1

The Dr.Web has recently discovered a new linux malware called Linux.MulDrop.14 , targeting rpi with raspbian OS.

Linux.MulDrop.14

Linux Trojan that is a bash script containing a mining program, which is compressed with gzip and encrypted with base64. Once launched, the script shuts down several processes and installs libraries required for its operation. It also installs zmap and sshpass.

How to secure Raspberry-Pie with raspbian OS , controlled over SSH against the Linux.MulDrop.14 malware ?

1
  • 1
    Change the default password, or better yet use key authentication and not password authentication – Neil McGuigan Jun 12 '17 at 23:30
1

As reported here and here, the Linux.MulDrop.14 malware is a Bash script which exploits the victim by installing and running a crypto-currency mining program. As I understand it, it needs to be run inside the machine to infect it; other vectors of infection aren't specified. Therefore, if you don't run or install dubious software or scripts, you should be fine.

You should also change the default password of your Raspberry PI. Beside being a possible entry point for the first infection, it will also cause the infection to spread: once the malware manages to infect a RaspberryPI, it will SSH to other machines in the network using the default RaspberryPI credentials "login=pi, password=raspberry", then upload and run a copy of itself.

1
  • I think I have an infected Pi, but I can still SSH into it probably because of shared SSH keys. In this case, do you know how I can remove it? – vicatcu Jul 13 '17 at 0:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.