my important files on an external drive. and yes you can set the file permissions to let you browse the files but not write to them.

[@djvar94]

At the end of the day, security is a concept that comes down to having sense and sensibility in whatever you do in your everyday life. For computers it's about whether or not you trust whatever you downloaded and take it with a pinch of salt. If you steer away from downloading from untrusted sources then you should keep yourself in pretty good shape

[@davehenderson3739]

Yeah don't download software you don't know about and don't go to sketchy sites.

[@5izzy557]

Good Opsec is the best line of defense.

[@Masaliantiikeri]

Good thing we have CoW file systems like BTRFS and ZFS. We can rollback file system changes in between snapshots. Basically it can't encrypt all the datasets unless you have root access.

[@ArthursHD]

Don't be fooled. Where is will there is a solution. Ransomware on Windows often deletes Shadow Copies.

[@ThatLinuxDude]

@@ArthursHD BUT to be fair in Windows it needs Administrator Privileges in order to do so. So it's likely this'll be the case here as well.

[@muhammadnashirakrom2935]

I've question,this ransomware only infected home current user isn't it? It can't infected the whole linux system or home other user? Because linux is modular, in Linux we have file permission(supported by file system') and user level access, and we still input password whenever run command who need access super user level access like sudo. That's point above is not explain in your video? So we have secure Linux system with only remove or disable user who run the Ransomware or infected by it and the system is normal or safe again.

[@KeithBoehler]

This is a good question. I hope it gets answered.

[@malikulamin9948]

theres many stupid peoples saying linux infected by virus, ransomware, in reality they bloody download the file and give root permission...and say linux are vulnerable...

[@dikahadipriyanto1418]

Come to think of it i do not see he is entering password there, could it be he give access to root

[@NiceMicroTV]

running an ELF file with executable permissions on Linux is not surprising. What would be more interesting for us Linux users is how do you get this file, how does it make itself executable, and how does it run itself in a real environment, as I won't just get a random binary file from the internet and run it.

[@ArmiaKhairy]

It could be within a bundle of executable admins use to configure stuff on servers, they may just runn all the executables sequentially in a folder without cheking them first.

[@NiceMicroTV]

@@ArmiaKhairy yeah, but I could literally whip up a bash script in like 20 minutes that encrypts all your data with a random password and leaves a scary message in every folder. The fact that this can be done to a system is not news, especially most Linux systems come with nice default encryption packages. What would be interesting is to see what mechanism does it use to get into the system in the first place. whatever is shown in the video is not even remotely interesting.

[@jasoncravens1124]

@@ArmiaKhairy If that is the case, you have a way bigger problem than that ransomware script. Someone can freely add things to your server. Plus give it execute permissions?

[@creepingmee]

Honestly, if you would do this, you are just as likely to type rm -rf / I mean c'mon....

[@RinksRides]

I tried this command recently... F U LOLZ

[@ReloadedK]

@@RinksRides Please don't force remove anything unless you know exactly what it is. The rm command is to be respected, always

[@gasun1274]

@@ReloadedK i had to delete the xorg conf file with rm once because my DE won't boot with it. i read the guide on how to use it like a medieval monk copying the bible

[@samuelefilice4661]

@@RinksRides never run random commands in Linux, expecially if you run it like an administrator (with sudo or doas or e ven directly by the root account)

[@kylek.3689]

I have now twice typed "rm -rf /*", trying to type "rm -rf ./*"

[@SmallXD]

I love your channel!

[@Tommy-the-coffee-addict]

no system is perfectly secure,but a tip for most users is that to not make any file executable on linux without getting it from a trustable source,and ideally get most,if not all programs from a trusted package manager (APT is really good,the AUR is not so good (the AUR is powerful,but definitely not the most secure)) and not off a browser like on windows.

[@brentsummers7377]

And be careful with using a PPA. Try to do some research into who has written the PPA.

[@jonissesmarchadesch7025]

So the same in Windows then

[@thefoolishgmodcube2644]

AUR is not so good? Does that mean most Arch Linux users are fucked?

[@Tommy-the-coffee-addict]

@@jonissesmarchadesch7025 if windows package managers didn't suck,then yes

[@hihello-tp3wi]

@@thefoolishgmodcube2644 it's quite common for experienced arch users to warn against blindly installing AUR packages. It's fucked if you aren't installing trusted packages

[@Eddy-Cool]

question: how did it work without sudo?

[@joejavacavalier2001]

Besides, clamav, iptables to limit outside connections, only using software from the approved repositories, restricting ssh server access with RSA keys.... What else can you do?

[@devnull6320]

Everything, you got the source code for the kernel. But you need to understand how things works, and thats a huge problem :D

[@aleksic1234]

Route everything through Tor

[@jasoncravens1124]

Look at the code first.

[@joejavacavalier2001]

@@jasoncravens1124 The code to what? The kernel or all the GNU stuff I use on top of the kernel? Um, no

[@jasoncravens1124]

@@joejavacavalier2001 No, not everything, some bullshit suspect file. Like a .elf file that you have acquired "somewhere" and have intentionally marked executable (which he did , and didn't show you) and then manually run from a terminal. You may want to take a look at that first. Point is, you are on it. Because that is what you can do. This would never happen, not ever. What is this, your first day on a linux box? And I don't think it would happen then, either. This is very misleading.

[@GabrielM01]

now run this elf in a packaged snap with no file system permissions

[@aleksic1234]

*exactly*

[@alex15095]

Snap is proprietary software and complete treachery to the open-source community. Use Flatpak instead

[@dikahadipriyanto1418]

As puppy linux user i guess this wont work, we use sfs or pet

[@vaisakh_km]

Or run in a chroot sandbox

[@GabrielM01]

@@vaisakh_km even better

[@GC-qe8vc]

I would expect the Security Channel to explain the difference between privillege escalation and a script that operates with regular user privilleges. When malware by the same name encrypts an entire computer under Windows vs the user's home folder under Linux, then claiming "there's no difference" is misleading and false. And the message "Linux gets malware too" even if well-intentioned, ends up being the good old FUD tactic of closed-source companies (a term coined when Microsoft's official strategy towards Linux was to spread fear, uncertainty and doubt). There's a good reason Linux dominated the server market and continues to do so.

[@alexmercer7550]

who the hell would download a random executable from a random place and purposefully execute it in terminal i understand that it can be included as a payload to some program but still you can get every possible program from your package manager, and or from source/official website

[@kiiiburn]

For everyone saying, "don't run random executables" what do you say about RCE vulnerabilities for these types of things? Happens all the time.

[@westlyward2504]

I do acknowledge that there can be vulnerabilities that go undiscovered for years. The creator of this video makes it sound like what he does in the video is something that linux users do all the time. Although it may be moot point, I'd also like to note that I've seen many articles talking about these vulnerabilities, I don't remember, any of them saying that they had been exploited in the wild.

[@GC-qe8vc]

Well, this video was not an example of remote code execution. And no, it does not happen "all the time" in Linux. Don't mix up the discovery of a code vulnerability that could *potentially* be used for RCE and the creation of an actual exploit.

[@matman1975]

Who made that file executable as most times a single file will not have executable rights. (Which user owns the file?) Unlike Windows, I do use Windows as well. :)

[@swh77]

Actually tar preserves permissions. If a user downloaded tar archive, file inside could be marked as execuable.

[@deletevil]

@@swh77 whoa! That I didn't know. Thanks for this! When I am thinking about that, it sounds more scary than it sounds.

[@prondiest]

why i afraid ransomware when i break it every time i trying to fix not working stuff

[@maxwellsmart3156]

What's the attack vector for this ransomware because one doesn't just download files and run them on a server, not even Windows, but much less likely on your production Linux server. Any system is vulnerable, castles, servers, it just depends if there are stringent security protocols. ELF stands for executable and linkable format, it replaced the older a.out format but there's not reason to use and extension, you only have to make it executable. Run readelf to find out about the file.

[@mrcrackerist]

I have seen some companies "security" and it makes me shiver. running web servers as root, downloading random pieces of code form the internet and etc... If you run random binaries form the internet then this happens, the major difference Linux does not auto execute unlike Windows, also most Windows users doesn't separate the admin user from a there main account.

[@gabrielandy9272]

only thing windows auto executes is Disk/usb/drives and you can disable this in the security panel, to make it "Asks" what to do or just don't do anything automatically.

[@bobbuilder8855]

Windows doesn't auto execute anything. Please don't spread false information.

[@alex15095]

@@bobbuilder8855 Oh Windows does auto execute alright. It auto executes Windows Update every single damn time. It executes it as admin. As soon as you plug in any device, Windows Update auto executes some proprietary driver installer from your device's vendor. It downloads arbitrary code and auto executes it as administrator, no UAC prompt either. Definitely nothing unsafe there..

[@loganiushere]

@@bobbuilder8855 *hasn't by default since winxp

[@computer_freedom]

@@bobbuilder8855 All you need to do is get your program or script into the Startup directory. The use of "%USERNAME%" for the user name will make this the current user logged on at the time, and it will execute the next time that user logs on. There is no permissions needed to put this into the said directory. I did this to a friend of mine, without having physical access to his computer, and he struggled with his screen upside down for an hour before he figured out how to fix it.

[@alexcricles]

I think ransomware just attack closed-source operating-system (windows, mac, etc), how open-source operating system could be attacked too?

[@thebestwizz]

As many said, a lot of our packages come from using distro pkg managers. But also, most of us who use Linux are not average users. If anything harmful is unpacked and installed it is most likely because of oversight, not ignorance.

[@ChristopherGray00]

leave it to arch users to downplay and pretend that linux is all immune magical system, this is why we have a bad adoption rate, because of people being disingenuous and lying about the realities of linux, it's a great OS, but stop pretending its fucking magic. just stop.

[@plutonianfairy]

I don't get why there aren't any mainstream AV tools on Linux... Especially considering more average users are switching to linux these days...

[@amin7581]

Because: 1. most hacker have no reason to hack linux as the number of people using it compared to windows is very very small. Meaning, not worth their time. Even if want to hack a linux computer, it would be a server from a big corps. 2. Most linux distro has no av because it's going to use too much ram. Making it not much better, or maybe even worse than Windows. 3. Most linux distro has no av because they knows that most linux user will download and install from official repos anyway.

[@Davi-did]

The person or people who wrote this ransomware put in the readme file, "Whats Happen?" instead of "What's happened?" or "What's happening?" Do the language patterns indicate to anyone what country of origin they may have?

[@mikehare7185]

Couldn't I just undelete my files to get them back? Assuming I had plenty free space on my drive. Anyway I've never installed software from an untrusted source so I can't say I'm at all worried.

[@mdragonborn]

Iv been infected by a koom ransomware I resetted my PC since there wasn't much on it but now some system things stop working like search bar and start menu I can't fix anything by the normal methods shown on yt or any information site

[@igorthelight]

Just format your drive and install the system. If you don't know how - ask someone who knows ;-)

[@mdragonborn]

@@igorthelight hmm that was a problem 2 months ago and I already used diskpart to clean my drives multiple times now I'm running win 11 no issues

[@laryfox7428]

But I don't think it can affect files with different ownership(unless you run it as superuser)

[@godnyx117]

Does running the script as regular user effects directories other than your home directory?

[@genericgamer1319]

i don't think it can the same is true for windows if you can't access it the virus can't unless they get root & even so if SELinux is installed it adds security giving a process specific files/ports it can access/execute so even with root it can't do everything or at least that's how i understand things

[@godnyx117]

@@genericgamer1319 Yeah that's what I though and why I call bullshit. If I'm not wrong, windows can silently get permission to execute software with "administrator" privileges and also most of the files doesn't need that anyway so they are less secure. So this guy tells use that a malware (which is really a regular program) can infect linux. No shit Sherlock!!!

[@ildefonsogiron4034]

@@godnyx117 You're right. Windows runs in user space, as opposed to Linux, and that's why, when user privileges escalate, programs can compromise the whole system, and not just user's environment.

[@Codename1Alice8]

How to protect my ubuntu system???

[@refusist]

dont run crap you dont trust

[@tablettablete186]

AppArmor, Seccomps, Good DAC (Dicresionary Access Control) rules, SELinux, Capabilities...

[@Astra3yt]

@@refusist Which is basically kinda easy to do with package managers. Most of these attacks are targeted at organizations anyway, not at desktop users. That said, backups are always important.

[@Zszywek]

@@tablettablete186 I would also add Firejail and, technically speaking, if you would run ransomware file in the --private mode you would probably not be encrypted as it creates the temporary directories just for the run file, although I'm not cofident enough to try it by myself :P

[@Alipuree]

@@refusist Same for windows

[@carlayacuzzi5553]

Now Anti-Malware developers have to panic Windows users who see the possibility of moving to Linux, A well configured and hardened Linux is impossible to hack, Only AppArmor is needed | SELinux a well configured Firewall and a lot of common sense, Besides Linux users are not idiots. Greeting from Argentina

[@gonzalolog]

Well, you need *common sense* in order to not get a virus no matter what OS you're using, that's flawed

[@bologna3048]

you have to do some seriously stupid sh** to even get as far as the video-op lol

[@Windows11Official]

*Most of Linux users

[@orkhepaj]

linux users arent any smarter than win users

[@anonymouscyborg5610]

Linux definitely has malware, and it is increasing but the thing is on Linux you use mostly OSS so there's almost no chance of malware, and if the malware slips into the code then there are alot of people looking at the source code continuously soo its very damm hard for malware to slip in but definitely possible

[@ChristopherGray00]

this is a bogus argument, the reason there isn't much linux malware yet is because the desktop userbase is a small minority compared to windows, linux programs have the freedom and more to execute malware just as bad as windows, this is true for essentially all operating systems that allow execution of arbitrary non-approved code.

[@computernerd8157]

This comment did not age well. I remember a bad actor compromised Linux Mint Distro. A Hacker modified the ISO and so he could create a Bot-Net. That would be much harder to do with closed sources software without a decompiler.

[@DarkGT]

Linux is as vulnerable as Windows if some user decide to run something unchecked from the Internet. But on Windows you get third-party anti malware products.

[@melhadden5266]

The third-party and anti malware products are subsidiaries of the virus propagators. You pay them ransom to infect other computers. No pay, they go away ...... Reformat your infected items and get on with your life. If you lost data, that's your fault for not backing it up.

[@DarkGT]

You don't value your time my friend. You can't just reformat your problems away...

[@apreturns]

Wait cant you just go to your encrypted files and enter its properties and set it back to its normal file name. It wouldn't hurt to try but if that worked. Ransomware would be gone already

[@igorthelight]

You are joking, right? :-) The WHOLE file is encrypted - not just it's name...

[@apreturns]

Get a file decrypter not so hard

[@NewRepublicMapper]

It’s not About Linux or Windows to make everything secure The Thing that you maintain your Cybersecurity is Your Common Sense

[@igorthelight]

True! As it was stated in 6:15

[@finoderi]

There are too little concrete information and details in this video. How this file works, what or who made it executable etc.

[@igorthelight]

Do you think you could know 100% about any virus? ;-) It's somewhere from the DarkWeb most likely.

[@finoderi]

@@igorthelight Do you even understand how new files on linux work.

[@igorthelight]

@@finoderi You mean - who gave it +x permission? :-)

[@troyBORG]

Ubuntu 2004 LTS isn't technically the newest it's the long-term support release I believe there's a 2104 interim release. And 2110 is coming October 14, 2021...

[@dominik2327]

One does not simply execute binaries downloaded from a website or received as an email attachment on Linux.

[@igorthelight]

Same for smart Windows users ;-)

[@josueyuman7990]

The only doubt that I have is, if for some reason that malware file ends up in my computer, if I go to properties of the file and select to don't "run as a program" this can be avoided?

[@technicallyme]

My nextcloud server on unbuntu server just got hit 😭. Fully patched system too

[@JosiahSCooper]

Is there such a thing as malware that effects firmware? For me, I store lots of my data, either in the cloud or through removable media - so - I can, effectively, always just reboot and do a clean install (no matter what).

[@plutonianfairy]

Do you guys know of any linux AV with real-time protection for consumers?

[@pyxl77]

It's strange, because after running that malicious program your operating system did not crash. If the program encrypt all your system file the operating system/Ubuntu should crash, or did the malicious program only encrypt your home folder and other external hard drive, which means that your system file (where your os installed) still secure and not encrypted..?

[@MealWars]

It didn't encrypt the system files, because it didn't have root. It could only encrypt files owned by the user who ran it. It still could cause problems of course, but it's mostly PEBKAC. Stupid users are platform agnostic as well.

[@linkxthatsme5141]

So they don't only happen in Windows XP

[@xDarkWav]

Well, some time ago I ran a public Minecraft server on Ubuntu 20.04 and after some time just found the entire server folder and desktop folder was deleted from the system with the console logs full of errors. I'm not 100% sure but it quite possibly was a remote code execution exploit in MC's server software or even the java runtime itself. Thankfully nothing of any value was on that machine, so I just wiped the SSD and reinstalled (no ubuntu anymore this time though). Now all my MC servers run isolated in their own, dedicated VMs in VirtualBox. I had to learn that that's necessary the hard way, I really didn't want to believe java was that horrible when it comes to security holes until then :/

[@Sumire973]

Java programs are OS and hardware architecture agnostic, so any malware made in Java will affect your Minecraft installation wherever you are.

[@oqocraft2661]

Do you still have the logs

[@xDarkWav]

@@oqocraft2661 unfortunately no, the logs were deleted and ofc backup logs don't contain the relevant information.

[@GooogleGoglee]

What I need to know is that Microsoft is building more code for Linux Kernel lately than the open community! This is worrying...

[@gonzalolog]

It still gets reviewed

[@ChristopherGray00]

you can't just push code into the kernel without it being reviewed first. not how it works at all.

[@davidkachel]

A worldwide bounty on these people and fat rewards for turning them in, would soon put a stop to this.

[@igorthelight]

... and get a lot of "fake" hackers get turned for the profit. Source - human history ;-)

[@iSamYTBackup]

apple's supplier deserved it because they supply a anti right to repair corporation

[@BruceCarbonLakeriver]

thought the same xD

about the people saying they stay secure only using packages from oficial distro... it is exactly the scenario where windows fails. A third user using a linux computer gets a mail with malware. This isn't rocket science. Just like with a properly run windows machine.

[@Pujastanto]

Unlike pcs, Servers are redundant unless all servers infected at once, what the server maintainers need to do is erase the infected one and use the backup, yeah it may slow down some server but it will be right back in minutes or maybe an hour or two, but if u are using linux as pc be careful though

[@kbhasi]

I suspect that this ransomware can enter Linux servers if the people maintaining them use default passwords and such and misconfigured their firewalls, as I've seen (in authentication logs) lots of failed attempts to log in as various default username and password combinations.

[@SkyyySi]

I think the main reason why is simply because most AVs don't support Linux at all, and if no one shares those files with them, there's no way they can add it to their database.

[@mamalinio]

Its extremely difficult not to say nearly impossible this to be deployed on an enterprise server from experienced admins.

[@exe_]

always backup on different servers, take at least two sources to backup (all cloud drives together count as one and the files you use to actually work count as zero).

[@MrAdi2500]

Yep. I know the 3-2-1 rule: 3 backups, two of them in the normal building but different servers and one anywhere else, at least in a different region at best in another country. And the rule: "No backup no tears for you"

[@Underblackandwhite]

I wonder if Clamav from Cisco can detect that. Also, anyone got a sample of that strain?

[@pnunezaguila]

The equivalent of double click in Windows is to use the terminal... I mean that will exclude 80% of windows users, if Windows required to use the terminal to do the same, to get infected.

[@bologna3048]

nope. it's still double click on linux too lol

[@Davidian1024]

Only 218 files affected? Sounds like it was contained within the leo user account. Even the most minimal Ubuntu 20.04 install with a desktop environment will have far more files. This isn't that interesting.

[@49studebaker1]

There are read, write, execute permissions. Maybe there could be an encrypt permission?

[@LibreGlider]

Read, write, execute permissions are more than enough. Plus SELinux or AppArmor would have not allowed this to happen.

[@rknill1]

I maintain a windows partition and Linux partition on the same drive and periodically do a disk image backup using AOMEI standard edition. I do a weekly backup of the entire drive. I have on occasion restored the Linux partition with no problem. The windows partition is on the drive for gaming. The Linux Manjaro is for everything else.

[@maxgood42]

lots of comments about Linux vs Windows ha ha but how do we get this ransom ware out of the system ?

[@ab.md.faisalrahman3310]

why on earth a linux user would run a suspicious script without cat?

[@igorthelight]

Good luck reading every *.ELF file ;-) That wasn't a BASH script in the video.

[@SlyNine]

Have you seen a virus escape a VM? Are there any extra precautions you take? (besides shared files or folders)

[@kquote03]

Not him but VM escapes definitely are a thing. They can be from things as simple as the shared folders or from stuff like the graphics drivers

[@archygrey9093]

Personally i wouldn't risk it on your main computer / hardrive.

[@ShazySoft]

My security solution has always been just being poor. No one's gonna hit you if you've got nothing for then to steal

[@igorthelight]

Well... You could still be infected my mailware and ransomware. Not targeted for you - just a random one.

[@cacheman]

Does it do anything linux specific? E.g go after filesystem snapshots, or try to mount filesystems?

[@mihailmojsoski4202]

nah it just encrypts all the files in your home directory

[@JaccovanSchaik]

OK, so it's possible to run a program that will encrypt all the files in your Linux system. What's the news?

[@LordAlacorn]

Only Home folder - user files. System is 100% fine. And if you use latest Fedora with default BTRFS - you just say "LOL NO" and roll back all your data in 3 minutes.

[@electricshock900]

linux can be affacted by RandsomeWare ?

[@badpiggies988]

This is why Ubuntu strongly recommends that we not go into the OS’ files and disable the requirement for entering a password every time we run something as sudo. And besides, with the Linux community's gradual growth we seem to have gotten on the radar of cyberattackers recently; as horrifying as it is given the short supply of antivirus programs that exist for Linux OSes due to how complacent we Linux users have become about cybersecurity, in a way I see the existence of explicitly Linux-targeting malware like this that can run natively on it as a good thing, it's like a rite of passage for us- just like it was for Mac users many years ago.

[@Doofus171]

Thats only possible if the Linux user is signed in with administrator rights. If the Linux user was signed in as a Standard User rights, it would never even be able to execute.

[@AgentFortySeven47]

the average linux user is aware enough to use the distro package managers for their software and use trusted sites for the few programs that aren't in the package manager. i have fedora and the majority of packages that i need are in the fedora repos or fedora-adjacent repos (rpm fusion, for example)

[@Skeleton-wn2zu]

Just use btrfs to snapshot your system so you can backup your files and restore them if needed.

[@kquote03]

not practical since that will take a LOT of storage and most distros only backup / without backing up the home folder

[@kquote03]

@@szymex8341 yea I know, for system files it's alright, but for /home it takes way too much space.

[@djdeetsdroppingthosefunkyb1236]

@@kquote03 Takes 8gb on my setup...

[@kquote03]

@@djdeetsdroppingthosefunkyb1236 Things like "for how long your setup is running for" and "how many snapshots" obviously affect.

[@kquote03]

@Watcher I'll be honest. I agree. I guess my comment about it taking way too much space was just an isolated issue as I do work with many heavy files.

[@ShantanuDeyAnik]

Sir do you have any malware analysis course or something like that?

[@arqtk]

where did u get the malware from? I need it for a test

[@shady4tv]

Linux Support is my specialty and I have NEVER seen Linux Ransomware hit a system in the wild. This is not to say that it couldn't happen... just that it's very rare. Use packages from your repos if you can in production environments - you contact your support vendor Amazon, SUSE, Microsoft, Red Hat and have them package it for you if it doesn't exist if you pay for support. ....also PATCH! I can't stress this enough.

[@impoppy9145]

Well I've been using windows for 20 years now and I've never even been infected with ransomware. I'm pretty sure everyone else here never been infected by ransomware either. Does this mean Windows is unhackable and ransomware on windows does not exist?

[@glikar1]

How do they get around permissions when encrypting the disk? I'm assuming it wasn't an infected file from the repo? Maybe they only encrypt the home directory.

[@vladbejenaru3541]

Looks like. He didn't show encrypted files outside of home.

[@atpray]

Linux is just an operating system like any other. Its just most of software used on linux are open source. Just don't execute any file or script or software from third party sources, unless they are your trusted sources. You always have your package manager to install all open source applications that you will ever need.

[@CoolingTool]

@Idk Gaming thats epic

[@kim-hendrikmerk4163]

So there is ransomware for Linux. But how do you actually get it shouldn't you be able to get most of your stuff from a secured repository?

[@RAFALAMAO_]

Please, wallpaper link?

[@adambrown3918]

Great video! Recommendations on anti-malware for Linux?

[@mihailmojsoski4202]

Common sense

[@rexempire3365]

Just so you know, anti-malware software for linux typically only scans for windows malware.

[@adambrown3918]

@@rexempire3365 Thank you for the reply 😊👍. I'm just genuinely curious if anyone is using anything( other than clamscan antivirus ) to deal with malware on *nix pc's.

[@raandomplayer8589]

thank you for this video, i came from your coverage of ltt getting hacked

[@tonysheerness2427]

How does malware run on Linux without root password? Surely just by running the command it should come back and ask for root password?

[@thecloudrazor]

SELinux probably would have prevented this.

[@AaronTechnic]

Yea

[@villan821]

btw I use Arch

[@tactical4415]

Are you going to test Kaspersky for the 2021/2022 year?

[@MarcGameplays]

Can ClamAV detect this kind of malware in files?

[@lattice.d]

Its much more difficult to get something like this to actually run and priv esc to cause system wide damage most of the time compared to Windows. A threat is a threat though for sure.

[@ChristopherGray00]

i dont know why linux users are trying to pretend like its any harder to run malware on linux, it's not, stop trying to be disingenuous for sake of argument, linux has the ability to run code as dangerous and more than windows.

[@contrivix_quest_kwt]

How do i protect my servers from ransomware

[@igorthelight]

You should read a book or watch a tutorial on Linux Security ;-)

[@ArtflPhenix]

Can we have MacOS ransomware next?

[@jasoncravens1124]

Same difference. Unix. With *nix (linux/unix) it's mostly the same as far as running software. Same terminal and everything.

[@igorthelight]

@@jasoncravens1124 Mac is closer to FreeBSD if I'm not mistaken. Almost the same thing. Not exactly but close.

[@littleghoost]

Depending on the number of files, this is not that efficient. I think the best efficiency for ransomware is MTF table encryption of disk storage. If there are many files, the person can end the process before it is finished, not to mention that changing the file names makes it very clear what is happening and prompts quick action from the person to block encryption.

[@paulg3336]

If someone sent me an email and asked me to smash my storage drive with a hammer... I probably wouldn't do it. Why got to this trouble? The only person that would fall for this is obviously an idiot,so why not just ask him to run: rm -rf / in the terminal ? Or better still ask him to transfer the contents of his bank account to yours.

[@jeschinstad]

That doesn't work on Ubuntu. :)

[@amatechie2070]

Thanks for the video, how do we decrypt the folders?

[@computer_freedom]

I once wrote a program to XOR files. I could do it again for Linux, but that isn't much different from what you did here, except you didn't write the program. So what is the point of your video?

[@igorthelight]

To prove that Linux could be infected. It's just you would have to run something from unknown source. With sudo, preferably ;-)