this post was submitted on 11 Jan 2024
118 points (89.3% liked)

Technology

34698 readers
402 users here now

This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.

Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.

Rules:

1: All Lemmy rules apply

2: Do not post low effort posts

3: NEVER post naziped*gore stuff

4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.

5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)

6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist

7: crypto related posts, unless essential, are disallowed

founded 5 years ago
MODERATORS
[email protected]
118
Linux devices are under attack by a never-before-seen worm (arstechnica.com)
submitted 9 months ago by [email protected] to c/[email protected]
18 comments fedilink hide all child comments
 

Based on Mirai malware, self-replicating NoaBot installs cryptomining app on infected devices.

top 18 comments
sorted by: hot top controversial new old
[–] [email protected] 26 points 9 months ago (1 children)

the NoaBot targets weak passwords connecting SSH connections.

Harden your configs people.

AllowUsers is a really goood one.

[–] [email protected] 18 points 9 months ago (1 children)

Or just don't allow password auth at all.

[–] [email protected] 1 points 9 months ago (1 children)

Or just have a good password

[–] [email protected] 2 points 9 months ago (2 children)

If we're going to play that game. Require an Ed25519 key with a strong password.

[–] [email protected] 2 points 9 months ago

Or ed25519-sk.

[–] [email protected] 1 points 9 months ago

https://imgs.xkcd.com/comics/security.png

(In this case the "wrench" is just breaking into some weak link that isn't ssh, once your password is strong to not be a weak link)

[–] [email protected] 17 points 9 months ago (2 children)

Akamai has published an extensive library of indicators that people can use to check for signs of NoaBot on their devices (https://github.com/akamai/akamai-security-research/tree/main)

GCs those Akamai folks...

[–] [email protected] 10 points 9 months ago (6 children)
[–] [email protected] 10 points 9 months ago

Good cunts - it's originally an Aussie term of endearment, as far as I'm aware

[–] [email protected] 6 points 9 months ago

Garbage Collection

[–] [email protected] 5 points 9 months ago* (last edited 9 months ago)

What does GC stand for?

Girthy Cocks maybe?
As a compliment, u noe?
Like saying they have Balls of Steel.

[–] [email protected] 4 points 9 months ago

Game Cube

[–] [email protected] 3 points 9 months ago

In this context i'm going with Game Chick from that list, because none make sense to me.

[–] [email protected] 8 points 9 months ago (1 children)

here's a link to the script. its nothing fancy, but makes it easy to check: https://github.com/akamai/akamai-security-research/blob/main/malware/noabot/noabot_detect.sh

[–] [email protected] 4 points 9 months ago

here’s a link to the script.

"MagicPussy" doesn't sound that bad. 😏

[–] [email protected] 6 points 9 months ago

Very poor title, like someone's just got their "Big Book of Clickbait"

Everything is under attack all the time, and everything is never-before-seen until it's seen.

[–] [email protected] 2 points 9 months ago

I love how in security, we have gone from "use strong passwords" to "don't make your own passwords", because people will just refuse to learn.