Should desktop users of Ubuntu (and other Linux distros) be concerned about the malware-infection drive described as "Operation Windigo"?

What threat does it pose to us immediately and are there any longer term ramifications?


Just reread the question. If you're on an install without SSH or your SSH server is not available online (eg it is blocked by a NAT router, et al), you have nothing to fear from this news. The whole attack requires SSH.

Additionally, if you're not running a webserver (and by extension you're not on an awesome internet connection), it seems unlikely —though, and importantly, not impossible— that Windigo is going to bother you, even if you do have an exposed SSH server.

That's not to say you're free from any risk. There is other malware and there will be even more as time goes on and Ubuntu gains users. It's also stupidly easy to manipulate people. I had a little rant a few years ago: Linux isn't invulnerable. Don't say it is.

Anyway, if you're still reading, I'm going to assume you're running a SSH server on the internet.

The ESET post and PDF writeup on "Operation Windigo" should tell you everything you need in order to tell if you're at risk or are currently infected. They have sample code that can be copied out and run to test your system.

The whole thing is certainly worth a read but this isn't the security apocalypse some might suggest. The primary route by which these servers became infected was human idiocy:

No vulnerabilities were exploited on the Linux servers; only stolen credentials were leveraged. We conclude that password-authentication on servers should be a thing of the past

So for all the fanfare, this is a very basic infection technique. They're either cracking passwords (dictionary-attacks most likely) or they're stealing SSH keys off client computers, backups, etc. I'd like to think it's the first.

There is nothing clever or new about this. Everybody running a SSH server faces those risks and they're really easy to protect against. Just practise basic SSH security and you'll be fine: use password protected keys and not passwords, run sshd on a high port, fail2ban, no root user. If you ignore these basics and run a SSH server where you're allowing root logins with a password, you'll get hacked.

And just because this wasn't an exploit-based infection doesn't mean the next one won't be. Staying up to date with security-release packages is vital. Make it automatic. Making sure your PHP (et al) scripts are updated is vital, subscribe to your authors' RSS feeds.

The significance of Windigo is the sophistication and portability of the rootkit that gets installed on the servers. There is network resilience through dynamic DNS, not static IPs, multiple httpd configurations to maximise success rates, the lack of dependencies in this whole stack that makes it almost certain to run in all scenarios (even on ARM)... and by all accounts the payloads (the spam, and infection kits for client computers) are very effective. 1% success is epic when you're talking about 500K a day.

The "this is happening on Linux so Linux is insecure" inference I can see in some quarters is nonsense. This could happen on any platform and frankly, it already does. What is special here is that this has been pulled together by competent developers. Thankfully the ingress point is pretty much as simple as a burglar finding the spare key under the doormat.

The Too Long; Didn't Read version...

It seems the hacked servers were run by idiots with weak security but don't be complacent. Check to see if your servers are infected and check to see you're not making the same stupid mistakes as the people who are currently infected.

  • You're right, concern no matter how small needs to be addressed server side, as the main targets here are those with obsolete security measures. – bleeves Mar 20 '14 at 16:03
  • Well I am definitely guilty at installing ppa's that I have picked up on from websites such as omgubuntu and sorts. I did install an AV on the computer but being the not-super-tech-savvy guy that I am, how should I go about and confirm a software source is a trusted one? I am not running any server (yet, but might in the future) and update Ubuntu every chance I get. Technically this should make for a relatively safe system but won't safe me from doing anything stupid like adding a wrong ppa. – Nkciy84 Mar 24 '14 at 0:09
  • @Nkciy84 That's not a straightforward question in itself. Most PPAs come down to how much you can trust the person responsible for publishing packages to it. That information is all available on Launchpad but it won't necessarily tell you for sure. – Oli Mar 24 '14 at 0:26

Heh. That is exactly why I say PPA's are bad idea. However, the articles you point at tell us about no virus. Usual security measures should be just fine: have the latest updates from main repositories, think what you download and run, no matter if root or user. If you have slightest concerns about some software, lock it with AppArmor or special user ID.


Having verified that I have a clean system, according to the suggested check, how can I prevent any future intrustions?

ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo “System clean” || echo “System infected”
  • Now I see: To prevent infection of systems, ESET suggested disabling root login through SSH along with passwords. SSH Agent Forwarding instead of copying over private keys to servers was also recommended, as was two-factor authentication. – EdgeCase Mar 20 '14 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.