Linux devices are under attack by a never-before-seen worm

Comments

• mlfh@lemmy.ml ⁨9⁩ ⁨months⁩ ago

  This is just an attack that attempts common username/password combinations on ssh, and the article even states that the worm is dime-a-dozen. Unless you have both password auth enabled and an available account with an easily guessable password (and if you have either you should change that), this is nothing to worry about, even with sshd available to the internet.

  Sensationalist title.

  source

  • ichbinjasokreativ@lemmy.world ⁨9⁩ ⁨months⁩ ago

    Thank you, spared me from giving attention to an unworthy article

    source

    • SharkAttak@kbin.social ⁨9⁩ ⁨months⁩ ago

      savedusaclick

      source
  • Dasnap@lemmy.world ⁨9⁩ ⁨months⁩ ago

    Hell, even having a lax fail2ban stops these attacks.

    source
  • knobbysideup@sh.itjust.works ⁨9⁩ ⁨months⁩ ago

    Prevention, as always, is much easier than a cure.

    source
• CyberSeeker@discuss.tchncs.de ⁨9⁩ ⁨months⁩ ago

  Linux devices are under attack by a commonly seen, easily preventable attack

  source
• Lifecoach5000@lemmy.world ⁨9⁩ ⁨months⁩ ago

  So as I new Linux guy that just has Ubuntu installed on a laptop running media server, sounds like I shouldn’t be worried since it is NAT’d behind my router and this worm compromises telnet and SSH connections. Am I getting the gist right? Totally newb here again.

  source

  • flyos@jlai.lu ⁨9⁩ ⁨months⁩ ago

    Not particularly security savvy, but :

    The infected devices then attempt to crack the telnet password by guessing default and commonly used credential pairs.

    My understanding is that the worm is targetting connected devices with supidly simple credentials, which is why “Internet-of-Things” is mentioned?

    source

    • SlopppyEngineer@lemmy.world ⁨9⁩ ⁨months⁩ ago

      Looking at sites like insecam.org, the amount of devices still sett to admin/admin is frighteningly high

      source
  • Jackinopolis@sh.itjust.works ⁨9⁩ ⁨months⁩ ago

    Conventional Linux use should be fine. It’s targeting SSH connections to other things over the net; connecting to a server, remote camera, etc. So it reverse engineers the connection by brute-forcing(?) Weak ssh passwords to install the malware.

    I’m not an IT professional but this is my layman interpretation.

    source
  • Kethal@lemmy.world ⁨9⁩ ⁨months⁩ ago

    People are giving some advice but it doesn’t seem appropriate for an absolute newbie. Here’s what I’d say. Absolutely do not run telnet. Because it’s so insecure and everyone knows that, it’s usually not on by default, and you would have had to start it yourself somehow. It’s unlikely that you did that, but you can check to see.

    If you’re new, you very likely don’t need an SSH server running. Unless you’re logging into that computer remotely, you don’t need it. It’s probably not running, but it’s conceivable that it could run by default. Check to see and disable it if you don’t need remote login.

    If you do need remote login, use SSH and use a good password. Ideally, you’d need to leave newbie territory and use public-private keys instead of a password. It’s also not a bad idea to use a nonstandard port, instead of 22. That doesn’t beef security much, but many scanners are going to look for 22 and nothing else.

    source

    • Lifecoach5000@lemmy.world ⁨9⁩ ⁨months⁩ ago

      Thank you for the well thought out response! I, myself do know my way around networking a bit. Linux in general is what I am just now dipping my toes in. Loving it and learning a lot.

      source
    • dgriffith@aussie.zone ⁨9⁩ ⁨months⁩ ago

      To add to this, install fail2ban (most distros have it in their package system) and activate it for the various things that use username/passwords in your system.

      Basically it monitors access logs and blocks the IPs that repeatedly fail logins.l for a certain amount of time.

      This drastically reduces the effectiveness of brute force attempts - as long as your password isn’t, “password” and guessable in one go.

      source
  • thisisawayoflife@lemmy.world ⁨9⁩ ⁨months⁩ ago

    Systems with exposed SSHd, but also properly configured, are also not at risk.

    source
  • QuadratureSurfer@lemmy.world ⁨9⁩ ⁨months⁩ ago

    Hard to tell at a glance.

    The telnet vulnerability allows it to infect some older IoT devices (such as CCTV cameras) or if you are using an older router where telnet is enabled (or may be enabled by default). Most modern devices don’t use that method anymore due to security concerns.

    The SSH vulnerability can affect a lot more devices. So if you have a Raspberry Pi on your network with a default account/password or a weak password then it can infect that and spread to other devices on your local network. Or maybe a cheap IoT device that has weak security… same problem.

    A concern for you is if you have some other device on your network that was vulnerable, because then that device can serve as a point for the worm to jump to your other devices (if they also use default passwords or weak passwords).

    Another big question to ask is whether you have UPnP enabled on your router.

    Either way I would make sure that you have strong passwords, change the default username, etc, on all of your devices.

    source
  • foggy@lemmy.world ⁨9⁩ ⁨months⁩ ago

    Can you connect to your server when not on your network?

    If no, you’re definitely ok.

    source
  • uint32@discuss.tchncs.de ⁨9⁩ ⁨months⁩ ago

    There will always be new malware. Just update regularly and use your head. Don’t worry about it too much

    source
• linearchaos@lemmy.world ⁨9⁩ ⁨months⁩ ago

  A million attacks a day have done this for the past 20 years. ssh + bad password is so old it can drink in the US.

  ssh-keygen is your friend, pretty much no reason not to use it.

  source
• 21Cabbage@lemmynsfw.com ⁨9⁩ ⁨months⁩ ago

  One would assume it wouldn’t have been seen before, be weird if a patch got pushed and all of a sudden an old virus came back out of the archives like that permafrost thing people are paranoid about.

  source
• cmnybo@discuss.tchncs.de ⁨9⁩ ⁨months⁩ ago

  This is why you don’t allow password login for SSH, especially not on systems that are accessible from the internet.

  source

  • cyberpunk007@lemmy.world ⁨9⁩ ⁨months⁩ ago

    This might as well be an article about windows systems exposing RDP to the internet.

    source
• terminhell@lemmy.world ⁨9⁩ ⁨months⁩ ago

  I’m guessing, per the article, that as long as you’re not exposing telnet/ssh directly, you should be ok? If you’re doing that already, why? I could see having some iot device that isn’t properly segmented from the rest of your lan already problematic, and something like this would be a concern.

  source

  • Squizzy@lemmy.world ⁨9⁩ ⁨months⁩ ago

    I shouldn’t be on Linux, I don’t know anything about computers. This is why Windows is the safer bet.

    source

    • TheOSINTguy@sh.itjust.works ⁨9⁩ ⁨months⁩ ago

      Whenever linux has a big sercurity issue, its a big deal. whenever windows has a big security issue, its just another tuesday.

      That should tell you that windows systems are targeted much more.

      source

      • -> View More Comments
    • CluckN@lemmy.world ⁨9⁩ ⁨months⁩ ago

      By Jehovah you can’t say that on Lemmy!

      source
• excitingburp@lemmy.world ⁨9⁩ ⁨months⁩ ago

  / laughs in immutable Linux

  source

  • cyberpunk007@lemmy.world ⁨9⁩ ⁨months⁩ ago

    What use is an immutable system, if it doesn’t already have the data on it that an attacker can steal?

    source

    • excitingburp@lemmy.world ⁨9⁩ ⁨months⁩ ago

      Worms are near impossible to install on an immutable system. You can’t just write to /usr/share/bin or some other truck to hide your binary.

      source

      • -> View More Comments
• JimmyBigSausage@lemm.ee ⁨9⁩ ⁨months⁩ ago

  NOT the boreworm!!

  source

  • paraphrand@lemmy.world ⁨9⁩ ⁨months⁩ ago

    Flash, ahhhhh!

    source