10

What precautions should one take in prevention of attack by trojan BackDoor.Wirenet.1?

Blocking all communications with 212.7.208.65 should be sufficient? If so, how to do it?

2
  • 1
    by not launching any program you don't know/trust?
    – steabert
    Aug 29, 2012 at 20:10
  • 6
    No immediate steps are necessary, other then learning about Linux Security. Aug 29, 2012 at 20:28

2 Answers 2

9

My understanding is the wirenet-1 has to create a file in the directory ~/ WIFIADAPT Since Linux sees directories and files as the same (you can't have a file and directory by the same name) I believe that creating an empty file by the name of WIFIADAPT in your home directory would keep your from getting the Trogen since It would not be able to create the Directory WIFIADAPT the location it stores the infection. Just for extra measures I would set the permissions on the created file read only. This is just my suggestion but I believe this would work. It also wold be a good idea to block the above mentioned IP address.

2
  • by logic yeah! i agree
    – penreturns
    Sep 1, 2012 at 19:44
  • This is an interesting approach. Sep 4, 2012 at 20:45
8

BackDoor.Wirenet.1 Keylogger is a backdoor trojan that can run on Linux and MacOSX, stealing personal information, passwords, and banking credentials! It copies itself to the user's home directory at /home/WIFIADAPT

It then creates a connection to a remote IP, currently 212.7.208.65

Defence and Removal:

  1. Block that IP with your router / firewall.
  2. Delete the above directory/files.
5
  • Thanks for the advice. Is there someway to know the source of infection?
    – user86499
    Aug 30, 2012 at 12:16
  • How would we go about blocking that particular IP address? UFW can only block ports, right? Aug 30, 2012 at 15:54
  • hum, and how did it get the rights to write in /home/WIFIADAPT ? It asked politely the user ? Or did you make a mistake and this is ~/WIFIADAPT that is targeted ?
    – vaab
    Sep 3, 2012 at 17:29
  • 2
    @Glutanimate Looks like this does the job: sudo ufw reject out to 212.7.208.65. You can test by trying to ping to that IP later.
    – jcollado
    Sep 5, 2012 at 3:31
  • 1
    @Glutanimate sudo -- iptables -Block INPUT -s 212.7.208.65 -p all -j DROP will also do it, but will only persist until you logout unless you add it to one of your startup scripts.
    – Joe
    Sep 5, 2012 at 20:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .