Jump to content
tek-69

ip spoof and trojan reroutes

Recommended Posts

just thought i'd post this news article i found on google to let people know this kind of non-sense is goin on and to be careful.

 

Linux Users Spoofed By Bogus Security Alert   Oct. 25, 2004   	 



More Stories on:
Security
Industries
Administration


   
Unsuspecting Linux users were tricked into possibly downloading a virus.
By TechWeb News

 
   
Joining the ranks of Windows' users who have been victimized by spoofed security alerts, Linux users this weekend received bogus messages directing them to download updates that are in fact Trojan horses, Red Hat announced Saturday.

The E-mail, which carried the sender address of "security@redhat.com" and an initial subject head of "RedHat: Buffer Overflow in 'ls' and 'mkdir,'" instructs users to download and install a purported patch. In an advisory on its Web site, Red Hat warned that the "patch" is actually a Trojan designed to compromise systems.

"Official messages from the Red Hat security team are never sent unsolicited," said the company in its advisory, and "are always sent from the address 'secalert@redhat.com,' and are digitally signed."

After the initial spammed wave, said Finnish security firm F-Secure Corp., someone used phony information to register the domain "fedora-redhat.com," which is very close to "fedora.redhat.com," the official site of the Fedora Project, a free operating system supported by Red Hat.

The second spam run of Sunday directed recipients to fedora-redhat.com for the fix.

Early Monday, F-Secure noted that the supposed "patch" was no longer online. As of mid-morning Monday, the fedora-redhat.com site also was offline.

Windows users have been targeted several times with similar bogus security messages, most notably in 2003 when the Swen worm disguised itself as a patch attached to messages claiming to come from Microsoft.

This, however, is the first instance of the tactic applied to Linux users.

Share this post


Link to post
Share on other sites

Naw...most Linux users are smart enough to know not to "CLICK YES TO CONTINUE!"

Share this post


Link to post
Share on other sites

i did something like this 8-9 years ago. When I use to hack and hacking was getting "popular" I thought it would be funny to see how many people I could trick that wanted to try to hack their shell accounts. So what I did was code a fake FTP exploit in C that faked a login but really emailed me the user/pass and hostname.

 

I offered the file as a already compiled exploit and I was surprised how many people fell for it.

Share this post


Link to post
Share on other sites
Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

×
×
  • Create New...