Re: New Linux Trojan

[Ben Ford <bford () securityexchange net>]

Qualys Inc wrote:

> executable programs. On Linux systems, the Remote Shell Trojan 
> typically begins its replication activities in the current working 
> directory and in the /bin directory.
[ . . .]

> Mitigating Factors:
> -------------------
> The replication process of the Remote Shell Program can only effect 
> binary files within the access privileges of the user who launched 
> the originally infected program.

I think that this point should be emphasized a bit more, unless you are 
simply out for dramatization.  A properly configured machine won't have 
the root user running untrusted binaries.

-b


--
#===================================================================#
# More dead people have written in support of Microsoft against the #
# DOJ than any other single group, leading UMSA (United MS Shills   #
# of America) President Steve Barkto to lodge a formal complaint.   #
#===================================================================#




----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com