Ubuntu 14.04 is CrossRat malware a threat?

Question

I saw a link about CrossRat Malware on Quora, is this Malware a problem on Ubuntu 14.04?
I have not been able to find the location listed for linux on my Ubuntu. Also I generally have Java shut off in my browser(Which should be safe?) but on occasion I turn it on(Not safe?), I played a java game a while back but I'm not sure if it was before the crashes or after.

I'm asking because I have been having fairly regular random crash problems on Firefox and very very very occasionally on gThumb, no other APP's/packages seem to have the crashing problem.

I have replaced Firefox with a Mobile Firefox version but no change what so ever in Firefox crashes. Addins make no difference, none or my usual zillion addins still same, Random Firefox crashes, sometimes long periods it works fine, other times crash after crash after crash.

I have used synaptic package managers fix broken packages, I have also updated.... and any other things I have read about in search that listed app/package crashes, no change on anything.

I did get ubuntu to break on a Nvidia driver install(Shoulda stayed with Nouveau driver.), got her back all on my own, I'm pretty proud of that. :)

By the way, before you answer "CrossRAT is a cross-platform remote access Trojan that can target four popular desktop operating systems, Windows, Solaris, Linux, and macOS..." So please don't give me the standard Linux does things different than windows virus bit, as this is one case where that does not apply, as this blipin POS works in Linux.

Also Denebian was mentioned in the article but not Ubuntu. Also the majority of virus detectors will not find this POS according to the article.

Answer 1

Yes it is but the same rule still apply: it is a threat but only if you let it. -You- need to activate the installation. For me that's enough to never have this activated onto my system.

Regarding this malware:

There are 2 places this malware pops up.

• file mediamgrs.jar, in /usr/var/

• file in ~/.config/autostart likely named mediamgrs.desktop.

  1. the 1st is impossible to be there unless you provide the admin password. /usr/ is owned by "root" so it requires your admin password to store any program.
  2. the 2nd is impossible unless you download it yourself.

So please don't give me the standard Linux does things different

Sorry but that is STILL true: Linux DOES things different than windows. Keep your admin password safe and you have nothing to fear.

Besides that: removing the 2 files when they are present is enough to delete it from your system.

Regarding comments:

The malware puts in in a new dir var in usr. "Second problem is how can a web page install the critter unknown to the user, if an admin password needs to be put in or "you download it yourself" as you mention?" It can't under linux: the download always goes to the default download from the browser. So... you need to download it. you need to execute the download. you need to provide the admin password when asked. See the problem there for any malware that wants to settle outside your /home? Even inside your /home you need to execute the download.

"wine' is windows. So yes, wine is always an issue but again: do not insert your admin unless you know it should be asked = 99.8% safe (that is never going to be 100%) and any problem related from the other 0.2% can be fixed since you are still the admin or with a backup :) " I don't have any "mediamgrs" files but changing a name only takes a second, so that one is not comforting." well it is not really possible for malware to use random filenames so yes it is safe.

They might use different names but then someone would list those names too. This one uses 2 locations (1 in /usr/var/ one 1 .config as a desktop file. Easy to spot. Easy to delete. Not really a problem for a user comfortable with command line or someone careful with the admin password ;) ) Mind also what malware creators want: they want to make money. Often by harvesting emailaddresses, creditcard info etc. And preferably as quick as possible.... Windows is still a far easier target.

General tips:

• do NOT use shared directories. Samba and wine are entry points though malware/virus needs to be created to abuse this kind of method.
• do not automate processes that require a password.
• Keep your admin password safe
• Create (and verify you can restore) backups; if all else fails a backup of your personal data is enough to remove loads of problem.

Answer 2

Regarding the need to write into /usr/var, be aware that crossRAT will fall back to ~/Library if it can't write to /usr/var. As other commentators have pointed out, the only real way to prevent infection is never to allow your browser (or email client) to execute a .jar file.