linux trojan!! beware folks

pbharris · January 18th, 2003, 10:24 PM

hopefully no one will get hit with this, i have all oggs so i am not worried about it, but maybe *you* should be. get more infor here:

http://securityresponse.symantec.com...ux.jbellz.html

cunokyle · January 18th, 2003, 10:27 PM

good thing I use XMMS! Does sound like a nasty little virus though.

SpookyEddy · January 18th, 2003, 10:32 PM

Thanks for the info, time for a quick dist-upgrade

January 18th, 2003, 10:36 PM

Thanks for the Heads up , PB.

I've only got one Mandrake install at present, with no sound card, so mp3's ain't a prob for me.

Quote:

The current version of Trojan.Linux.JBellz is designed to affect the following Linux systems only:

Suse 8.0
Slackware 8.0

NOTE: The Trojan may affect other Linux systems, and modifying the Trojan is easy enough to support other Linux distributions, or other platforms.

So no complacency for other distros, either.

Cheers
Mick

edit: BTW, these virus threat reports could go in the new Security forum.

thronka · January 18th, 2003, 10:41 PM

Even if it was to affect other distros, you could easily modify the kernel to stop that service.

Germ · January 18th, 2003, 10:42 PM

Thanks for the info, Paul. I'm migrating to ogg, guess I better get it finished. Just in case.

the jester · January 18th, 2003, 10:48 PM

that's very community-minded of symantec considering I couldn't find any linux/unix products in their shopping list

dontcha just love a conspiracy....

Scott Tiger · January 18th, 2003, 11:01 PM

Thanks for the update PB..

Guess Linux's rising popularity is going to increase the likelyhood of threats like these.

krohnjw · January 18th, 2003, 11:08 PM

Scott: Looks like someone took the jinglebell code released by gobbles that allows code to be executed with mpg123 and made their own trojan...go kiddies. This isnt an attack on linux, it's an oppertunist using some one else's code

There is an updated mpg123 package that was released a day or so ago in response to the gobbles code. Should be a quick fix.

thronka: this isnt due to a running service, this is due to someone downloading a modified MP3, modified with the jinglebells code, and playing it with mpg123, the command line mp3 player.

pbharris · January 18th, 2003, 11:59 PM

good point mickwish!

cunokyle - xmms does use mpg123 to playback mp3s...