Preventative Maintenance for 'Xnote' Linux Trojan

**chiques** · February 10th, 2015

Any suggestions on precautions I can take?

http://www.techworm.net/2015/02/xnot...s-botnets.html

**carl4926** · February 10th, 2015

Don't run as root

The malware will only be installed in a system if it has been launched with superuser (root) -

**chiques** · February 10th, 2015

Originally Posted by carl4926

Don't run as root

So I'd have to run this malware 'manually' as su? It won't run as root by itself?

**bashiergui** · February 11th, 2015

Originally Posted by chiques

So I'd have to run this malware 'manually' as su? It won't run as root by itself?

You wouldn't run it. Attackers have brute forced internet-facing password, like on ssh. Once they get root access the bad guys run it themselves. So disable password auth on ssh and only use keys. If you don't have any services running open to the internet then you're not the target of the campaign they're talking about in the link.

**mooreted** · February 11th, 2015

Unless you are running something like a website, you don't have to do anything. Your desktop computer or laptop is safe.

**Bucky Ball** · February 11th, 2015

This:

The malware will only be installed in a system if it has been launched with superuser (root) privileges.

This:

The only saving grace for Linux users it that it will not launch itself if it doesnt have the root privileges in the target PC.

... and this:

“The only saving grace for Linux users it that it will not launch itself if it doesnt have the root privileges in the target PC.”

Which is why you don’t log in as ‘root’ and instead ‘sudo’ whenever you need root privileges.

You need to boot your machine and log in as root to open the backdoor. No-one does, and if they do, not advisable.