Intezer, a security firm, publishes malware analyses, mostly of Linux threats, along with container escape research.
HN links it for the Symbiote analysis; commenters say the malware is hard to find if unseen but find the 'nearly-impossible-to-detect' framing overblown.
> "Genuinely, would you be happy with just container isolation between you and other
customers of your cloud provider? Most people absolutely would not."
But that's exactly how VPS hosting works today - you don't get your own private blade unless you're ready to pay premium prices and have the competence needed to run them yourself. The technicalities of how private resources in a VPS are isolated from each other will differ, but the concept remains the same nonetheless.
People bite the bullet, only to be subject to things like rowhammer [1], or other container escape scenarios [2].
The top comment in this thread reflects the proper way of dealing with this: containers or sandboxes are may not be treated as a secure boundary.
[1] https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/xiao
[2] https://www.intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/
And it isn't too difficult for something to elevate itself to root anyways. It could just include a basic key-logger which would work on most systems and wait for your password. Unless you're on Wayland, you can see for yourself by typing `xinput list` and `xinput test <id>` using the id of your keyboard.
edit: and another comment linked to a blog post which also explains how this specific malware gains root https://www.intezer.com/blog/research/new-linux-threat-symbiote/
What are the odds of some of these software peddlers being in the malware business directly or indirectly? The chances of them happening to want you to download an otherwise unknown piece of stuff and run it privileged seem to be more of a risk than that you have the malware on your system.
Does anybody know what came of this?
https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targeting-linux-systems/
Did the threat materialize or was it a dud?
Agreed that it still seems decently hard to find if you aren't looking for it. Though the tone of the blog post made a lot more sense to me when I saw the over-top-top title of the article[0] it's responding to: 'Analysis of a New, Nearly-Impossible-to-Detect Linux Threat':
[0] https://intezer.com/blog/research/new-linux-threat-symbiote/
https://www.intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/
This linked source article has much more detail.
original src: https://www.intezer.com/blog/research/new-linux-threat-symbiote/
an attack targetting brazilian linux users