The email goes on to describe a piece of software that encrypts the contents of the disk and demands a ransom.
How does it do that? (of course the article does not mention that ...). From the link ...
The main encryption routine recursively traverses the following
folders within the root directory up to 17 subdirectories in depth:
/boot /bin /sbin /lib/security /lib64/security /usr/local/etc /etc
/mnt /share /media /home /usr /tmp /opt /var /root
According to researchers, the victim's "files are encrypted using Triple-DES applied to 4096-byte file blocks," and "each file is encrypted using a different set of 64-bit encryption keys."
We need to know how they believe they can circumvent the admin password ...
- Does it require a sudo password?
- Or does it attempt to brute-force the sudo password? If so how good is your password?
- Does it require you to download this malware from the mail and run it? (...) If so... don't :-P
Best method to counter this: create regular backups and keep more than 1 backup of anything important to you. It is always possible to format a disk and reinstall and to restore a clean backup.
I feel strongly that an anti-virus is not needed on Ubuntu.
Me too! But a virus is just a small part of all malware. You also got rootkits, and crapware like what you describe above.
Is that advice now out-of-date with the advent of KillDisk?
No! That advice is the best you can get. At the moment we can consider Ubuntu Software Center free from malware. That article and similar articles I found all lack 1 bit of information: how does it actually encrypt our disks.