Linux malware protection (Wolfsbane, Firewood)?

carcajou · Apprentice Joined: 10 Jun 2008 Posts: 249

Hello all.

This is more a general question because I ran into following article:

https://www.welivesecurity.com/en/eset-research/unveiling-wolfsbane-gelsemiums-linux-counterpart-to-gelsevirine/

It seems that Linux is becoming (or it already became) a more appealing target to the nice guys that author this kind of software. My question is - how to protect from this? What are some good preventive measures? Of course, besides being sane. Primary I'm interested in desktop systems, but I guess many things are common for server systems as well.

Thank you.

BurningMemory · n00b Joined: 17 Jan 2023 Posts: 56

Hello there! There is two ways to go. What you want to do is avoid
unknown websites, downloading and running unknown software (by unknown people
as well), and just being careful on the internet. Also, make sure you enable a firewall
on your machine. Besides that follow the most important advice - update your system
if it goes on the internet.

If you really want to be paranoid about it, then use virtual machines or even operating
systems like Qubes. Speaking of virtualization, Gentoo supports KVM and XEN both of
which are great. Also, avoid installing too much software that you don't actually
need per say. That is besides technical stuff.

szatox · Advocate Joined: 27 Aug 2013 Posts: 3499

NeddySeagoon · Posted: Sat Feb 08, 2025 2:33 pm Post subject:

carcajou,

There are no technical solutions to social problems. That takes practice ... if in doubt, don't.
Technical approaches are only aimed at damage limitation, not prevention.

A paranoid firewall can help
DROP everything inbound that you are not expecting
REJECT everything outbound except that which you explicit permit. Reject, not drop because you want the logs.

This helps stop the bad guys phoning home and blocks lots of outgoing traffic you didn't know you had.

Security is like the layers of an onion. Identify your threats and deploy the defensive measures to meet those threads.
Do not plan/expect to be 100% successful, the idea is to make an attacker move on to an easier target.

There is also a trade off with usability.
e.g. Unplugging the network cable helps security but it reduces usability to the point of making a desktop system difficult to use.
Turning off javascript may be a price you are prepared to pay
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.