Linux and BSD Web Servers at Risk of Sophisticated Mumblehard Infection(eset.com)

http://www.eset.com/int/about/press/articles/malware/article/linux-and-bsd-web-servers-at-risk-of-sophisticated-mumblehard-infection-says-eset/

3 comments

That pirated copy of DirectMailer that you loaded onto your server also sends spam?! Whoda thunk it?

tux196811 anni fa

I know what you're saying... but this is odd:

"... we found that IP addresses hard-coded in the malware are closely tied to those of Yellsoft"

cruelfate11 anni fa

Learned a couple of things from linked research paper like always mount /tmp and /var/tmp as noexec, and some `dig` fu.

feld11 anni fa

noexec can break a lot of things so please be mindful

cruelfate11 anni fa

Ya, was wondering about package install scripts.

kjs311 anni fa

You can remount those dirs without noexec when you need to do a legitimate install.

badalex11 anni fa

8,500 unique IP addresses during 7 months. How is this not trivial?