BDFDoor virus

[ToddAndMargo]

https://www.bleepingcomputer.com/news/security/bpfdoor-stealthy-linux-malwar...

Any comments?

SELinux tag this guy?

Do you have to be tricked to installing the daemon?
Or can it just come up the wire at you?

[Samuel Sieb]

On 5/17/22 01:04, ToddAndMargo via users wrote:
> https://www.bleepingcomputer.com/news/security/bpfdoor-stealthy-linux-malwar...
>
> Any comments?
>
> SELinux tag this guy?
>
> Do you have to be tricked to installing the daemon?
> Or can it just come up the wire at you?

It has to be installed through some other vulnerability.

[Luna Jernberg]

Will be patched upstream in the new kernels coming tommorow

On 5/17/22, Samuel Sieb  wrote:
> On 5/17/22 01:04, ToddAndMargo via users wrote:
> > https://www.bleepingcomputer.com/news/security/bpfdoor-stealthy-linux-malwar...
> >
> > Any comments?
> >
> > SELinux tag this guy?
> >
> > Do you have to be tricked to installing the daemon?
> > Or can it just come up the wire at you?
>
> It has to be installed through some other vulnerability.
> _______________________________________________
> users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam on the list, report it:
> https://pagure.io/fedora-infrastructure

[Samuel Sieb]

On 5/17/22 01:15, Luna Jernberg wrote:
> Will be patched upstream in the new kernels coming tommorow

Patched how?

[ToddAndMargo]

On 5/17/22 01:14, Samuel Sieb wrote:
> On 5/17/22 01:04, ToddAndMargo via users wrote:
> > https://www.bleepingcomputer.com/news/security/bpfdoor-stealthy-linux-malwar...
> >
> > Any comments?
> >
> > SELinux tag this guy?
> >
> > Do you have to be tricked to installing the daemon?
> > Or can it just come up the wire at you?
>
> It has to be installed through some other vulnerability.

Seems you have to be tricked into giving the installer
root access to operate iptables

[ToddAndMargo]

On 5/17/22 01:31, ToddAndMargo via users wrote:
> On 5/17/22 01:14, Samuel Sieb wrote:
> > On 5/17/22 01:04, ToddAndMargo via users wrote:
> > > https://www.bleepingcomputer.com/news/security/bpfdoor-stealthy-linux-malwar...
> > >
> > > Any comments?
> > >
> > > SELinux tag this guy?
> > >
> > > Do you have to be tricked to installing the daemon?
> > > Or can it just come up the wire at you?
> >
> > It has to be installed through some other vulnerability.
>
> Seems you have to be tricked into giving the installer
> root access to operate iptables

I also wonder how it fares behind a NAT router?