Linux

9406 readers

291 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 2 years ago

MODERATORS

Ategon@programming.dev

anzo@programming.dev

dwraf_of_ignorance@programming.dev

Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection (thehackernews.com)

submitted 3 weeks ago by Sunshine@piefed.ca to c/linux@programming.dev

13 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] pedz@lemmy.ca 22 points 3 weeks ago (12 children)

It's a good explanation and analysis of what it is and what it does.

There's just one thing that I didn't see mentioned and it's about the prevalence of having a software installed to extract rar files in the first place.

AFAIK there's nothing installed by default on Debian to open rar files. You kind of have to go out of your way to extract one. Unless this changed with the latest release.

I'm not much of a distro hopper so I'd be curious to know, are there distributions where opening and extracting a rar file only requires to click it?

[–] skaffi 6 points 3 weeks ago (3 children)

Isn't that irrelevant? According to the article, the archive itself doesn't contain any malicious code. Rather, it's encoded in the file name, and can start executing itself when being parsed by the shell - no extraction needed.

It seems to me that avoiding rar files, or limiting your ability to extract them will provide a false sense of security at best. Seems to me that this could be done using any file type at all.

[–] pedz@lemmy.ca 3 points 3 weeks ago (2 children)

The starting point of the attack is an email message containing a RAR archive, which includes a file with a maliciously crafted file name: "ziliao2.pdf{echo,<Base64-encoded command>}|{base64,-d}|bash"

Doesn't it mean that a rar archive contains the malicious file?

It's worth noting that simply extracting the file from the archive does not trigger execution. Rather, it occurs only when a shell script or command attempts to parse the file name.

[–] skaffi 2 points 3 weeks ago (1 children)

Right you are! I'm not sure how that went over my head. Eh, too much morning, too little coffee. Thanks for correcting me.

[–] pedz@lemmy.ca 1 points 3 weeks ago

It's also worth saying that as much as I don't have an antivirus on Linux, and that I'm generally not too worried about malware and viruses, I have backups, follow the 3-2-1 rules, and my OS can be scarified if there is ever a problem.

But I must admit that being infected is not always detectable and taking extra care probably wouldn't hurt.

load more comments (8 replies)