MESSAGE
| DATE | 2015-11-08 |
| FROM | Ruben Safir
|
| SUBJECT | Subject: [Hangout-NYLXS] ransomware - attacking apache
|
http://techcrunch.com/2015/11/06/linux-ransomware-is-now-attacking-webmasters/
Linux Ransomware Is Now Attacking Webmasters
Posted yesterday by John Biggs (-at-johnbiggs)
Next Story
A new bit of ransomware is now attacking Linux-based machines,
specifically the folders associated with serving web pages. Called
Linux.Encoder.1 the ransomware will encrypt your MySQL, Apache, and
home/root folders. The system then asks for a single bitcoin to decrypt
the files.
From Dr.Web Antivirus:
Once launched with administrator privileges, the Trojan dubbed
Linux.Encoder.1 downloads files containing cybercriminals’ demands and a
file with the path to a public RSA key. After that, the malicious
program starts as a daemon and deletes the original files. Subsequently,
the RSA key is used to store AES keys which will be employed by the
Trojan to encrypt files on the infected computer.
First, Linux.Encoder.1 encrypts all files in home directories and
directories related to website administration. Then the Trojan
recursively traverses the whole file system starting with the directory
from which it is launched; next time, starting with a root directory
(“/”). At that, the Trojan encrypts only files with specified extensions
and only if a directory name starts with one of the strings indicated by
cybercriminals.
Once you pay the ransom the system receives a signal to traverse the
directories again to decrypt the files. The malware requires
administrator privileges to run and, presumably, a sysadmin who would
allow for such a program to run unbridled. The team recommends backing
up all data and keeping all files in place if you’re attacked until
researchers create a decryption system.
_______________________________________________
hangout mailing list
hangout-at-nylxs.com
http://www.nylxs.com/ |
|
