Security threats Toolkit

Linux under threat from 'security update'

Munir Kotadia ZDNet Australia

Published: 25 Oct 2004 10:45 BST

Linux maker Red Hat is warning users about an email that pretends to be an official security advisory but is actually a phishing-type scam that contains links to malicious code.

The fake email appears to have been sent from "security@redhat.com" and was first spotted on Friday evening with a subject line: "RedHat: Buffer Overflow in 'ls' and 'mkdir'".

The email contains instructions on how to load and install a 'patch', which Red Hat warns is likely to contain malicious code.

Red Hat said its official security messages are sent from secalert@redhat.com and are digitally signed.

According to the company's Web site: "All official updates for Red Hat products are digitally signed and should not be installed unless they are correctly signed and the signature is verified."

Windows users have been successfully targeted a number of times with malware disguised as a fake 'security update'.

One of the most successful worms of 2003, Swen or Gibe.F, was disguised as a Microsoft patch to fix a flaw in Internet Explorer.

Less than four months later the tactic was tried again, but this time the Xombe or Trojan.Xombe worm, posed as a critical update for Windows XP.

The most recent attempt to fool Windows users was the Sober.D worm that masqueraded as a fix for the MyDoom worm. Munir Kotadia reported from Sydney for ZDNet Australia. For more ZDNet Australia stories, click here.