Linux malware

Short description: Malware that affects the Linux operating system

Linux malware includes viruses, Trojans, worms and other types of malware that affect the Linux family of operating systems. Linux, Unix and other Unix-like computer operating systems are generally regarded as very well-protected against, but not immune to, computer viruses.[1][2]

## Contents

* 1 Linux vulnerability
* 1.1 Viruses and trojan horses
* 1.2 Worms and targeted attacks
* 1.3 Web scripts
* 1.4 Buffer overruns
* 1.5 Cross-platform viruses
* 1.6 Social engineering
* 1.7 Go-written malware
* 2 Anti-virus applications
* 2.1 For Microsoft Windows-specific threats
* 2.2 For Linux-specific threats
* 3 Threats
* 3.1 Botnets
* 3.2 Ransomware
* 3.3 Rootkits
* 3.4 Trojans
* 3.5 Viruses
* 3.6 Worms
* 4 See also
* 5 References
* 6 External links

## Linux vulnerability

Like Unix systems, Linux implements a multi-user environment where users are granted specific privileges and there is some form of access control implemented. To gain control over a Linux system or to cause any serious consequences to the system itself, the malware would have to gain root access to the system.[2]

In the past, it has been suggested that Linux had so little malware because its low market share made it a less profitable target. Rick Moen, an experienced Linux system administrator, counters that:

> [That argument] ignores Unix's dominance in a number of non-desktop specialties, including Web servers and scientific workstations. A virus/trojan/worm author who successfully targeted specifically Apache httpd Linux/x86 Web servers would both have an extremely target-rich environment and instantly earn lasting fame, and yet it doesn't happen.[3]

In 2008 the quantity of malware targeting Linux was noted as increasing. Shane Coursen, a senior technical consultant with Kaspersky Lab, said at the time, "The growth in Linux malware is simply due to its increasing popularity, particularly as a desktop operating system ... The use of an operating system is directly correlated to the interest by the malware writers to develop malware for that OS."[4]

Tom Ferris, a researcher with Security Protocols, commented on one of Kaspersky's reports, stating, "In people's minds, if it's non-Windows, it's secure, and that's not the case. They think nobody writes malware for Linux or Mac OS X. But that's not necessarily true."[4]

Some Linux users do run Linux-based anti-virus software to scan insecure documents and email which comes from or is going to Windows users. SecurityFocus's Scott Granneman stated:

> ...some Linux machines definitely need anti-virus software. Samba or NFS servers, for instance, may store documents in undocumented, vulnerable Microsoft formats, such as Word and Excel, that contain and propagate viruses. Linux mail servers should run AV software in order to neutralize viruses before they show up in the mailboxes of Outlook and Outlook Express users.[1]

Because they are predominantly used on mail servers which may send mail to computers running other operating systems, Linux virus scanners generally use definitions for, and scan for, all known viruses for all computer platforms. For example, the open source ClamAV "Detects ... viruses, worms and trojans, including Microsoft Office macro viruses, mobile malware, and other threats."[5]

Cases of malware intended for Microsoft Windows systems posing a danger to Linux systems when run through compatibility layers such as Wine, while uncommon, have been recorded.[6]

### Viruses and trojan horses

Template:No citations section The viruses listed below pose a potential, although minimal, threat to Linux systems. If an infected binary containing one of the viruses were run, the system would be temporarily infected, as the Linux kernel is memory resident and read-only. Any infection level would depend on which user with what privileges ran the binary. A binary run under the root account would be able to infect the entire system. Privilege escalation vulnerabilities may permit malware running under a limited account to infect the entire system.

This is true for any malicious program that is run without special steps taken to limit its privileges. It is trivial to add a code snippet to any program that a user may download and let this additional code download a modified login server, an open mail relay, or similar program, and make this additional component run any time the user logs in. No special malware writing skills are needed for this. Special skill may be needed for tricking the user to run the (trojan) program in the first place.

The use of software repositories significantly reduces any threat of installation of malware, as the software repositories are checked by maintainers, who try to ensure that their repository is malware-free. Subsequently, to ensure safe distribution of the software, checksums are made available. These make it possible to reveal modified versions that may have been introduced by e.g. hijacking of communications using a man-in-the-middle attack or via a redirection attack such as ARP or DNS poisoning. Careful use of these digital signatures provides an additional line of defense, which limits the scope of attacks to include only the original authors, package and release maintainers and possibly others with suitable administrative access, depending on how the keys and checksums are handled. Reproducible builds can ensure that digitally signed source code has been reliably transformed into a binary application.

### Worms and targeted attacks

Template:No citations section The classical threat to Unix-like systems are vulnerabilities in network daemons, such as SSH and web servers. These can be used by worms or for attacks against specific targets. As servers are patched quite quickly when a vulnerability is found, there have been only a few widespread worms of this kind. As specific targets can be attacked through a vulnerability that is not publicly known there is no guarantee that a certain installation is secure. Also servers without such vulnerabilities can be successfully attacked through weak passwords.

### Web scripts

Linux servers may also be used by malware without any attack against the system itself, where e.g. web content and scripts are insufficiently restricted or checked and used by malware to attack visitors. Some attacks use complicated malware to attack Linux servers, but when most get full root access then hackers are able to attack by[7] modifying anything like replacing binaries or injecting modules. This may allow the redirection of users to different content on the web.[8] Typically, a CGI script meant for leaving comments, could, by mistake, allow inclusion of code exploiting vulnerabilities in the web browser.

### Buffer overruns

Template:No citations section Older Linux distributions were relatively sensitive to buffer overflow attacks: if the program did not care about the size of the buffer itself, the kernel provided only limited protection, allowing an attacker to execute arbitrary code under the rights of the vulnerable application under attack. Programs that gain root access even when launched by a non-root user (via the setuid bit) were particularly attractive to attack. However, as of 2009 most of the kernels include address space layout randomization (ASLR), enhanced memory protection and other extensions making such attacks much more difficult to arrange.

### Cross-platform viruses

An area of concern identified in 2007 is that of cross-platform viruses, driven by the popularity of cross-platform applications. This was brought to the forefront of malware awareness by the distribution of an OpenOffice.org virus called Badbunny.

Stuart Smith of Symantec wrote the following:

> What makes this virus worth mentioning is that it illustrates how easily scripting platforms, extensibility, plug-ins, ActiveX, etc, can be abused. All too often, this is forgotten in the pursuit to match features with another vendor... The ability for malware to survive in a cross-platform, cross-application environment has particular relevance as more and more malware is pushed out via Web sites. How long until someone uses something like this to drop a JavaScript infecter on a Web server, regardless of platform?[9]

### Social engineering

As is the case with any operating system, Linux is vulnerable to malware that tricks the user into installing it through social engineering. In December 2009 a malicious waterfall screensaver that contained a script that used the infected Linux PC in denial-of-service attacks was discovered.[10]

### Go-written malware

The IBM Security Report: Attacks on Industries Supporting COVID-19 Response Efforts Double had as a key point that "Cybercriminals Accelerate Use of Linux Malware – With a 40% increase in Linux-related malware families in the past year, and a 500% increase in Go-written malware in the first six months of 2020, attackers are accelerating a migration to Linux malware, that can more easily run on various platforms, including cloud environments." That these cybercriminals are increasingly using Linux and Unix to target hospitals and allied industries (that rely on these systems and cloud networks) that they are increasingly vulnerable during the COVID-19 crisis, such as the Red Cross cyberattack.[11]

## Anti-virus applications

The ClamTk GUI for ClamAV running a scan on Ubuntu 8.04 Hardy Heron

There are a number of anti-virus applications available which will run under the Linux operating system. Most of these applications are looking for exploits which could affect users of Microsoft Windows.

### For Microsoft Windows-specific threats

These applications are useful for computers (typically, servers) which will pass on files to Microsoft Windows users. They do not look for Linux-specific threats.

* Avast! (proprietary; freeware version available)
* AVG (proprietary; freeware version available)
* Avira (proprietary; freeware version was available, discontinued due to lack of demand)[12]
* BitDefender (proprietary; freeware version available)
* ClamAV (free and open source software)[13]
* Comodo (proprietary; freeware version available)[14]
* Crowdstrike (Proprietary)
* Dr.Web (proprietary)[15]
* F-Prot (proprietary; freeware version available)[16]
* F-Secure Linux (proprietary)
* Kaspersky Linux Security (proprietary)[17]
* McAfee VirusScan Enterprise for Linux (proprietary)[18]
* Panda Security for Linux (proprietary)[19]
* Sophos (proprietary)
* Symantec AntiVirus for Linux (proprietary)[20]
* Trend Micro ServerProtect for Linux (proprietary)

### For Linux-specific threats

These applications look for actual threats to the Linux computers on which they are running.

* chkrootkit (free and open source software)[21]
* ClamAV (free and open source software)[22]
* Comodo (proprietary)[23]
* Crowdstrike (proprietary)
* Dr.Web (proprietary)[15]
* ESET (proprietary)[24][25][26][27] * Kaspersky Virus Removal Tool (KVRT) for Linux (free)[28]
* Linux Malware Detect[29]
* lynis (open source auditing)[30][31]
* rkhunter (free and open source software)[32]
* Samhain (free and open source software)[33]
* Sophos (proprietary)[34][35]

Linux malware can also be detected (and analyzed) using memory forensics tools, such as:

* Forcepoint (proprietary)[36]
* Volatility[37] (free and open source software)[38]

## Threats

The following is a partial list of known Linux malware. However, few if any are in the wild, and most have been rendered obsolete by Linux updates or were never a threat. Known malware is not the only or even the most important threat: new malware or attacks directed to specific sites can use vulnerabilities previously unknown to the community or unused by malware.

### Botnets

* Mayhem – 32/64-bit Linux/FreeBSD multifunctional botnet[39]
* Linux.Remaiten – a threat targeting the Internet of things.[40][41][42]
* Mirai (malware) – a DDoS botnet spreads through telnet service and designed to infect Internet of Things (IoT).[43][44][45][46]
* GafGyt/BASHLITE/Qbot – a DDoS botnet spreads through SSH and Telnet service weak passwords, firstly discovered during bash Shellshock vulnerability.[47]
* LuaBot – a botnet coded with modules component in Lua programming language, cross-compiled in C wrapper with LibC, it aims for Internet of Things in ARM, MIPS and PPC architectures, with the usage to DDoS, spreads Mirai (malware) or selling proxy access to the cyber crime.[48][49]
* Hydra,[50] Aidra,[51] LightAidra[52] and NewAidra[53] – another form of a powerful IRC botnet that infects Linux boxes.
* EnergyMech 2.8 overkill mod (Linux/Overkill) – a long-lasting botnet worm designed to infect servers with its bot and operated through IRC protocol, for the purposes of DDoSing and spreading itself.[54]

### Ransomware

* Linux.Encoder.1[55][56]
* Lilocked[57][58]

### Rootkits

* Snakso – a 64-bit Linux webserver rootkit[59]
* Pigmy Goat - used in Sophos Firewall in 2024 [60]

### Trojans

* Effusion – 32/64-bit injector for Apache/Nginx webservers, (7 Jan 2014)[61]
* Hand of Thief – Banking trojan, 2013,[62][63]
* Kaiten – Linux.Backdoor.Kaiten trojan horse[64]
* Rexob – Linux.Backdoor.Rexob trojan[65]
* Waterfall screensaver backdoor – on gnome-look.org[66]
* Tsunami.gen - Backdoor.Linux.Tsunami.gen[67]
* Turla - HEUR:Backdoor.Linux.Turla.gen[68][69]
* Xor DDoS[70] – a trojan malware that hijacks Linux systems and uses them to launch DDoS attacks which have reached loads of 150+ Gbps.[71]
* Hummingbad – has infected over 10 million Android operating systems. User details are sold and adverts are tapped on without the user's knowledge thereby generating fraudulent advertising revenue.[72]
* NyaDrop – a small Linux backdoor compiled from a Linux shellcode to be used to infect Linux boxes with bigger size Linux malware.[73]
* PNScan – Linux trojan designed to aim routers and self-infecting to a specific targeted network segment in a worm-like form[74]
* SpeakUp – a backdoor trojan that infects six different Linux distributions and macOS devices.[75]

### Viruses

* 42[76][77]
* Arches[78]
* Alaeda – Virus.Linux.Alaeda[79]
* Binom – Linux/Binom[80]
* Bliss – requires root privileges
* Brundle[81]
* Bukowski[82]
* Caveat[83][84]
* Cephei – Linux.Cephei.A (and variants)[85]
* Coin[86][87]
* Hasher[88][89]
* Lacrimae (aka Crimea)[90][91]
* Nuxbee – Virus.Linux.Nuxbee.1403[92]
* PiLoT[93][94]
* Podloso – Linux.Podloso (The iPod virus)[95][96]
* RELx[97]
* Rike – Virus.Linux.Rike.1627[98]
* RST – Virus.Linux.RST.a[99] (known for infecting Korean release of Mozilla Suite 1.7.6 and Thunderbird 1.0.2 in September 2005[100])
* Staog, the first computer virus on Linux
* Vit – Virus.Linux.Vit.4096[101]
* Winter – Virus.Linux.Winter.341[102]
* Winux (also known as Lindose and PEElf)[103]
* Wit virus[104]
* Zariche – Linux.Zariche.A (and variants)[105]
* ZipWorm – Virus.Linux.ZipWorm[106]

### Worms

* Adm – Net-Worm.Linux.Adm[107]
* Adore[108]
* Bad Bunny – Perl.Badbunny[9][109]
* Cheese – Net-Worm.Linux.Cheese[110]
* Devnull
* Kork[111]
* Linux/Lion
* Linux.Darlloz – targets home routers, set-top boxes, security cameras and industrial control systems.[112][113]
* Linux/Lupper.worm[114]
* Mighty – Net-Worm.Linux.Mighty[115]
* Millen – Linux.Millen.Worm[116]
* Ramen worm - targeted only Red Hat Linux distributions versions 6.2 and 7.0
* Slapper[117]
* SSH Bruteforce[118]

## See also

* Botnet
* Computer virus
* Computer worm
* Dirty COW
* Ransomware
* Spyware
* Timeline of computer viruses and worms
* Trojan horse (computing)

## References

1. ↑ 1.0 1.1 Granneman, Scott (October 2003). "Linux vs. Windows Viruses". http://www.securityfocus.com/columnists/188.
2. ↑ 2.0 2.1 Yeargin, Ray (July 2005). "The short life and hard times of a linux virus". http://librenix.com/?inode=21.
3. ↑ "Virus Department". http://linuxmafia.com/~rick/faq/#virus4.
4. ↑ 4.0 4.1 Patrizio, Andy (April 2006). "Linux Malware On The Rise". http://www.internetnews.com/dev-news/article.php/3601946.
5. ↑ ClamAV (2010). "Clam AntiVirus 0.96 User Manual". http://www.clamav.net/doc/latest/clamdoc.pdf.
6. ↑ Duncan, Rory; Schreuders, Z. Cliffe (1 March 2019). "Security implications of running windows software on a Linux system using Wine: a malware analysis study" (in en). Journal of Computer Virology and Hacking Techniques 15 (1): 39–60. doi:10.1007/s11416-018-0319-9. ISSN 2263-8733.
7. ↑ Prince, Brian (5 January 2013). "Stealthy Apache Exploit Redirects Victims to Blackhole Malware.". http://connection.ebscohost.com/c/articles/91650917.
8. ↑ Prince, Brian (May 1, 2013). "Stealthy Apache Exploit Redirects Victims to Blackhole Malware". http://www.eweek.com/security/stealthy-apache-exploit-redirects-victims-to-blackhole-malware/.
9. ↑ 9.0 9.1 Smith, Stuart (June 2007). "Bad Bunny". http://www.symantec.com/enterprise/security_response/weblog/2007/06/bad_bunny.html.
10. ↑ Kissling, Kristian (December 2009). "Malicious Screensaver: Malware on Gnome-Look.org". http://www.ubuntu-user.com/Online/News/Malicious-Screensaver-Malware-on-Gnome-Look.org.
11. ↑ "IBM Security Report: Attacks on Industries Supporting COVID-19 Response Efforts Double". https://newsroom.ibm.com/2021-02-24-IBM-Security-Report-Attacks-on-Industries-Supporting-COVID-19-Response-Efforts-Double.
12. ↑ "Discontinuation of Antivirus solutions for Linux systems on June 30th 2016". http://www.avira.com/en/support-for-home-knowledgebase-detail/kbid/1491.
13. ↑ "ClamAV". http://www.clamav.net/.
14. ↑ Comodo Group (2015). "Comodo Antivirus for Linux". https://www.comodo.com/home/internet-security/antivirus-for-linux.php.
15. ↑ 15.0 15.1 "Dr.Web anti-virus for Linux". Dashke. http://products.drweb.com/linux/.
16. ↑ FRISK Software International (2011). "F-PROT Antivirus for Linux x86 / BSD x86". http://www.f-prot.com/products/corporate_users/unix/.
17. ↑ "Kaspersky Linux Security - Gateway, mail and file server, workstation protection for Linux/FreeBSD". Kaspersky Lab. http://www.kaspersky.com/linux.
18. ↑ "McAfee VirusScan Enterprise for Linux". McAfee. http://www.mcafee.com/us/products/virusscan-enterprise-for-linux.aspx.
19. ↑ "Panda Security Antivirus Protection for Linux". Panda Security. http://www.pandasecurity.com/spain/homeusers/solutions/linux/.
20. ↑ Symantec (January 2009). "System requirements for Symantec AntiVirus for Linux 1.0". http://service1.symantec.com/SUPPORT/ent-security.nsf/ppfdocs/2005110716014248.
21. ↑ "chkrootkit -- locally checks for signs of a rootkit". http://www.chkrootkit.org/.
22. ↑ "ClamavNet". http://www.clamav.net/.
23. ↑ "COMODO Antivirus for Linux (CAVL) v1.1.268025.1 is released!". comodo.com. 2013-02-28. http://forums.comodo.com/comodo-antivirus-for-linux-cavl/comodo-antivirus-for-linux-cavl-v112680251-is-released-t92199.0.html.
24. ↑ "ESET File Security - Antivirus Protection for Linux, BSD, and Solaris". Eset. http://www.eset.com/int/home/products/antivirus-linux/.
25. ↑ "ESET Mail Security - Linux, BSD, and Solaris mail server protection". Eset. http://www.eset.com/products/linux_mail.php.
26. ↑ "ESET NOD32 Antivirus for Linux Gateway Devices". Eset. http://www.eset.com/products/gateway.php.
27. ↑ "ESET NOD32 Antivirus 4 for Linux Desktop". Eset. http://www.eset.com/us/download/home/detail/family/71/#offline,98,ENU.
28. ↑ "KVRT for Linux: Malware scanner for Linux systems". 30 May 2024. https://www.kaspersky.com/blog/kvrt-for-linux/51375/.
29. ↑ https://www.rfxn.com/projects/linux-malware-detect/ R-fx Networks project page of LMD
30. ↑ "Lynis - Security auditing and hardening tool for Linux/Unix". https://cisofy.com/lynis/.
31. ↑ "Lynis: Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional. - CISOf..". September 7, 2019. https://github.com/CISOfy/lynis.
32. ↑ "Root Kit Hunter". http://www.rootkit.nl/projects/rootkit_hunter.html.
33. ↑ "samhain The SAMHAIN file integrity / host-based intrusion detection system". https://la-samhna.de/samhain/.
34. ↑ "Botnets, a free tool and 6 years of Linux/Rst-B | Naked Security". Nakedsecurity.sophos.com. 2008-02-13. http://nakedsecurity.sophos.com/2008/02/13/botnets-a-free-tool-and-6-years-of-linuxrst-b/.
35. ↑ "Free Linux Malware Scanner | Lightweight Agent for Linux Malware Detection and Removal | Sophos". https://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-linux.aspx.
36. ↑ "Forcepoint". https://www.forcepoint.com/.
37. ↑ volatilesystems.com
38. ↑ "Google Code Archive - Long-term storage for Google Code Project Hosting.". https://code.google.com/archive/p/volatility/wikis/LinuxMemoryForensics.wiki.
39. ↑ Kovalev et al (17 July 2014), Mayhem – a hidden threat for *nix web servers , Virus Bulletin
40. ↑ "Meet Remaiten - a Linux bot on steroids targeting routers and potentially other IoT devices". WeLiveSecurity. 30 March 2016. http://www.welivesecurity.com/2016/03/30/meet-remaiten-a-linux-bot-on-steroids-targeting-routers-and-potentially-other-iot-devices/.
41. ↑ "Threat Detail - ESET Virusradar". virusradar.com. http://www.virusradar.com/en/Linux_Remaiten/detail.
42. ↑ Mohit Kumar (31 March 2016). "Advanced Malware targeting Internet of the Things and Routers". The Hacker News. http://thehackernews.com/2016/03/internet-of-thing-malware.html.
43. ↑ njccic (December 28, 2016). "Mirai Botnet". The New Jersey Cybersecurity and Communications Integration Cell (NJCCIC). https://www.cyber.nj.gov/threat-profiles/botnet-variants/mirai-botnet.
44. ↑ Krebs, Brian (September 21, 2016). "KrebsOnSecurity Hit With Record DDoS". Brian Krebs. https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/.
45. ↑ Hackett, Robert (October 3, 2016). "Why a Hacker Dumped Code Behind Colossal Website-Trampling Botnet". Fortune.com. http://fortune.com/2016/10/03/botnet-code-ddos-hacker/.
46. ↑ Newman, Lily Hay. "What We Know About Friday's Massive East Coast Internet Outage" (in en-US). WIRED. https://www.wired.com/2016/10/internet-outage-ddos-dns-dyn/.
47. ↑ Liam Tung (September 25, 2014). "First attacks using shellshock Bash bug discovered". ZDNet. https://www.zdnet.com/article/first-attacks-using-shellshock-bash-bug-discovered/.
48. ↑ Catalin Cimpanu (September 5, 2016). "LuaBot Is the First DDoS Malware Coded in Lua Targeting Linux Platforms". Softpedia. http://news.softpedia.com/news/luabot-is-the-first-botnet-malware-coded-in-lua-targeting-linux-platforms-507978.shtml.
49. ↑ Catalin Cimpanu (September 17, 2016). "LuaBot Author Says His Malware Is "Not Harmful"". Softpedia. http://news.softpedia.com/news/luabot-author-says-his-malware-is-not-harmful-508397.shtml.
50. ↑ Infodox (June 12, 2012). "Hydra IRC bot, the 25 minute overview of the kit". Insecurety Research. http://insecurety.net/?p=90.
51. ↑ Dan Goodin (March 21, 2013). "Guerilla researcher created epic botnet to scan billions of IP addresses". Ars Technica. https://arstechnica.com/security/2013/03/guerilla-researcher-created-epic-botnet-to-scan-billions-of-ip-addresses/.
52. ↑ John Leyden (September 9, 2014). "Use home networking kit? DDoS bot is BACK... and it has EVOLVED". The Register. https://www.theregister.co.uk/2014/09/09/linux_modem_bot/.
53. ↑ John Leyden (October 31, 2016). "A successor to Mirai? Newly discovered malware aims to create fresh IoT botnet". The Register. https://www.theregister.co.uk/2016/10/31/iot_botnet_wannabe/.
54. ↑ unixfreaxjp (November 28, 2016). "MMD-0061-2016 - EnergyMech 2.8 Overkill Mod". MalwareMustDie. http://blog.malwaremustdie.org/2016/11/mmd-0061-2016-emech-for-ddos.html.
55. ↑ "Linux.Encoder.1". drweb.com. https://vms.drweb.com/virus/?i=7703983&lng=en.
56. ↑ Lucian Constantin (10 November 2015). "First Linux ransomware program cracked, for now". Computerworld. http://www.computerworld.com/article/3003461/security/first-linux-ransomware-program-cracked-for-now.html.
57. ↑ "Lilocked". https://www.bleepingcomputer.com/news/security/lilocked-ransomware-actively-targeting-servers-and-web-sites/.
58. ↑ Goud, Naveen (September 6, 2019). "LiLocked Ransomware hits Linux Servers". https://www.cybersecurity-insiders.com/lilocked-ransomware-hits-linux-servers/.
59. ↑ Leyden, John ( 21 November 2012), Evildoers can now turn all sites on a Linux server into silent hell-pits , The Register, retrieved 21 November 2012
60. ↑ "Custom "Pygmy Goat" malware used in Sophos Firewall hack on govt network". https://www.bleepingcomputer.com/news/security/custom-pygmy-goat-malware-used-in-sophos-firewall-hack-on-govt-network/.
61. ↑ Kovalev et al Effusion – a new sophisticated injector for Nginx web servers , Virus Bulletin
62. ↑ rsa.com. "Thieves Reaching for Linux—"Hand of Thief" Trojan Targets Linux #INTH3WILD » Speaking of Security - The RSA Blog and Podcast". Blogs.rsa.com. https://blogs.rsa.com/thieves-reaching-for-linux-hand-of-thief-trojan-targets-linux-inth3wild/.
63. ↑ Vaughan, Steven J.. "Linux desktop Trojan 'Hand of Thief' steals in". ZDNet. https://www.zdnet.com/home-and-office/networking/linux-desktop-trojan-hand-of-thief-steals-in/.
64. ↑ Florio, Elia (February 2006). "Linux.Backdoor.Kaiten". http://www.symantec.com/security_response/writeup.jsp?docid=2006-021417-0144-99.
65. ↑ Florio, Elia (December 2007). "Linux.Backdoor.Rexob". http://www.symantec.com/security_response/writeup.jsp?docid=2007-072612-1704-99.
66. ↑ Vervloesem, Koen (December 2009). "Linux malware: an incident and some solutions". https://lwn.net/Articles/367874/.
67. ↑ "Backdoor.Linux.Tsunami.gen". Securelist. https://w.securelist.com/en/descriptions/backdoor.linux.tsunami.gen.
68. ↑ "The 'Penquin' Turla - Securelist". securelist.com. 8 December 2014. https://securelist.com/blog/research/67962/the-penquin-turla-2/.
69. ↑ Joey-Elijah Sneddon (9 December 2014). "Yes, This Trojan Infects Linux. No, It's Not The Tuxpocalypse - OMG! Ubuntu!". OMG! Ubuntu!. http://www.omgubuntu.co.uk/2014/12/government-spying-turla-linux-trojan-found.
70. ↑ unixfreaxjp.wirehack7, shibumi (September 29, 2014). "Linux/XOR.DDoS : Fuzzy reversing a new China ELF". MalwareMustDie. http://blog.malwaremustdie.org/2014/09/mmd-0028-2014-fuzzy-reversing-new-china.html.
71. ↑ Akamai Technologies (29 September 2015). "OR DDoS Botnet Launching 20 Attacks a Day From Compromised Linux Machines, Says Akamai". https://www.akamai.com/us/en/about/news/press/2015-press/xor-ddos-botnet-attacking-linux-machines.jsp.
72. ↑ Samuel Gibbs (6 July 2016). "HummingBad malware infects 10m Android devices". https://www.theguardian.com/technology/2016/jul/06/hummingbad-malware-infects-10m-android-devices-information-apps-ads.
73. ↑ David Bisson (October 17, 2016). "NyaDrop exploiting Internet of Things insecurity to infect Linux devices with malware". Graham Cluley. https://www.grahamcluley.com/nyadrop-exploiting-iot-insecurity-infect-devices-malware/.
74. ↑ Catalin Cimpanu (August 25, 2016). "PNScan Linux Trojan Resurfaces with New Attacks Targeting Routers in India". Softpedia. http://news.softpedia.com/news/pnscan-linux-trojan-resurfaces-with-new-attacks-targeting-routers-in-india-507617.shtml.
75. ↑ Tara Seals (February 4, 2019). "SpeakUp Linux Backdoor Sets Up for Major Attack". https://threatpost.com/speakup-linux-backdoor/141431/.
76. ↑ herm1t (August 2008). "Linux.42: Using CRC32B (SSE4.2) instruction in polymorphic decryptor". http://vx.eof-project.net/viewtopic.php?pid=1049.
77. ↑ Ferrie, Peter (September 2008). "Life, the Universe, and Everything". http://blogs.technet.com/mmpc/archive/2008/09/10/life-the-universe-and-everything.aspx.
78. ↑ herm1t (August 2006). "Infecting ELF-files using function padding for Linux". http://vx.netlux.org/lib/vhe00.html.
79. ↑ Kaspersky Lab (May 2007). "Virus.Linux.Alaeda". http://www.viruslist.com/en/viruses/encyclopedia?virusid=21703.
80. ↑ McAfee (December 2004). "Linux/Binom". http://vil.nai.com/vil/content/v_130506.htm.
81. ↑ Rieck, Konrad and Konrad Kretschmer (August 2001). "Brundle Fly 0.0.1 - A Good-Natured Linux ELF Virus". http://www.roqe.org/brundle-fly/.
82. ↑ de Almeida Lopes, Anthony (July 2007). "Project Bukowski". https://sourceforge.net/projects/bukowski/.
83. ↑ herm1t (February 2008). "Caveat virus". http://www.vxheavens.com/lib/vhe06.html.
84. ↑ Ferrie, Peter (July 2009). "Can you spare a seg?". http://vx.netlux.org/lib/apf29.html.
85. ↑ TMZ (January 2019). "Linux.Cephei - ESET Virusradar". http://www.virusradar.com/en/Linux_Cephei.A/description.
86. ↑ herm1t (October 2007). "Reverse of a coin: A short note on segment alignment". http://www.vxheavens.com/lib/vhe04.html.
87. ↑ Ferrie, Peter (September 2009). "Heads or tails?". http://vx.netlux.org/lib/apf31.html.
88. ↑ herm1t (October 2007). "Hashin' the elves". http://www.vxheavens.com/lib/vhe02.html.
89. ↑ Ferrie, Peter (August 2009). "Making a hash of things". http://vx.netlux.org/lib/apf30.html.
90. ↑ herm1t (June 2008). "README". http://vx.netlux.org/herm1t/Lacrimae_EN.txt.
91. ↑ Ferrie, Peter (February 2008). "Crimea river". http://vx.netlux.org/lib/apf12.html.
92. ↑ Kaspersky Lab (December 2001). "Virus.Linux.Nuxbee.1403". http://www.viruslist.com/en/viruses/encyclopedia?virusid=21725.
93. ↑ herm1t (November 2007). "INT 0x80? No, thank you!". http://www.vxheavens.com/lib/vhe05.html.
94. ↑ Ferrie, Peter (September 2009). "Flying solo". http://vx.netlux.org/lib/apf37.html.
95. ↑ Ferrie, Peter (April 2007). "Linux.Podloso". http://www.symantec.com/business/security_response/writeup.jsp?docid=2007-040516-4947-99.
96. ↑ Ferrie, Peter (April 2007). "The iPod virus". http://www.symantec.com/enterprise/security_response/weblog/2007/04/the_ipod_virus.html.
97. ↑ herm1t (December 2009). "From position-independent to self-relocatable viral code". http://www.vxheavens.com/lib/vhe08.html.
98. ↑ Kaspersky Lab (August 2003). "Virus.Linux.Rike.1627". http://www.viruslist.com/en/viruses/encyclopedia?virusid=21733.
99. ↑ Kaspersky Lab (January 2002). "Virus.Linux.RST.a". http://www.viruslist.com/en/viruses/encyclopedia?virusid=21734.
100. ↑ "The ways of viruses in Linux HOW SAFE?". http://www.linux-magazine.com/w3/issue/62/Viruses_in_Linux.pdf.
101. ↑ Kaspersky Lab (March 2000). "Virus.Linux.Vit.4096". http://www.viruslist.com/en/viruslist.html?id=3135&key=00001000050000200003.
102. ↑ Kaspersky Lab (October 2000). "Virus.Linux.Winter.341". http://www.viruslist.com/en/viruses/encyclopedia?virusid=21756.
103. ↑ Rautiainen, Sami (March 2001). "F-Secure Virus Descriptions: Lindose". http://www.f-secure.com/v-descs/lindose.shtml.
104. ↑ "The Wit Virus: A virus built on the ViT ELF virus". http://members.hellug.gr/nmav/papers/other/wit-virus.pdf.
105. ↑ TMZ (January 2015). "Linux.Zariche - ESET Virusradar". http://www.virusradar.com/en/Linux_Zariche.A/description.
106. ↑ Kaspersky Lab (January 2001). "Virus.Linux.ZipWorm". http://www.viruslist.com/en/viruses/encyclopedia?virusid=21759.
107. ↑ Kaspersky Lab (May 2001). "Net-Worm.Linux.Adm". http://www.viruslist.com/en/viruses/encyclopedia?virusid=23854.
108. ↑ Rautiainen, Sami (April 2001). "F-Secure Virus Descriptions: Adore". http://www.f-secure.com/v-descs/adore.shtml.
109. ↑ Smith, Stuart (May 2007). "Perl.Badbunny". http://www.symantec.com/security_response/writeup.jsp?docid=2007-052400-3656-99.
110. ↑ Kaspersky Lab (May 2001). "Net-Worm.Linux.Cheese". http://www.viruslist.com/en/viruses/encyclopedia?virusid=23856.
111. ↑ Rautiainen, Sami (April 2001). "F-Secure Virus Descriptions: Kork". http://www.f-secure.com/v-descs/kork.shtml.
112. ↑ Mohit Kumar (2013-11-30). "Linux worm targeting Routers, Set-top boxes and Security Cameras with PHP-CGI Vulnerability". The Hacker News. http://thehackernews.com/2013/11/Linux-ELF-malware-php-cgi-vulnerability.html.
113. ↑ Joe Casad (3 December 2013). "New Worm Attacks Linux Devices". Linux Magazine. http://www.linux-magazine.com/Online/News/New-Worm-Attacks-Linux-Devices.
114. ↑ McAfee (June 2005). "Linux/Lupper.worm Description". http://vil.nai.com/vil/content/v_136821.htm.
115. ↑ Kaspersky Lab (October 2002). "Net-Worm.Linux.Mighty". http://www.viruslist.com/en/viruses/encyclopedia?virusid=23864.
116. ↑ Perriot, Frederic (February 2007). "Linux.Millen.Worm". http://www.symantec.com/security_response/writeup.jsp?docid=2002-121114-1432-99.
117. ↑ Rautiainen, Sami (September 2002). "F-Secure Virus Descriptions: Slapper". http://www.f-secure.com/v-descs/slapper.shtml.
118. ↑ Voss, Joel (December 2007). "SSH Bruteforce Virus by AltSci Concepts". https://www.altsci.com/concepts/virus/.

## External links

* Linuxvirus on the Official Ubuntu Documentation

* v
* t
* e

Linux

Linux kernel|

* History
* Kernel
* Linus's law
* Linux-libre
* Linux startup process
* Linux kernel oops
* Tux
* more…

Controversies|

* Criticism of Linux
* Criticism of desktop Linux
* GNU/Linux naming controversy
* Tanenbaum–Torvalds debate
* SCO and Linux

Distributions|

* General comparison
* Distributions list
* Netbook-specific comparison
* Distributions that run from RAM
* Lightweight
* Security-focused operating system
* Proprietary software for Linux
* Package manager
* Package format
* List of software package managers

Organizations|

* LinuxChix
* Linux Counter
* Linux Documentation Project
* Linux Foundation
* Linux Mark Institute
* Linux User Group (LUG)

Adoption|

* Adopters
* Desktop
* Embedded
* Gaming
* Mobile
* Range of use

Media|

* DistroWatch
* Free Software Magazine
* Full Circle
* Linux.com
* Linux Format
* Linux Gazette
* Linux Journal
* Linux Magazine
* LinuxUser
* Ubuntu User
* Linux Outlaws
* Linux Voice
* LugRadio
* LWN.net
* Open Source For You
* Phoronix
* Revolution OS
* The Code

* Linux
* Linux kernel features
* Portal
* WikiProject

* v
* t
* e

Malware topics

Infectious malware|

* Comparison of computer viruses
* Computer virus
* Computer worm
* List of computer worms
* Timeline of computer viruses and worms

Concealment|

* Backdoor
* Clickjacking
* Man-in-the-browser
* Man-in-the-middle
* Man-in-the-mobile
* Rootkit
* Trojan horse
* Zombie computer

Malware for profit|

* Adware
* Botnet
* Crimeware
* Form grabbing
* Fraudulent dialer
* Malbot
* Keystroke logging
* Privacy-invasive software
* Ransomware
* Rogue security software
* Scareware
* Spyware
* Web threats

By operating system|

* Android malware
* Classic Mac OS viruses
* iOS malware
* Linux malware
* MacOS malware
* Macro virus
* Mobile malware
* Palm OS viruses

Protection|

* Anti-keylogger
* Antivirus software
* Browser security
* Data loss prevention software
* Defensive computing
* Firewall
* Internet security
* Intrusion detection system
* Mobile security
* Network security

Countermeasures|

* Computer and network surveillance
* Honeypot
* Bot Roast

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Linux malware. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Linux_malware&oldid=4152735"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template