Could you elaborate a bit on that? Like what would you suggest apart from the obvious things like updating, not downloading weird stuff and limit open ports to the minimum and stuff like that?
Basically that. Using software with firejail and apparmor. Making a security audit with lynis.
Getting more knowledgeable about open ports and what software is able to do.
It already is pretty rampant, however most Linux admins have minimal if any detection strategy.
Additionally, while there’s plenty of binaries about like VoidLink, almost all campaigns against Linux hosts target SSH, or RCE vulnerabilities, and deliver shell scripts that orchestrate the attack.
Why compile a binary when the shell has everything you need? The threat models are pretty different between Windows and the *nix world.
When you look at botnet composition, they’re usually made up of outdated Linux hosts with SSH open with password-based authentication.
Seriously people, switch to key-based auth and disable password auth entirely.
I forgot but do browsers download binaries as executable?
One of the big issues with windows is the fact that it uses file extensions for determining file type, so EXEs can just be instantly run after downloading, which led to MSFT making the "Mark Of Th Web" attribute, which moved hackers into finding every type of bypass for MOTW.
I think straight bin downloads require you to chmod +x first, but you could also probably bypass it with any archive format like .tar.gz or opting for a .deb or .rpm.
The upside is that you really shouldn't be downloading raw bins outside of the package manager, but there are a bunch of tools that only ship as appimages, so you're kinda screwed if you download and execute from an untrusted source.
You are not the only thing capable of running binaries on your system. There's always the possibility of something else being compromised that now has the capability to run this binary.
Security comes in many layers on top of each other and with software having to work together to plug all possible holes, not just the direct exploitation paths you are currently actively conscious about and using.
I can't emphasize enough, how much I and ol most others, could not give two fucks about hardening a home desktop. Just fine me a button. I don't want to be trying passwords.
Isn't it already the case to steal from companies? I don't know if things like Shai Hulud 2.0 qualifies as malware. Companies are much more lucrative targets so I am not sure personal Linux is changing much.
Isn't there a video on YouTube of a person trolling a scammer like this? The guy skinned Linux to look like Windows and then gave a phone scammer remote access to their PC and watched him get more and more frustrated and confused by why it wasn't working properly
Jokes aside, the fact that Wine defaults to mounting your entire drive to the fake Windows environment is a major security issue. This whole project is a very impressive engineering feat but the user experience is so bad it can have disastrous consequences.
wine also lets windows executables call any syscall of the host, a malware could attempt to detect wine and just call posix syscalls even if you dont mount your drive to the virtual windows enviroment, this also means that flatpak or bubblewrap doesnt do as much as you would hope for
47 Comments
django@discuss.tchncs.de · 226 pts · 174d
germanatlas@lemmy.blahaj.zone · 78 pts · 174d
Giving the little buddy a chance
0ops@piefed.zip · 11 pts · 173d
It's just good sportsmanship
umbrella@lemmy.ml · 5 pts · 173d
minfapper@piefed.social · 147 pts · 174d
Unfortunately, it's only a matter of time until native Linux malware becomes more rampant
MissyBee@lemmy.blahaj.zone · 38 pts · 174d
Yeah, got me into Linux hardening.
gigachad@piefed.social · 26 pts · 174d
Could you elaborate a bit on that? Like what would you suggest apart from the obvious things like updating, not downloading weird stuff and limit open ports to the minimum and stuff like that?
errer@lemmy.world · 76 pts · 174d
Well, whenever you talk about Linux, you gotta get real hard.
Honytawk@feddit.nl · 40 pts · 173d
jaybone@lemmy.zip · 24 pts · 173d
I use starch, btw.
OrganicMustard@lemmy.world · 22 pts · 174d
Check this page, it's mostly applicable to all distros
MissyBee@lemmy.blahaj.zone · 11 pts · 173d
Basically that. Using software with firejail and apparmor. Making a security audit with lynis. Getting more knowledgeable about open ports and what software is able to do.
Whostosay@sh.itjust.works · 3 pts · 174d
I also would like to know
fartsparkles@lemmy.world · 31 pts · 174d
It already is pretty rampant, however most Linux admins have minimal if any detection strategy.
Additionally, while there’s plenty of binaries about like VoidLink, almost all campaigns against Linux hosts target SSH, or RCE vulnerabilities, and deliver shell scripts that orchestrate the attack.
Why compile a binary when the shell has everything you need? The threat models are pretty different between Windows and the *nix world.
When you look at botnet composition, they’re usually made up of outdated Linux hosts with SSH open with password-based authentication.
Seriously people, switch to key-based auth and disable password auth entirely.
mlg@lemmy.world · 18 pts · 174d
I forgot but do browsers download binaries as executable?
One of the big issues with windows is the fact that it uses file extensions for determining file type, so EXEs can just be instantly run after downloading, which led to MSFT making the "Mark Of Th Web" attribute, which moved hackers into finding every type of bypass for MOTW.
I think straight bin downloads require you to chmod +x first, but you could also probably bypass it with any archive format like .tar.gz or opting for a .deb or .rpm.
The upside is that you really shouldn't be downloading raw bins outside of the package manager, but there are a bunch of tools that only ship as appimages, so you're kinda screwed if you download and execute from an untrusted source.
ViatorOmnium@piefed.social · 32 pts · 173d
The weak link on Linux is the number of tools that trained the users to
curl ... | bashklymilark@herbicide.fallcounty.omg.lol · 4 pts · 173d
Sometimes! I've definitely had some executable files that have downloaded with the x bit flagged.
Retail4068@lemmy.world · -11 pts · 174d
You can kindly fuck off with this level of hand holding lol. Forcing me to +x by default is a massive pain in the ass.
0x0@infosec.pub · 16 pts · 173d
Forcing you to +x is the opposite of handholding. Do you want sudo to wipe your ass as well?
Retail4068@lemmy.world · 0 pts · 173d
Year of the Linux desktop 2026.
TimeSquirrel@kbin.melroy.org · 6 pts · 173d
You are not the only thing capable of running binaries on your system. There's always the possibility of something else being compromised that now has the capability to run this binary.
Security comes in many layers on top of each other and with software having to work together to plug all possible holes, not just the direct exploitation paths you are currently actively conscious about and using.
Retail4068@lemmy.world · 0 pts · 173d
I can't emphasize enough, how much I and ol most others, could not give two fucks about hardening a home desktop. Just fine me a button. I don't want to be trying passwords.
biotin7@sopuli.xyz · 6 pts · 174d
Reminder, that once a vulnerability is found, it disappears, FOREVERRRRRR
You don't get that with windows.
oce@jlai.lu · 6 pts · 174d
Isn't it already the case to steal from companies? I don't know if things like Shai Hulud 2.0 qualifies as malware. Companies are much more lucrative targets so I am not sure personal Linux is changing much.
Rothe@piefed.social · 5 pts · 174d
That is indeed one of the unfortunate but inevitable results of the OS becoming more popular.
Sibbo@sopuli.xyz · 113 pts · 174d
Open an issue in wine, tell them that not supporting malware robs you of the true native windows experience.
django@discuss.tchncs.de · 26 pts · 174d
Try ReactOS for this experience: https://reactos.org/
bilb@lemmy.ml · 2 pts · 173d
umbrella@lemmy.ml · 1 pts · 173d
jaybone@lemmy.zip · 59 pts · 173d
These Indian scammers keep calling me telling me I have a virus and I need to go to start menu.
I don’t even have a start menu. 🤷
cRazi_man@europe.pub · 49 pts · 173d
Isn't there a video on YouTube of a person trolling a scammer like this? The guy skinned Linux to look like Windows and then gave a phone scammer remote access to their PC and watched him get more and more frustrated and confused by why it wasn't working properly
DudeImMacGyver@kbin.earth · 9 pts · 173d
Fucking with scammers and spammers is a wonderful past time!
Dasus@lemmy.world · 8 pts · 173d
I don't know, but I need to see that.
jaybone@lemmy.zip · 8 pts · 173d
That’s awesome. Do you have a link?
Johanno@feddit.org · 10 pts · 173d
Pretty sure it was either kitboga or there are several people who did this. You should find it easily on YouTube
idealotus@lemmy.world · 46 pts · 174d
tries to install with wine anyway
SkaveRat@discuss.tchncs.de · 26 pts · 174d
while running wine with sudo
Alawami@lemmy.ml · 12 pts · 174d
inside flatpak with tight permissions anyway.
wreckedcarzz@lemmy.world · 17 pts · 174d
Oh yeah baby, give me those tight permissions uwu
kamen@lemmy.world · 43 pts · 173d
You need Wine for that
/s
SomethingBurger@jlai.lu · 45 pts · 173d
Jokes aside, the fact that Wine defaults to mounting your entire drive to the fake Windows environment is a major security issue. This whole project is a very impressive engineering feat but the user experience is so bad it can have disastrous consequences.
protogen420@lemmy.blahaj.zone · 22 pts · 173d
wine also lets windows executables call any syscall of the host, a malware could attempt to detect wine and just call posix syscalls even if you dont mount your drive to the virtual windows enviroment, this also means that flatpak or bubblewrap doesnt do as much as you would hope for
muhyb@programming.dev · 10 pts · 173d
You can install Wine as flatpak. That should solve some of the issue.
corsicanguppy@lemmy.ca · 4 pts · 173d
Wow. You found a way to make wine's issues worse by adding the supply-chain risk on top.
Alvaro@lemmy.blahaj.zone · 20 pts · 173d
For the millionth time, wine is still a path for viruses. This virus can still run if you have wine and it can still do damage. Wine is not a sandbox.
Evil_Shrubbery@thelemmy.club · 16 pts · 174d
Omg, it's 2026, just use wine to run it, I'm sure it's seamless by now.
WorldsDumbestMan@lemmy.today · 11 pts · 173d
When the hacker tries to run an npm package to backdoor my linux, but it gives 23 errors.
twinnie@feddit.uk · 11 pts · 174d
I think 50% of the posts on here are this meme.
frank@lemmy.fraxoweb.com · 4 pts · 173d
I will definitely open all .exe with such a cool icon.
Retail4068@lemmy.world · 3 pts · 174d
Skill issue.