Lupper Linux Virus.
Here’s a repost of an entry I made on New Linux User.
ZDnet is reporting a Linux virus this morning. Since there are so few Linux virii out there in the wild, I immediately get suspicious when I hear of one. I investigated this virus and here are my thoughts on it:
First off, while everyone is indeed calling this a Linux virus, I must disagree.
The vulnerabilities that this virus attacks actually belong to three scripts, not the OS itself. Therefore, I really wouldn’t call this a Linux virus. That’s like calling a vulnerability in MS Word or Windows Skype a Windows virus. That’s just not correct.
This worm spreads by exploiting web servers hosting vulnerable PHP/CGI scripts.
It’s the scripts, not the OS.
I think people are calling it a Linux virus because these three scripts primarily run on Linux machines, however I’m pretty sure the AW stats plugin is a Wordpress plugin will therefore run on IIS if the Wordpress installation it is plugged into is running on IIS. That’s just speculation on my part, though.
There are many things inherent in GNU/Linux that make it very difficult for a virus to function which is the main reason why there’s virtually no GNU/Linux viruses out there. However, as the OS gains popularity, more people are going to start focussing on it and I expect we’ll see more viruses pop up. They won’t be nearly as destructive as Windows virii though.
You might remember show #17 with Mark Rais where we discussed GNU/Linux virii and security.
November 28th, 2005 at 1:27 pm
This is an XML-RPC virus and NOT a Linux virus, yet this is more a worm than a virus and is only if you are running a server with php-xmlrpc running in your webserver.
November 28th, 2005 at 2:00 pm
Yeah - totally agree. I think that people very quickly realized that calling this a Linux virus was a pretty good example of shoddy reporting by people who don’t know the first thing about the Internet, web servers, Linux, or virii.