<div dir="ltr">Updates/patching and common sense are more necessary in Linux. Windows you probably want an AV, ideally something that can block shellcode/memory injection attacks and sandbox zero day/unknown executions.<div><br></div><div>Backups that are originated from the device you want to backup have an inherent security flaw that they typically have access to the backup storage repository, and can therefore delete or encrypt the backups if the malware author makes his cryptoware "aware" of the backup technology you are using.</div><div><br></div><div>Backup systems that "pull" data from the computer that is being backed up are better (for example BareOS) but this often isn't practical when doing offsite-type backups.</div><div><br></div><div>An alternative mitigation if, for example, you are backup up a Linux box with Duplicity to a remote rsync host (so your Linux box obviously has the credentials which puts your backup data at risk), would be to have the backup server use ZFS and have a good snapshot policy in place (7 days, 4 weeks, 3 months, 1 year, or something) this way, if you discover you've been crypto'd (they usually want money so they tend to make sure you are aware) AND they take out your backup, the server admin can recover your previous data from yesterday's or last week's snapshot.</div><div><br></div><div>But as Cranky said, rotating some offline storage devices like USB sticks/drives for your critical data is a great idea, the problem with manual methods is they often don't get done after a while.</div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><b>Mark Steffen</b><div><font size="1">Office Direct: +1.226.476.1240 | Mobile/WhatsApp: +1.226.600.0464</font></div><div><i style="font-size:x-small">"Don't believe everything you read on the Internet." -Abraham Lincoln</i></div><div><br><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Fri, Mar 31, 2017 at 1:01 PM, CrankyOldBugger <span dir="ltr"><<a href="mailto:crankyoldbugger@gmail.com" target="_blank">crankyoldbugger@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">To add to B.S.'s comment, when he said "Backups", he meant "offsite" or "not on the network". While this is more for Windows users than us Linux folks, I have heard that these ransomware viruses (virii?) do run around the local network pretty quickly, so if you're backing up to just another PC or NAS, then the infection will spread. I know a guy who had a customer fall prey to one of these. They're nasty things.<div><br></div><div>Do regular backups, but do them to something that you can easily unplug, like a USB stick. Plug the stick in, do your backups, pull the stick out, label it and put it somewhere safe. You could even buy a bunch of USB sticks and rotate them for even more protection.</div><div><br></div><div>A/V is not "necessary" in the Linux world like it is in Windows or Macs, but it doesn't hurt to be extra paranoid from time to time. I've heard good things about ClamAV, and I've used it myself, but if you want to do some reading you could try: <a href="http://www.makeuseof.com/tag/free-linux-antivirus-programs/" target="_blank">http://www.makeuseof.com/tag/<wbr>free-linux-antivirus-programs/</a></div><div><br></div><div><br></div><div><br></div></div><div class="HOEnZb"><div class="h5"><br><div class="gmail_quote"><div dir="ltr">On Fri, 31 Mar 2017 at 11:50 Khalid Baheyeldin <<a href="mailto:kb@2bits.com" target="_blank">kb@2bits.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="m_-9053800643052839547gmail_msg"><div class="m_-9053800643052839547gmail_msg">A possible program that was used is this one (last comment in the thread). Initially a proof of concept, but now some actors are using it for real.<br class="m_-9053800643052839547gmail_msg"><br class="m_-9053800643052839547gmail_msg"></div><div class="m_-9053800643052839547gmail_msg">The key is gaining root access. If you prevent that, then you are safe.<br class="m_-9053800643052839547gmail_msg"></div><div class="m_-9053800643052839547gmail_msg"><br class="m_-9053800643052839547gmail_msg"><a href="https://github.com/jdsecurity/CryptoTrooper" class="m_-9053800643052839547gmail_msg" target="_blank">https://github.com/jdsecurity/<wbr>CryptoTrooper</a><br class="m_-9053800643052839547gmail_msg"><br class="m_-9053800643052839547gmail_msg"></div>Since it has a similar /etc/motd.<br class="m_-9053800643052839547gmail_msg"></div><div class="gmail_extra m_-9053800643052839547gmail_msg"><br class="m_-9053800643052839547gmail_msg"><div class="gmail_quote m_-9053800643052839547gmail_msg">On Fri, Mar 31, 2017 at 11:45 AM, Khalid Baheyeldin <span dir="ltr" class="m_-9053800643052839547gmail_msg"><<a href="mailto:kb@2bits.com" class="m_-9053800643052839547gmail_msg" target="_blank">kb@2bits.com</a>></span> wrote:<br class="m_-9053800643052839547gmail_msg"><blockquote class="gmail_quote m_-9053800643052839547gmail_msg" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="m_-9053800643052839547gmail_msg"><div class="m_-9053800643052839547gmail_msg">Scrolling down a bit in the comments.<br class="m_-9053800643052839547gmail_msg"><br class="m_-9053800643052839547gmail_msg">He used Firefox as root, then probably clicked on a link or ad that had malware in it. That replaced his Python executable with the ransomware thing.<br class="m_-9053800643052839547gmail_msg"><br class="m_-9053800643052839547gmail_msg"></div>I never ran antivirus on Linux either.<br class="m_-9053800643052839547gmail_msg"></div><div class="gmail_extra m_-9053800643052839547gmail_msg"><br class="m_-9053800643052839547gmail_msg"><div class="gmail_quote m_-9053800643052839547gmail_msg"><div class="m_-9053800643052839547gmail_msg"><div class="m_-9053800643052839547m_-3680441429822043829h5 m_-9053800643052839547gmail_msg">On Fri, Mar 31, 2017 at 11:10 AM, Joe Wennechuk <span dir="ltr" class="m_-9053800643052839547gmail_msg"><<a href="mailto:youcanreachmehere@hotmail.com" class="m_-9053800643052839547gmail_msg" target="_blank">youcanreachmehere@hotmail.com</a><wbr>></span> wrote:<br class="m_-9053800643052839547gmail_msg"></div></div><blockquote class="gmail_quote m_-9053800643052839547gmail_msg" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="m_-9053800643052839547gmail_msg"><div class="m_-9053800643052839547m_-3680441429822043829h5 m_-9053800643052839547gmail_msg">
<div dir="ltr" class="m_-9053800643052839547gmail_msg">
<div id="m_-9053800643052839547m_-3680441429822043829m_1764101601309589172m_-3049831526135450455divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif" dir="ltr" class="m_-9053800643052839547gmail_msg">
<p class="m_-9053800643052839547gmail_msg">I saw this link on reddit. <a href="https://forums.gentoo.org/viewtopic-t-1060828.html" class="m_-9053800643052839547m_-3680441429822043829m_1764101601309589172m_-3049831526135450455OWAAutoLink m_-9053800643052839547gmail_msg" id="m_-9053800643052839547m_-3680441429822043829m_1764101601309589172m_-3049831526135450455LPlnk610831" target="_blank">
https://forums.gentoo.org/<wbr>viewtopic-t-1060828.html</a> </p>
<p class="m_-9053800643052839547gmail_msg"><br class="m_-9053800643052839547gmail_msg">
</p>
<p class="m_-9053800643052839547gmail_msg">I have never run any antivirus or anything on my linux box. Does anyone know how this got into this users machine, and/or how I should be protecting my home, and work environments using Linux?</p>
<p class="m_-9053800643052839547gmail_msg"><br class="m_-9053800643052839547gmail_msg">
</p>
<p class="m_-9053800643052839547gmail_msg"><br class="m_-9053800643052839547gmail_msg">
</p>
<p class="m_-9053800643052839547gmail_msg"><br class="m_-9053800643052839547gmail_msg">
</p>
<div id="m_-9053800643052839547m_-3680441429822043829m_1764101601309589172m_-3049831526135450455Signature" class="m_-9053800643052839547gmail_msg">
<div id="m_-9053800643052839547m_-3680441429822043829m_1764101601309589172m_-3049831526135450455divtagdefaultwrapper" dir="ltr" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif" class="m_-9053800643052839547gmail_msg">
Joseph Wennechuk
<div class="m_-9053800643052839547gmail_msg">Phone: <a href="tel:(226)%20505-4812" value="+12265054812" class="m_-9053800643052839547gmail_msg" target="_blank">(226) 505-4812</a><br class="m_-9053800643052839547gmail_msg">
</div>
<div class="m_-9053800643052839547gmail_msg"><a href="https://www.linkedin.com/pub/joseph-wennechuk/4/b59/382" id="m_-9053800643052839547m_-3680441429822043829m_1764101601309589172m_-3049831526135450455LPNoLP" class="m_-9053800643052839547gmail_msg" target="_blank">https://www.linkedin.com/pub/<wbr>joseph-wennechuk/4/b59/382</a></div>
<div class="m_-9053800643052839547gmail_msg"><br class="m_-9053800643052839547gmail_msg">
</div>
</div>
</div>
</div>
</div>
<br class="m_-9053800643052839547gmail_msg"></div></div>______________________________<wbr>_________________<br class="m_-9053800643052839547gmail_msg">
kwlug-disc mailing list<br class="m_-9053800643052839547gmail_msg">
<a href="mailto:kwlug-disc@kwlug.org" class="m_-9053800643052839547gmail_msg" target="_blank">kwlug-disc@kwlug.org</a><br class="m_-9053800643052839547gmail_msg">
<a href="http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org" rel="noreferrer" class="m_-9053800643052839547gmail_msg" target="_blank">http://kwlug.org/mailman/<wbr>listinfo/kwlug-disc_kwlug.org</a><br class="m_-9053800643052839547gmail_msg">
<br class="m_-9053800643052839547gmail_msg"></blockquote></div><span class="m_-9053800643052839547m_-3680441429822043829HOEnZb m_-9053800643052839547gmail_msg"><font color="#888888" class="m_-9053800643052839547gmail_msg"><br class="m_-9053800643052839547gmail_msg"><br clear="all" class="m_-9053800643052839547gmail_msg"><br class="m_-9053800643052839547gmail_msg">-- <br class="m_-9053800643052839547gmail_msg"><div class="m_-9053800643052839547m_-3680441429822043829m_1764101601309589172gmail_signature m_-9053800643052839547gmail_msg" data-smartmail="gmail_signature">Khalid M. Baheyeldin<br class="m_-9053800643052839547gmail_msg"><a href="http://2bits.com" class="m_-9053800643052839547gmail_msg" target="_blank">2bits.com</a>, Inc.<br class="m_-9053800643052839547gmail_msg">Fast Reliable Drupal<br class="m_-9053800643052839547gmail_msg">Drupal optimization, development, customization and consulting.<br class="m_-9053800643052839547gmail_msg">Simplicity is prerequisite for reliability. -- Edsger W.Dijkstra<br class="m_-9053800643052839547gmail_msg">Simplicity is the ultimate sophistication. -- Leonardo da Vinci<br class="m_-9053800643052839547gmail_msg">For every complex problem, there is an answer that is clear, simple, and wrong." -- H.L. Mencken<br class="m_-9053800643052839547gmail_msg"></div>
</font></span></div>
</blockquote></div><br class="m_-9053800643052839547gmail_msg"><br clear="all" class="m_-9053800643052839547gmail_msg"><br class="m_-9053800643052839547gmail_msg">-- <br class="m_-9053800643052839547gmail_msg"><div class="m_-9053800643052839547m_-3680441429822043829gmail_signature m_-9053800643052839547gmail_msg" data-smartmail="gmail_signature">Khalid M. Baheyeldin<br class="m_-9053800643052839547gmail_msg"><a href="http://2bits.com" class="m_-9053800643052839547gmail_msg" target="_blank">2bits.com</a>, Inc.<br class="m_-9053800643052839547gmail_msg">Fast Reliable Drupal<br class="m_-9053800643052839547gmail_msg">Drupal optimization, development, customization and consulting.<br class="m_-9053800643052839547gmail_msg">Simplicity is prerequisite for reliability. -- Edsger W.Dijkstra<br class="m_-9053800643052839547gmail_msg">Simplicity is the ultimate sophistication. -- Leonardo da Vinci<br class="m_-9053800643052839547gmail_msg">For every complex problem, there is an answer that is clear, simple, and wrong." -- H.L. Mencken<br class="m_-9053800643052839547gmail_msg"></div>
</div>
______________________________<wbr>_________________<br class="m_-9053800643052839547gmail_msg">
kwlug-disc mailing list<br class="m_-9053800643052839547gmail_msg">
<a href="mailto:kwlug-disc@kwlug.org" class="m_-9053800643052839547gmail_msg" target="_blank">kwlug-disc@kwlug.org</a><br class="m_-9053800643052839547gmail_msg">
<a href="http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org" rel="noreferrer" class="m_-9053800643052839547gmail_msg" target="_blank">http://kwlug.org/mailman/<wbr>listinfo/kwlug-disc_kwlug.org</a><br class="m_-9053800643052839547gmail_msg">
</blockquote></div>
</div></div><br>______________________________<wbr>_________________<br>
kwlug-disc mailing list<br>
<a href="mailto:kwlug-disc@kwlug.org">kwlug-disc@kwlug.org</a><br>
<a href="http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org" rel="noreferrer" target="_blank">http://kwlug.org/mailman/<wbr>listinfo/kwlug-disc_kwlug.org</a><br>
<br></blockquote></div><br></div>