Anyone know anything about the Hand of Thief malware that has been announced for sale on an apparent underground cyber crime forum? It is said that is has been tested to work on Ubuntu! Should I be worried and I'm assuming Canonical is taking steps to stop this malware?
5
-
2Take a look at Thieves Reaching for Linux—”Hand of Thief” Trojan Targets Linux.– MitchAug 10, 2013 at 13:38
-
To the Bank it is malware - to the Thief or to the Linux-User not in general ?– dschinn1001Aug 10, 2013 at 14:10
-
Nothing to be afraid of. You have to want to get this malware to get it.– RolandiXorAug 10, 2013 at 23:22
-
@RolandiXor "you have to want to get"...by this do you mean that you have to be extremely careless and non-security conscious, or that you have to go looking for it to get infected, or something else entirely? I'm unsure of your meaning.– TrailRiderAug 13, 2013 at 23:06
-
@TrailRider it can only be distributed either if you pay for it or get it via suspicious emails. In other words, it is something you practically have to go looking for.– RolandiXorAug 15, 2013 at 4:52
Add a comment
|
2 Answers
I have read several articles on it. While it is a risk, I would say that if you're careful the risk is minimal.
This is an excerpt from "Linux desktop Trojan 'Hand of Thief' steals in" (from ZDnet.com)
Fortunately, as Limor Kessem, one of RSA's top cyber Intelligence experts, wrote after a conversation with the Trojan's "sales agent," Hand of Thief has no good ways of infecting Linux users. Instead, the cracker "suggested using email and social engineering as the infection vector."
I myself cannot put it better than the author of the article: Steven J. Vaughan-Nichols
Practically speaking that means you shouldn't be clicking on any strange URLs sent to you over social media or by e-mail. But, you already knew that? Right? Right!?
So as I stated earlier, if you are careful you should be safe. To sum it up, don't open any file sent from someone you don't know and be very careful in clicking links sent to you by people you do(both of which you should already be doing anyway).
The article I referred and linked to is the best of several I read on "Hand of Thief" trojan and I would refer you to it if you would like any further information.
I would also refer you to the article sited by Mitch in his comment to your question. It also states the lack of distribution that this malware has, albeit in a slightly different way and a bit more vaguely.
Without the ability to spread the malware as widely as on the Windows platform, the price tag seems hefty, and raises the question – will the Linux Trojan have the same value as its Windows counterparts?
I will repeat the link so that my sources are cited but the credit for this one still goes to Mitch. Thieves Reaching for Linux—”Hand of Thief” Trojan Targets Linux
Edit on 9-10-13 A new article was written about "HoT", while I don't want to necro-bump this question, just to make my answer more complete I will quote it here[my emphasis added] :
Once installed, HoT would seek to grab information from Web forms and send the results to a botnet server. As malware, however, HoT fails in the most fundamental way possible: It requires a deliberate effort by the user to install it.
it went on to say:
In fact, even if you do take the time and effort to infect a Linux PC with HoT, the program still doesn't work worth a damn. RSA found that HoT often crashed with Firefox on Fedora, grabbed useless data with Chrome on Fedora, and was blocked from running at all on Ubuntu Linux.
To sum up the article, the HoT malware was mostly hype and as far as security experts(RSA) are concerned it is a complete failure.
The article makes interesting reading and as it says; The only people that were hurt by it were the crooks dumb enough to pay $2000 for it.
The article I sited was on zdnet.com:
answered Aug 10, 2013 at 16:34
-
"opening files" and "clicking links" are very different things. Can hand of thief spread through the browser or through the victim being tricked into executing a binary or script?– AngeloAug 13, 2013 at 11:19
-
2@Angelo From my read of the article it mentions not clicking on a link, The "sales rep"(read crook) suggested email or social engineering. While the article didn't elaborate they did mention not clicking on a strange URL(link). I took social engineering to be tricking a user into exec. a script, but his is entirely my interpretation of the phrase, it was not in the article itself. The article is not clear as I assume that the only way to know for sure would be to buy it and see so they could not verify exactly how it was spread. Aug 13, 2013 at 22:47
-
1@Angelo continued... the second article says " there aren’t significant exploit packs targeting the platform" so that leads me to believe that a web browser exploit it unlikely and a "link" would just be to a legitimate looking web site that would trick the user into exec. a script or binary, or maybe a addon to Firefox or other browser that would install the trojan. I could be wrong on this as the articles are not specific on this(again I have to assume that it is because they can't get that info) Aug 13, 2013 at 22:54
-
1One more general note, I only included that warnings I did as a general precaution that should be followed anyway, not because I know anything specific. I am not a security expert by any means, just someone who was interested in the security risk of this trojan and how it affects linux security in general, so I read the articles carefully and was passing on my take on it. I could be wrong on how it works. Nothing I said was meant to be definitive, only informative. Aug 13, 2013 at 22:59
-
thanks! I just wanted to be clear that the "not clicking" on strange links suggestion was for general computer hygiene and not because hand of thief could spread from visiting a webpage (eg java or something else).– AngeloAug 14, 2013 at 12:34
Hand of Thief Trojan Has No Claws in Linux: http://www.infosecurity-magazine.com/view/34349/hand-of-thief-trojan-has-no-claws/
-
2Please edit your answer to include a summary of what's described in the article. This way if the link becomes unavailable your answer will retain its usefulness.– hmayagJul 6, 2014 at 7:08
-
The gist of the article is that "Hand of Thief" is not a real threat, and is just being hyped up by the for-profit "tech" media. You'd have to actually work at it to get infected with this malware, unlike the thousands of viruses that infect Windows without much user involvement thanks to a completely ineffective security model. Oct 9, 2014 at 4:38