Anyone know anything about the Hand of Thief malware that has been announced for sale on an apparent underground cyber crime forum? It is said that is has been tested to work on Ubuntu! Should I be worried and I'm assuming Canonical is taking steps to stop this malware?
I have read several articles on it. While it is a risk, I would say that if you're careful the risk is minimal.
This is an excerpt from "Linux desktop Trojan 'Hand of Thief' steals in" (from ZDnet.com)
Fortunately, as Limor Kessem, one of RSA's top cyber Intelligence experts, wrote after a conversation with the Trojan's "sales agent," Hand of Thief has no good ways of infecting Linux users. Instead, the cracker "suggested using email and social engineering as the infection vector."
I myself cannot put it better than the author of the article: Steven J. Vaughan-Nichols
Practically speaking that means you shouldn't be clicking on any strange URLs sent to you over social media or by e-mail. But, you already knew that? Right? Right!?
So as I stated earlier, if you are careful you should be safe. To sum it up, don't open any file sent from someone you don't know and be very careful in clicking links sent to you by people you do(both of which you should already be doing anyway).
The article I referred and linked to is the best of several I read on "Hand of Thief" trojan and I would refer you to it if you would like any further information.
I would also refer you to the article sited by Mitch in his comment to your question. It also states the lack of distribution that this malware has, albeit in a slightly different way and a bit more vaguely.
Without the ability to spread the malware as widely as on the Windows platform, the price tag seems hefty, and raises the question – will the Linux Trojan have the same value as its Windows counterparts?
I will repeat the link so that my sources are cited but the credit for this one still goes to Mitch. Thieves Reaching for Linux—”Hand of Thief” Trojan Targets Linux
Edit on 9-10-13 A new article was written about "HoT", while I don't want to necro-bump this question, just to make my answer more complete I will quote it here[my emphasis added] :
Once installed, HoT would seek to grab information from Web forms and send the results to a botnet server. As malware, however, HoT fails in the most fundamental way possible: It requires a deliberate effort by the user to install it.
it went on to say:
In fact, even if you do take the time and effort to infect a Linux PC with HoT, the program still doesn't work worth a damn. RSA found that HoT often crashed with Firefox on Fedora, grabbed useless data with Chrome on Fedora, and was blocked from running at all on Ubuntu Linux.
To sum up the article, the HoT malware was mostly hype and as far as security experts(RSA) are concerned it is a complete failure.
The article makes interesting reading and as it says; The only people that were hurt by it were the crooks dumb enough to pay $2000 for it.
The article I sited was on zdnet.com:
Hand of Thief Trojan Has No Claws in Linux: http://www.infosecurity-magazine.com/view/34349/hand-of-thief-trojan-has-no-claws/