Malicious Screensaver: Malware on Gnome-Look.org

Posted by tripwire45 on Dec 10, 2009 3:49 PM EDT
Ubuntu User Magazine; By James Pyles
Mail this story
Print this story

When installing an innocuous "waterfall" screensaver from Gnome-Look.org, an Ubuntu user noticed something strange: apart from the screensaver not being on GNOME's approved list, it also contained a script that performed some peculiar substitutions.

Among other things, it took a file named auto.bash from the server and installed it on /user/bin/, along with a file named gnome.sh that it put in the /etc/profile.d/ directory. The script then issued ping requests to send very large packages to a particular server. The script presumably helped serve in a denial-of-service (DoS) attack against other servers that provide exploits for huge multiplayer games such as World of Warcraft.



The user posted his discovery in the Ubuntu Forums and the screensaver has since disappeared from the Gnome-Look.org site. The guesswork as to what the script exactly did and how to remove was batted about in the forum. Apparently the Debian package installed under the name app5552. It was determined that removing the malware together with the malicious script required the command...

Full Story

  Nav
» Read more about: Story Type: Security; Groups: GNOME, Linux, Ubuntu

« Return to the newswire homepage

This topic does not have any threads posted yet!

You cannot post until you login.