Leo Famulari <[email protected]> writes: > On Fri, Sep 30, 2016 at 05:47:35PM +0000, ng0 wrote: >> https://vms.drweb.com/virus/?_is=1&i=8598428 >> >> As far as I see it, Guix as GuixSD and systems with just Guix but with >> software/files which is coming from Guix assumed by this trojan to exist in >> 'normal' locations should not be able to get infected, >> is this observation correct? I did not feel like this is a case which >> should go to the -security list, as it's a general question. > > I don't know what "Linux.DDoS.93" is. Can you copy and paste the > relevant text into an email reply?
Oh, sorry. I thought this was obvious from it's name and that I mentioned it is a trojan. I got the link to the drweb.com page from https://archive.fo/8LmBS which is a copy of a short article in softpedia. The Website I initially linked seems to hold a copy of one version of the trojan's source code or some relevant/important part of it. Knowing Germanys weird position on exploits, virus, etc I will not copy anything from there in the email for my own legal safety. softpedia quotes: Dr.Web security researchers, the ones who have discovered this threat, say the trojan seems to infect Linux machines via the Shellshock vulnerability, still unpatched in a large number of devices. The trojan, going by the generic name of Linux.DDoS.93, will first and foremost modify the /var/run/dhcpclient-eth0.pid file in such a way that its process is started with every computer boot. If the file doesn't exist, the trojan will create it itself. drweb.com: The Trojan for Linux designed to carry out DDoS attacks. It is spread presumably via ShellShock vulnerabilities. At launching, it checks for the presence of /var/run/dhcpclient-eth0.pid. file. If the Trojan cannot find this file, it attempts to register itself in autorun. --
