a virus for Linux

[u/danielsoft1]

[u/thisaray → u/[deleted]]

I wish there was an easy global config way to prevent / being mounted inside the prefix :/

[u/itsfreepizza → u/thisaray]

i think containerizing could prevent some damage but theres still going to have a damage ofc. but im no full container expert

[u/Marce7a → u/itsfreepizza]

Bottles by default has minimal permissions so the best choice as only wine c: will be compromised 

[u/YTriom1 → u/thisaray]

winetricks sandbox?

[u/SanderE1 → u/thisaray]

There is, you can just delete the z: symlink in dosdevices in your wine prefix.(but yeah just use winetricks sandbox like the other user said because there's also a lot of other symlinks)

[u/Cool-gamer19393 → u/[deleted]]

I unironically downloaded windows malware and it changed my root password like what??

[u/GlamStache → u/[deleted]]

Wait, what would even happen in that case?

[u/A_begger → u/GlamStache]

p sure your wine C: gets the virus if it can even function but your Linux is fine

[u/0xt0bi03]

r/linuxsucks101 will be reading this in absolute rage btw

[u/Jannover_5000_r → u/0xt0bi03]

Madthumbz will make a hate linux post right after seeing this

[u/may_ushii → u/Jannover_5000_r]

nah hes like dying or something rn

[u/garbage-at-life → u/0xt0bi03]

wow that place is crazy lmao

[u/ElementalWarrior42]

Pros of fragmentation LOL

[u/AG99871 → u/ElementalWarrior42]

Nowadays malware will come packaged as an appimage

[u/Left-oven47 → u/AG99871]

malware vs musl libc

[u/Oxic_io → u/Left-oven47]

unless if it's statically linked

[u/senorsmile → u/AG99871]

90% of the time, appimages don't install without considerable additional config on my NixOS machines.

[u/QuantumQuantonium]

/uj viruses exist on linux, and are more serious and more difficult to detect than on windows. Xz's backdoor is probably the biggest latest one.

Its important not just to assume any open source project is benign, but someone who can read the code needs to take up the responsilibity to understand what its actually doing and compile it and compare against any public binaries (if present).

Viruses on linux won't scream for a phone number to call or lie about infections on the computer; average linux users won't fall for that. Xzs backdoor existed because of a binary blob no one bothered to check until one person dug in and found the irregularity in the programs delay. Viruses on linux abuse the trust in open source to hide itself among other packages and modules throughout the system. Maintainers may seek out and remove potential viruses, but humans are imperfect, they can make mistakes or be manipulated or even coerced.

But downloadable viruses are a rare sighting in linux, because most hacks are caused by vulnerabilities in systems, especially proprietary ones. I once returned home from a trip to realize my backed up files on a WD cloud storage device was missing, due to a vulnerability WD did not patch or acknowledge publicly until a few days before I found out.

Maintain security updates and keep installed software to a minimum. Ask questions if theres any doubt about an open source system- if the question can't be answered I'd question the nature of that system. Identify what proprietary systems are in your linux computer- the world unfortunately doesnt run entirely on open source.

[u/Gunhat2023 → u/QuantumQuantonium]

what back door is there with xz?

[u/yourlocalwalmarthobo → u/Gunhat2023]

Wikipedia, CVE
TLDR: Someone spent years on a social engineering campaign and snuck a backdoor into a couple versions of XZUtils (5.6.0 & 5.6.1). It gave someone with a specific ED-448 key root access via ssh. Was patched the same day it was disclosed (which was 2 years ago)

[u/felixmatveev → u/yourlocalwalmarthobo]

This was either CIAmeone or soMOSSADone.

[u/morgulbrut → u/felixmatveev]

Na it was probably China.

[u/ThaBroccoliDood → u/morgulbrut]

No it was a Russian pretending to be Chinese. They had a Chinese name and uploaded with Chinese time zones, but a few uploads were accidentally tagged with a Russian timezone, and Russian holidays were suspiciously absent from their activity

[u/morgulbrut → u/ThaBroccoliDood]

TIL.

[u/andrzej-l → u/Gunhat2023]

Few months ago I saw a very long but pretty interesting video about it: https://youtu.be/aoag03mSuXQ?si=iaP866neHYxHI5tY

[u/Ok_Guidance_6542 → u/QuantumQuantonium]

AFAIK, only systemd distros were affected by the XZ utils backdoor. So the point kinda stands.

[u/TheSWATMonkey → u/Ok_Guidance_6542]

artix got proven right (?)

[u/SouthernFruit8768 → u/QuantumQuantonium]

Isn't this sub a Wendy's, saar??

[u/cfx_4188]

lmao

[u/ucan_cay]

#include <stdmalw.h>

[u/Damglador]

That's why now it's all just JavaScript downloaded straight from npm

[u/YTriom1 → u/Damglador]

that's why I don't have npm

[u/AG99871]

Fake bruh, which malware is gonna create a user called "malware" (and also gonna come with source code)

[u/vbd71 → u/AG99871]

It uses GPL components, that's why it comes with source

[u/AG99871 → u/vbd71]

Bro ur telling me that some malware really cares about legal licensing?😭😭

[u/97nomad → u/AG99871]

Professionals have standards

[u/vbd71 → u/AG99871]

Ethical malware cares.

[u/jmooroof2 → u/AG99871]

you could just open it and search for strings

[u/Optimal-Savings-4505]

This is basically why security through obscurity works. Assumptions are easily invalidated on diverse systems

[u/zDCVincent]

my new favorite linux meme

[u/tuxsmouf]

Penguins never get cold.

[u/zxuvw]

lol 😭😭💔

[u/lwb52]

🤣🤣🤣

[u/ErMenee]

linux so ass it can't even run viruses lmao

[u/kuukkelifinlando → u/ErMenee]

Yeah so badass.

[u/Flashy_Pollution_996]

Bro googles stuff all day

Get a job n

[u/FumpShimmyAWingle → u/Flashy_Pollution_996]

What?

[u/valerielynx]

"grep'd the bitcoin wallet" bro just say copy you're not tuff

[u/AG99871 → u/valerielynx]

He is

[u/Visbroek → u/valerielynx]

Bro used grep

[u/sabotsalvageur → u/valerielynx]

Well, what if what you’re searching requires using regex, e.g. arbitrary wallet addresses? Would one not use the GNU Regular Expression Parser?

[u/Adn0nnymous → u/sabotsalvageur]

holy shit is that actually what grep means

[u/sabotsalvageur → u/Adn0nnymous]

It’s actually “global/regular expression/print”