<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
You can unsubscribe yourself using the below link<br>
<br>
<a href="http://lists.habari.co.tz/cgi-bin/mailman/listinfo/linux"
target="_blank">http://lists.habari.co.tz/cgi-bin/mailman/listinfo/linux</a><br>
<br>
<br>
<br>
<br>
<div class="moz-cite-prefix">On 03/06/2015 08:53 asubuhi, Joseph
Joachim via Linux wrote:<br>
</div>
<blockquote
cite="mid:CAFfyhGGGDAfB252s0TBf1_ik=ucB7oSkvf3KJSK5Vxv3vTi_YQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_default"
style="font-family:verdana,sans-serif;font-size:small;color:#0b5394">Hello </div>
<div class="gmail_default"
style="font-family:verdana,sans-serif;font-size:small;color:#0b5394">
I hope your doing fine. can you kindly unsubscribe from mail
list i don't want to receive this emails.</div>
<div class="gmail_default"
style="font-family:verdana,sans-serif;font-size:small;color:#0b5394">Thanks</div>
<div class="gmail_default"
style="font-family:verdana,sans-serif;font-size:small;color:#0b5394">Joseph</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Wed, May 27, 2015 at 5:11 PM,
Andreas Tauscher via Linux <span dir="ltr"><<a
moz-do-not-send="true"
href="mailto:linux@lists.habari.co.tz" target="_blank">linux@lists.habari.co.tz</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">This one
is attacking ARM or MIPS based routers with Linux as OS:<br>
Dissecting Linux/Moose<br>
<a moz-do-not-send="true"
href="http://www.welivesecurity.com/2015/05/26/dissecting-linuxmoose/"
target="_blank">http://www.welivesecurity.com/2015/05/26/dissecting-linuxmoose/</a><br>
<br>
Access to the router is got with a brute force attack
testing passwords.<br>
<br>
Once they got access to the router the male-ware (a ELF
binary) is uploaded.<br>
Several threads are started. Most of them are scanning for
other devices<br>
within the network and outside to infect them also.<br>
<br>
This maleware is a social network fan. It is creating fake
likes, views<br>
and follows at: Fotki (Yandex), Instagram (Facebook), Live
(Microsoft),<br>
Soundcloud, Twitter, Vine, Yahoo, Youtube (Google)<br>
But once on the router it can do anything. Traffic redirect,
stealing<br>
unencrypted session cookies, passwords, manipulate traffic
like for<br>
example injecting other male-ware into http traffic and and
and......<br>
<br>
A quick check if your router is infected:<br>
Port 10073 is open.<br>
On the router you find a binary named elan2<br>
A process elan2 is running.<br>
<br>
At <a moz-do-not-send="true"
href="https://github.com/eset/malware-ioc/tree/master/moose"
target="_blank">https://github.com/eset/malware-ioc/tree/master/moose</a>
you find also a<br>
list of IP addresses. If you detect traffic on port 10073 to
this<br>
addresses a device within the net might be infected.<br>
<br>
Protection: Disabling any remote access, a strong password
and a login<br>
name which is not one of the first tried: root, admin,
administrator.<br>
<br>
If the router is infected: Hard resetting the router and
reinstalling<br>
the firmware. A update might not be enough since the update
might<br>
upgrade only singe binaries but not overwriting the entire
memory.<br>
<span class="HOEnZb"><font color="#888888"><br>
Andreas<br>
<br>
<br>
</font></span><br>
_______________________________________________<br>
The Arusha Linux User Group: <a moz-do-not-send="true"
href="http://unix.or.tz" target="_blank">http://unix.or.tz</a><br>
Linux mailing list<br>
<a moz-do-not-send="true"
href="mailto:Linux@lists.habari.co.tz">Linux@lists.habari.co.tz</a><br>
<a moz-do-not-send="true"
href="http://lists.habari.co.tz/cgi-bin/mailman/listinfo/linux"
target="_blank">http://lists.habari.co.tz/cgi-bin/mailman/listinfo/linux</a><br>
<br>
The Arusha LUG mailing list is generously hosted by Habari
Node Ltd: <a moz-do-not-send="true"
href="http://www.habari.co.tz/" target="_blank">http://www.habari.co.tz/</a><br>
<br>
The above comments and data are owned by whoever posted them
(including attachments if any). The mailing list host is not
responsible for them in any way.<br>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div class="gmail_signature">
<div dir="ltr"><b><font color="#0000ff"><font>Mr.</font>Joseph
Joachim Joseph</font></b><br>
<b>Title:</b><font color="#0000ff">ICT-support</font> <br>
Organization:<font color="#0000ff">RTI-International</font><br>
Seconded:<font color="#0000ff">Ministry of Health and Social
Welfare</font><br>
Proffessional:<font color="#0000ff">Bsc in Computer Science</font><br>
Contacts:<font color="#0000ff">+2557884<span></span><span></span>42657
, </font>Skype:<font color="#0000ff">joseph.joseph.j</font>
<table style="border-collapse:collapse;border:none"
border="1" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2"
style="width:252.9pt;border:none;padding:0in 5.4pt
0in 5.4pt" valign="top" width="337"><br>
</td>
<td colspan="2"
style="width:252.9pt;border:none;padding:0in 5.4pt
0in 5.4pt" valign="top" width="337"><br>
</td>
<td colspan="2"
style="width:225.9pt;border:none;padding:0in 5.4pt
0in 5.4pt" valign="top" width="301">
<p><span style="font-size:10.0pt"> </span></p>
</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
The Arusha Linux User Group: <a class="moz-txt-link-freetext" href="http://unix.or.tz">http://unix.or.tz</a>
Linux mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Linux@lists.habari.co.tz">Linux@lists.habari.co.tz</a>
<a class="moz-txt-link-freetext" href="http://lists.habari.co.tz/cgi-bin/mailman/listinfo/linux">http://lists.habari.co.tz/cgi-bin/mailman/listinfo/linux</a>
The Arusha LUG mailing list is generously hosted by Habari Node Ltd: <a class="moz-txt-link-freetext" href="http://www.habari.co.tz/">http://www.habari.co.tz/</a>
The above comments and data are owned by whoever posted them (including attachments if any). The mailing list host is not responsible for them in any way.</pre>
</blockquote>
<br>
</body>
</html>