Operation Windigo - Linux ssh exploit and bot net
Way over there on ESET is an analysis of a long running OpenSSH exploit that has resulted in the operation for the last 3 years of an extensive linux Spam and Windows virus/malware/redirect farm...
Specific details about the exploit used here :
Cut to the chase - to check if your system is infected, run
ssh -G 2>&1 | grep -e illegal -e unknown >/dev/null && echo "System clean" || echo "System infected"
Uninfected systems return an error illegal option or unknown option for the -G flag, as well as the usage message
Infected systems only return the usage message.
Specific details about the exploit used here :
Cut to the chase - to check if your system is infected, run
ssh -G 2>&1 | grep -e illegal -e unknown >/dev/null && echo "System clean" || echo "System infected"
Uninfected systems return an error illegal option or unknown option for the -G flag, as well as the usage message
Infected systems only return the usage message.