FeriCyde Chat: The Linux Virus Threat List for 2005

FeriCyde Chat

The Comprehensive 2005 Linux Virus Threat List

L0NGH0RN.Wh3N? (L0ngh0rn)

There's even speculation that they've conspired in the past with the the NSA to allow them to eavesdrop on SSL sessions a few years ago with W1nd0ze9x and W1nd0zNT variants. This raised eyebrows in the press several years back but was quickly forgotten. During the Y2K scare, there were two confusing (and incompatible) infectious outbreaks, one called W1nM3, and the other W1n2K. Released about the same time, many people wondered why the crackers even bothered.

L0ngh0rn follows a long tradition of similar viri. The cracker group comes up with an ominous-sounding name like Ch1C4G0 or C41r0w. Then they proceed to chat it up to the mainstream press, telling them what an awesome vector of destruction it's going to be, wiping out everything in its path upon infection. This typically causes mainstream journalists to wax prophetic about the new threat the virus is going to pose and of course all of the damage it's going to inflict upon installed software and operating systems. To the journalists credit, the wreckage from the infection of every one of these babies has truly cost corporate America a bundle.

After multiple deadlines have passed, the virus finally does appear. At that point the ominous features that were supposed to make it so potent turn out to be mediocre, undelivered, or worse, comical.

Recommended cleanup techniques:
The recommended cleanup of L0ngh0rn is a two-pronged approach. If the band of crackers is to believed, this virus won't really infect it's first computer until 2007. A lot of industry insiders suspect that it's really not due to strike until 2008 or later, and even then with a reduced impact. This gives a person plenty of time to prepare not just the technology, but co-workers' mental attitudes.

To address this mis-perception, remind co-workers what a lame threat the prior 3 or 4 variants were and that really good anti-virus software is shipping right now that can address the threat directly.

Demonstrate this by loading any one of the GNU/Linux or *BSD anti-virus software packages with any one of the latest virus definitions found free, right off of the Internet. These products will help you lock down your current desktop or server and avoid the headache and worry created by the threat of impending doom. Better still, your co-workers can sleep better knowing that the enterprise is more secure.

M0r0nic.An4lyzt (M0r0Nz!)

For example, instead of the usual boot messages, in its first incarnation M0r0Nz! would continuously cause the text "Linux will never be mainstream!" to appear on the console and in console-enabled terminal windows. The next year the same virus appeared with an only slightly different message: "Linux will never be ready for the enterprise!"

This was followed the next year by a similar virus that spat more ominous warnings of squashing by Microsoft. Then the next year by numerous text that contained the words TCO. Last years version was even less creative, the TCO being changed by one count to SCO. As a matter of fact, the SCO messages printed so often most users didn't even bother to clean their computer of the virus. After all, like all prior versions, the program is in fact a simple annoyance that does no harm if you ignore it. Most intermediate to advanced administrators simply wrote small shell scripts to pipe the output to /dev/null.

Kernel messages indicating an infection by M0r0Nz!:

• Text with "Linux" or "Free Software" or "Open Source", and "doomed to failure".
• "The Linux Desktop: R.I.P.".
• "Linux ... Get the facts!".
• "intellectual property", "Linux" and "communists".

Recent variants have even more desperately funny text:

• "System lacks interoperability!"
• "Kernel will need to be re-written!"

Recommended cleanup techniques:
Cleanup of the M0r0nicAn4lyzt virus is straightforward. When co-workers fall victim to it, either load anti-virus software that cleans the computer of the virus (IBM is rumored to have the best), or point out the fact that prior versions of the software were pointless, and so is this threat for the same reasons. It might help to find the source of the infection and send an email to the administrator with helpful tips on how they can clean their computers of infection. Remember to be polite at all times when doing this.

F14KyC0W0rKRZ (FLKYZ)

For example, a recent coworker who was happily using Fedora became infected with FLKYZ, and found himself installing Gentoo. Fortunately for him, one of his friends knew all about Gentoo, helping him get up to speed in a fairly short while (2 weeks), only to find that the (still infected) computer was prompting him to switch to Debian.

Again, the coworker's friend came to the rescue, having converted to Debian himself the week prior, and offering all kinds of cool tips and heaping tons of praise on what a great distribution Debian was in comparison to Gentoo. This was followed the next week with yet another infection-prompted switch to Zandros.

Zandros beget Suse and so on until the coworker cleaned Linux off of his computer completely, sold it in frustration and bought a Mac. The sad part came later, when surprisingly enough, the source computer that was spreading the virus turned out to belong to none other than the friend that was constantly "helping" the coworker switch distributions.

FLKYZ's damage is done in an insidious way: Computers infected with it tend to get loaded and reloaded with operating systems instead of being used for actual work. This leads the computer user to the erroneous belief that Linux is more of a headache than a joy.

Recommended cleanup techniques:
Cleanup of the F14KyC0W0rKRZ virus is usually as straightforward as having the infected party switch back to a clean copy of the distribution they're most familiar with. Be careful not to suggest they switch to your own favorite, but rather the one that they can most easily identify with, and therefore lock down the most securely. It doesn't hurt to scan the local office environment for the source of infection and place a piece of duct tape over the network interface of the infected computer. You should also try to educate the owner of the computer such that future outbreaks of FLKYZ can be avoided.

Search.eng1ne.FUD(S.e.F)

The good news is that the third version seems to have been caught fairly early before it could spread much beyond the usual entry points. Prior outbreaks drew more serious attention and far more imbalance in the press. Fortunately, cooler heads and a more in-depth understanding yielded a correct response this year -- Laughter and an understanding that this virus is indeed extremely harmless.

Recommended cleanup techniques:
Cleanup programs to remove the S3F virus are extremely easy to locate. Simply use google.com to search for the best removal tools, pick one, and stick with it till you're done. Avoid other search methods as they seem to be sponsored by malware-infested sources.

sUn+FUD(sUn)

Like other Linux malware, the sUn virus can effect kernel messages. In the past couple of years, the most obvious infections caused the word Java! to print out as if in an endless loop at login, along with the annoying tendency to rename all files on the system with the text "Java." prepended or as extensions. If you start noticing that all of your software packages are renamed in a similar fashion, it's a sure sign of infection.

This malware also tries to alter the text in licensing files, wiping them out at the most in-opportune times and in other cases changing the text to create YAPNGL (Yet Another Pointless Non-GNU License). While this can be extremely annoying, overall most technical and business people have yet to be adversely affected. Infections of the sUn virus have dropped of late and are showing signs of a huge slow-down over the next few years -- possibly even total extinction.

Recommended cleanup techniques:
Cleanup of the sUn virus is pretty easy. Where practical, don't allow computers infected with sUn on your local network. If possible, get rid of the servers that have been infected in the past, and replace them with a supported GNU/Linux variant in enterprise-class settings.