E-Mail Scam Dupes Linux Users

Red Hat Inc. on Saturday warned users of an e-mail scam designed to plant malicious code on users’ systems. The malicious e-mail poses as a security update from the vendor, a technique that has become familiar to Windows users, but is a novelty in the Linux world.

The e-mail, which has been circulating since late last week, says it originates from the “Red Hat Security Team” and urges users to download a patch fixing vulnerabilities in the ls and mkdir file system utilities. To add a veneer of authenticity, the scammers used an authentic-seeming domain name, fedora-redhat.com, to host the malicious download.

Red Hat increases security in its latest update. Read more here.

“The Red Hat Security Team strongly advises you to immediately apply the fileutils-1.0.6 patch. This is a critical-critical update,” the message says. The e-mail message and the site contained instructions for downloading, decompressing and installing the false update.

The fedora-redhat.com domain name was reported to have been displaying the fake security message as late as Sunday, but by Monday morning it was no longer available. Fedora is Red Hat’s Linux distribution for technology enthusiasts and hobbyists; the company maintains an authentic Fedora site at fedora.redhat.com.

Red Hat became aware of the scam on Saturday, and issued an advisory on the front page of its security site. “These trojan updates contain malicious code designed to compromise the systems they are run on,” said Red Hat Security Response Team leader Mark Cox on Monday, in a statement provided to eWEEK.com.

For insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzer’s Weblog.

Cox said the company never sends unsolicited security messages and noted that all genuine messages and packages are signed with a GPG (Gnu Privacy Guard) digital signature, the details of which are available on Red Hat’s site.

Windows has been hit by several worms that spread via e-mails masquerading as security patches; for example, a version of the Dumaru worm last year spread via fake Microsoft e-mails. A related problem is the proliferation of phishing e-mails, which lure users (on any platform) to a supposedly authentic Web site, where they are induced to enter sensitive information such as bank account details and passwords to e-commerce accounts.

Check out eWEEK.com’s Linux & Open Source Center for the latest open-source news, reviews and analysis.

Be sure to add our eWEEK.com Linux news feed to your RSS newsreader or My Yahoo page