“Hand of Thief” Trojan Targets Linux | Hacker News Reader

“Hand of Thief” Trojan Targets Linux

blogs.rsa.com

59 pointstomrod26 comments

Also written up on Arstechnica ( http://arstechnica.com/security/2013/08/hand-of-thief-bankin... )

It is not a real remote exploit due to any flaw in Linux, rather it is something the purveyors trick people into installing via "social engineering".

Don't copy and paste commands into your shell, kids.

Even if they look safe: http://thejh.net/misc/website-terminal-copy-paste

Indeed. This is one of the reasons I use the SELinux sandbox to run my browser: there are a lot of ways that a browser could become a vulnerability. I would like to think I would always remember not to copy/paste from a website into my terminal, but the truth is that I could easily forget -- if I were in a hurry, if I knew the guy who made the website (but did not stop to think that someone might have hacked into the server), etc. Unfortunately it is hard to advise that everyone do this; the sandbox is very restrictive and basically incompatible with how most people use their computers.

Do you have any write-ups on how one would accomplish this SELinux sandbox for your browser? Thanks!

http://danwalsh.livejournal.com/31146.html

One very simple way to get a sandboxed browser is to run this command (my irony meter is going off the charts here):

sandbox -X -t sandbox_web_t firefox

However, that will prevent any persistence between sessions, so you probably want to do something more like this:

sandbox -X -H /path/to/some/directory -t sandbox_web_t firefox

My recommendation is that you read the man pages and experiment a bit.

my irony meter is going off the charts here

Nothing wrong with showing commands and examples to be used. It's the cut-and-paste aspect that's an issue.

My first action was to search through my package repos (Debian) to see if that sandbox command is known to my packaging system (it's not, hrm...).

Ubuntu ships Firefox with an AppArmor profile, although it appears that it is disabled by default (presumably for the same reason you give).

About that, recently I started to watch some videos about SELinux, and I tought it could be a good idea to use it for isolating some likely-to-leak software (e.g. Skype).

This includes things that have become commonplace, such as downloading random tarballs off the internet and running "./configure ; make".

Nothing is safe.

Or even worse,

    curl http://example.com/install.sh | sh

but... that one-liner makes my rails.node.js.io framework so beautiful and simple...

I don't understand what it is but there is a culture in Ruby/Node to make installation "easy" to the extent that it is dangerous and, worse, offer no documented alternative.

Installing rvm shouldn't add lines to my .zshrc without prompting me. That behavior would be outrageous anywhere else but in Ruby land it's normal.

Damn, made me cringe and lol at the same time.

uhh yeahhhh that is too common, look at github and see how many projects use link-trackers+url-shorteners instead of raw-github-urls.

If you must do so, then create an extra user on your computer that you use for things like this. (Make sure not to give that user sudo.)

Switch to that user before running any code you are not sure about.

This then dumb for at least two reasons. I never copy-paste commands because no learning occurs. If you want to work at the command line, you have to work. At the command line.

Does this mean that Linux has arrived as a desktop that's worth exploiting?

That was my takeaway.

The article is missing the MD5 hashes of the malware sample. There is an old adage from malware reverser: "MD5 or it didn't happen".

This website has got a wrong and expired SSL certificates.

Yes... accept it so we can hack you next time more easily ;))

Not something you'd expect from RSA, of all places.

Working link: http://www.zdnet.com/linux-desktop-trojan-hand-of-thief-stea...

Given the high price relative to the number of consumers that might be attacked with this software, I'd bet that it will mostly be purchased by people who want to do spear fishing.

Anyone know what technique this package uses to grab information from forms?

LD_PRELOAD? ptrace?

I googled but only found ways of doing this that are Win32-specific.

Reply on news.ycombinator.com