Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "J.O. Aho" Newsgroups: alt.os.linux Subject: Re: What do you make of this reported Linux back door? Date: Fri, 28 Feb 2025 18:00:28 +0100 Lines: 25 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net 8ItKaW8jbxDCUQLMvUGNeQSRXZ3ZXsR9gcoSTIiXD0VQfjvYAm Cancel-Lock: sha1:whsvBxrQ4czc1+zl8DUNDFAS05k= sha256:4iXxUiaYQetT/z+rVYZRJbgDJbpYX9XBNukagQB/w2U= User-Agent: Mozilla Thunderbird Content-Language: en-US-large In-Reply-To: Xref: csiph.com alt.os.linux:81072 On 28/02/2025 08.45, Hank wrote: > https://unit42.paloaltonetworks.com/new-linux-backdoor-auto-color/ > > Between early November and December 2024, Palo Alto Networks researchers > discovered new Linux malware called Auto-color. We chose this name based on > the file name the initial payload renames itself after installation. > > The malware employs several methods to avoid detection, such as: > > Using benign-looking file names for operating > Hiding remote command and control (C2) connections using an advanced > technique similar to the one used by the Symbiote malware family > Deploying proprietary encryption algorithms to hide communication and > configuration information > Once installed, Auto-color allows threat actors full remote access to > compromised machines, making it very difficult to remove without > specialized software. As Carlos and John has already pointed out, you need to execute a binary (or script) and it's self inflicted, don't install anything you can't install from your distros repository unless you really know what you are doing. -- //Aho