Based on Mirai malware, self-replicating NoaBot installs cryptomining app on infected devices.
the NoaBot targets weak passwords connecting SSH connections.
Harden your configs people.
AllowUsers is a really goood one.
Or just don’t allow password auth at all.
Or just have a good password
If we’re going to play that game. Require an Ed25519 key with a strong password.
Or ed25519-sk.
(In this case the “wrench” is just breaking into some weak link that isn’t ssh, once your password is strong to not be a weak link)
Also install something like fail2ban to prevent brute force attacks.
Akamai has published an extensive library of indicators that people can use to check for signs of NoaBot on their devices (https://github.com/akamai/akamai-security-research/tree/main)
GCs those Akamai folks…
What does GC stand for? https://www.acronymfinder.com/Slang/GC.html
Good cunts - it’s originally an Aussie term of endearment, as far as I’m aware
Garbage Collection
What does GC stand for?
Girthy Cocks maybe?
As a compliment, u noe?
Like saying they have Balls of Steel.Game Cube
In this context i’m going with Game Chick from that list, because none make sense to me.
Geocities
here’s a link to the script. its nothing fancy, but makes it easy to check: https://github.com/akamai/akamai-security-research/blob/main/malware/noabot/noabot_detect.sh
here’s a link to the script.
“MagicPussy” doesn’t sound that bad. 😏
Very poor title, like someone’s just got their “Big Book of Clickbait”
Everything is under attack all the time, and everything is never-before-seen until it’s seen.
I love how in security, we have gone from “use strong passwords” to “don’t make your own passwords”, because people will just refuse to learn.
