Giving the little buddy a chance

Yeah, got me into Linux hardening.

It already is pretty rampant, however most Linux admins have minimal if any detection strategy.

Additionally, while there’s plenty of binaries about like VoidLink, almost all campaigns against Linux hosts target SSH, or RCE vulnerabilities, and deliver shell scripts that orchestrate the attack.

Why compile a binary when the shell has everything you need? The threat models are pretty different between Windows and the *nix world.

When you look at botnet composition, they’re usually made up of outdated Linux hosts with SSH open with password-based authentication.

Seriously people, switch to key-based auth and disable password auth entirely.

I forgot but do browsers download binaries as executable?

One of the big issues with windows is the fact that it uses file extensions for determining file type, so EXEs can just be instantly run after downloading, which led to MSFT making the "Mark Of Th Web" attribute, which moved hackers into finding every type of bypass for MOTW.

I think straight bin downloads require you to chmod +x first, but you could also probably bypass it with any archive format like .tar.gz or opting for a .deb or .rpm.

The upside is that you really shouldn't be downloading raw bins outside of the package manager, but there are a bunch of tools that only ship as appimages, so you're kinda screwed if you download and execute from an untrusted source.

Reminder, that once a vulnerability is found, it disappears, FOREVERRRRRR

You don't get that with windows.

Isn't it already the case to steal from companies? I don't know if things like Shai Hulud 2.0 qualifies as malware. Companies are much more lucrative targets so I am not sure personal Linux is changing much.

That is indeed one of the unfortunate but inevitable results of the OS becoming more popular.

Try ReactOS for this experience: https://reactos.org/

Isn't there a video on YouTube of a person trolling a scammer like this? The guy skinned Linux to look like Windows and then gave a phone scammer remote access to their PC and watched him get more and more frustrated and confused by why it wasn't working properly

while running wine with sudo

inside flatpak with tight permissions anyway.

Jokes aside, the fact that Wine defaults to mounting your entire drive to the fake Windows environment is a major security issue. This whole project is a very impressive engineering feat but the user experience is so bad it can have disastrous consequences.