Linux devices are under attack by a never-before-seen worm | Hacker News Reader

Linux devices are under attack by a never-before-seen worm

arstechnica.com

63 pointsmilkglass18 comments

Spreads via password authenticated SSH, which is the first thing you disable when you set up an SSH server. Doesn't hide its CPU usage. Does a few mildly crafty things to prevent reverse engineering, but overall this "worm" just seems like it's picking low-hanging fruit.

This doesn't seem serious at all, nor difficult to detect. Am I missing something?

Same. It has some nicer evasion techniques but nothing out of the ordinary, to me this seems like a guy bought a malware suite that's above his pay grade and sent it off on ssh scans.

Yeah, I was surprised that this is still a thing in 202x, but then, there are many devices out there, which run a ssh server, which one wouldn't have 'installed'. Seems it targets IoT devices. Rather than (intentionally) causing DDoS, it mines cryptocoins (with great patience, I suppose), so it's more like a parasite, siphoning electricity and doing it's part to warm the globe.

Wait, if you disable password authenticated SSH, how do you log into the server?

Public key authentication, with your private keys in your .ssh folder and your public key in the server’s .ssh/authorized_keys file

You can have a password on the client end to unlock access to the keys, if you like.

The point of ssh is to use the keys for authentication. Having the ssh server permit password login is a back-compatible legacy from the telnet days and has been functionally obsolete for decades.

> Akamai has been monitoring NoaBot for the past 12 months in a honeypot that mimics real Linux devices to track various attacks circulating in the wild. To date, attacks have originated from 849 distinct IP addresses

This doesn't sound particularly new or concerning. Right?

That number sounds really low to me.

Whenever I see a story like this I just feel how f**d we are.

When you can waste an exploit like this on installing crypto

Whatever NSA and other advanced nation states have is magnitudes next level.

NSO Group sells some advanced stuff, but again what Israel keeps behind locked doors again have to be magnitudes next level.

There is nothing of substance to this attack? Just ssh credential stuffing and $env overwriting is the only "novel" evasion technique and it's really not that bad, EDR software can easily detect that this is happening and it likely only happens on malware.

I mean if you use ssh with password auth and a weak password in production you kinda deserve it.

Attack on weak ssh passwords. I'd say it's a good thing these viruses are going around, it serves as a good reminder to either switch to public key auth or use strong passwords.

Of course it's a crypto mining worm. Crypto is poison.

Fortunately, I'm using Qubes OS, which would make the attack easily detectable and curable on my system.

If your externally accessible ssh root password is changeme, even qubes won’t save you.

It will save me, since you will only get access to a single VM on my system.

It was a joke. This is spreading via a rudimentary password list.

https://github.com/akamai/akamai-security-research/blob/main...

My implication was that if you've managed to set up qubes so wrong that you would be affected by this, there's a good chance that you've made other massive mistakes too, making your qubes usage meaningless.

That being said. Qubes is an excellent piece of software and you are correct in your statements.

Reply on news.ycombinator.com