• 1 Post
  • 18 Comments
Joined 3 years ago
cake
Cake day: December 20th, 2021

help-circle





  • It was more than just a special icon for a folder, it had special behaviour too. Without looking it up (in the spirit of the meme), I seem to remember that it would automatically sync the files any time that you insert the floppy disk, kind of like having Dropbox but without the internet. The idea being that you would have files on your computer that you could take with you somewhere else (in your briefcase, on a floppy disk) and all instances of that briefcase would automatically sync the latest updates of the files without you having to manually copy them and work out which was the latest version of a file.






  • drspod@lemmy.mltoMemes@lemmy.mlUnpopular Opinion
    link
    fedilink
    arrow-up
    8
    arrow-down
    1
    ·
    10 months ago

    It only takes one paying customer to take the published FOSS code from the commercial software and re-distribute it for everyone to benefit from the commercial modifications made to it. That’s the point, a commercial use of the software can not make the source proprietary.

    This is what Redhat recently found out when they tried to hide their RHEL source behind a paywall. Attempting to tie the hands of their customers with an additional license agreement forbidding distribution of the source is a violation of the GPL.




  • The Kaspersky analysis noted that the malware contained comments in the shell scripts written in Ukrainian and Russian, and used malware components detected in previous malware campaigns since 2013 that presumably have been attributed to a specific group.

    FTA:

    Meanwhile, the postinst script contains comments in Russian and Ukrainian, including information about improvements made to the malware, as well as activist statements. They mention the dates 20200126 (January 26, 2020) and 20200127 (January 27, 2020).

    Having established how the infected Free Download Manager package was distributed, we decided to check whether the implants discovered over the course of our research have code overlaps with other malware samples. It turned out that the crond backdoor represents a modified version of a backdoor called Bew. Kaspersky security solutions for Linux have been detecting its variants since 2013.

    The Bew backdoor has been analyzed multiple times, and one of its first descriptions was published in 2014. Additionally, in 2017, CERN posted information about the BusyWinman campaign that involved usage of Bew. According to CERN, Bew infections were carried out through drive-by downloads.

    As for the stealer, its early version was described by Yoroi in 2019. It was used after exploitation of a vulnerability in the Exim mail server.







  • What was your XMPP client connecting to? Was it a well-known public endpoint (that they could be whitelisting) or was it a private server? If the latter then that indicates that they are allowing arbitrary IP connections which in theory means that you should be able to proxy any traffic you want. I doubt they are doing DPI, since TLS makes this very difficult these days when you don’t control the certificate stores on the clients.

    I’d imagine they’re relying on some combination of DNS whitelisting and port blocking which should be trivial to circumvent if you know ahead of time what traffic they allow through.