Comment on Powerful Malware Disguised as Crypto Miner Infects 1M+ Windows, Linux PCs

• Eyron@lemmy.world ⁨1⁩ ⁨year⁩ ago

  They describe an SSH infector, as well as a credentials scanner. To me, that sounds like it started like from exploited/infected Windows computers with SSH access, and then continued from there.

  With how many unencrypted SSH keys there are, how most hosts keep a list of the servers they SSH into, and how they can probably bypass some firewall protections once they’re inside the network: not a bad idea.

  source

  • Salamendacious@lemmy.world ⁨1⁩ ⁨year⁩ ago

    I think the original article talked about “spreading” to Linux machines so that generally tracks with what you’re saying that it starts on a Windows machine that itself has access to a Linux machine.

    source
• aniki@lemm.ee ⁨1⁩ ⁨year⁩ ago

  [deleted]

  source

  • Salamendacious@lemmy.world ⁨1⁩ ⁨year⁩ ago

    My job still had Windows 95 machines running just a couple years ago. Could there still be Samba1 running out there or does Linux update differently?

    source

    • lemmyvore@feddit.nl ⁨1⁩ ⁨year⁩ ago

      Of course there is. Unfortunately the average Linux self-hoster doesn’t have much of a clue and probably runs vulnerable Samba (even if it’s not S1). Of course it doesn’t help that Samba seems to get a vulnerability about once a week. It’s one of the most targeted pieces of network software you could run.

      source

      • Salamendacious@lemmy.world ⁨1⁩ ⁨year⁩ ago

        I know that Linux is a host of OSs but generally speaking is it up to the user to keep their software up to date or is there some kind of automatic updating process?

        source

        • -> View More Comments
    • aniki@lemm.ee ⁨1⁩ ⁨year⁩ ago

      [deleted]

      source

      • Salamendacious@lemmy.world ⁨1⁩ ⁨year⁩ ago

        Those machines were controlling a conveyor belt system and weren’t online. I was told the software they were running wasn’t available for other OSs. They were locked in a cabinet. That entire conveyor system is now gone so those machines are probably gone too.

        source

        • -> View More Comments
      • TimeSquirrel@kbin.social ⁨1⁩ ⁨year⁩ ago

        Is there actually still malware floating around out there that targets old Win9x machines? I'd think that without a population of hosts, it'd all die off and nobody is motivated to write more.

        source
    • Toes@ani.social ⁨1⁩ ⁨year⁩ ago

      Yeah windows 2000 assembly robots, too expensive to replace and too critical to not keep alive.

      source

      • Salamendacious@lemmy.world ⁨1⁩ ⁨year⁩ ago

        Well those were controlling a conveyor belt system that maintenance told me they bought used in the 90s.

        source
    • micka190@lemmy.world ⁨1⁩ ⁨year⁩ ago

      The bank I work at still has core systems running Lotus 🙃

      source

      • Salamendacious@lemmy.world ⁨1⁩ ⁨year⁩ ago

        Lotus 123 was outdated when I was still a kid. That’s impressive.

        source
• Salamendacious@lemmy.world ⁨1⁩ ⁨year⁩ ago

  Interesting, thanks for that

  source