Zanimljivosti iz svijeta Windowsa i Linuxa:
- maliciozni dropper (koji sam po sebi nema maliciozni code) može vidjeti u registriju koji exclusion paths postoje i onda jednostavno skine malware u taj folder i pokrene ga od tamo -> Defender potpuno zaobiđen
Nije ni Linux neprobojan kao što neki misle:
New Symbiote malware infects all running processes on Linux systems
"After injecting itself into all running processes, the malware acts as a system-wide parasite, leaving no identifiable signs of infection even during meticulous in-depth inspections."
"When it injects itself into processes, the malware can choose which results it displays ... If an administrator starts a packet capture on the infected machine to investigate some suspicious network traffic, Symbiote will inject itself into the inspection software's process and use BPF hooking to filter out results that would reveal its activity."
New peer-to-peer botnet infects Linux servers with cryptominers
"...it has powerful detection avoidance capabilities, such as using memory-mapped miners and dynamically detecting process monitoring to stop the mining module immediately"
"The miner binaries, xmrig and nbhash, are file-less, decoded from their base64 form and executed during runtime in memory, so they never touch the disk."
Manje-više tehnike već poznate u Windows svijetu sada se koriste i na Linuxu... samo je bilo pitanje vremena kada će se malware autori više posvetiti Linuxu, tj. kada će im postati dovoljno isplativo.
Mnogi serveri velikih i malih tvrtki, organizacija i ustanova se vrte na Linuxu - ransomware im daje motiv da se posvete Linuxu koliko i Windowsu.
Kako upasti na Linux server? Mnogi veliki slučajevi prošlih godina pokazuju da je moguće. Evo ovaj mjesec propust u Confluence softwareu (nešto kao kolaboracijski wiki tool kojeg koriste mnoge IT tvrtke) je omogućio ransomware zaraze.