Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection
Phishing emails with RAR archives exploit Linux filename injection to deliver VShell backdoor, bypassing antivirus defenses
It's a good explanation and analysis of what it is and what it does.
There's just one thing that I didn't see mentioned and it's about the prevalence of having a software installed to extract rar files in the first place.
AFAIK there's nothing installed by default on Debian to open rar files. You kind of have to go out of your way to extract one. Unless this changed with the latest release.
I'm not much of a distro hopper so I'd be curious to know, are there distributions where opening and extracting a rar file only requires to click it?
also: antivirus detection, you guys have antivirus? I just install things from the official repository
I've been using Linux for more than 25 years and never had an antivirus. I'm also trying to just keep to official repos. From what I've seen over the years it's not viruses or malware that are the most dangerous on Linux, but vulnerabilities found in some software, that usually only requires you to update your system.
Maybe I'd be more careful if I was installing obscure packages from weird places, but I'm about as conservative as Debian when it comes to new software and bleeding edge, so usually the stuff that I install has been tried and tried again.
7z can extract them, but i don't know if it's installed by default anywhere.
Isn't that irrelevant? According to the article, the archive itself doesn't contain any malicious code. Rather, it's encoded in the file name, and can start executing itself when being parsed by the shell - no extraction needed.
It seems to me that avoiding rar files, or limiting your ability to extract them will provide a false sense of security at best. Seems to me that this could be done using any file type at all.
The starting point of the attack is an email message containing a RAR archive, which includes a file with a maliciously crafted file name: "ziliao2.pdf
{echo,<Base64-encoded command>}|{base64,-d}|bash"
Doesn't it mean that a rar archive contains the malicious file?
It's worth noting that simply extracting the file from the archive does not trigger execution. Rather, it occurs only when a shell script or command attempts to parse the file name.