Explication de ce que fait la commande et en quoi elle peut déterminer si le système est infecté ou pas :
Indicators of Compromise (IOCs)
We will provide two means of identifying the presence of the Linux/Ebury SSH backdoor. The easiest way to identify an infected server relies on the presence of a feature added by the malware to the ssh binary. A longer process involves inspection of the shared memory segments used by the malware.
The command ssh -G has a different behaviour on a system with Linux/Ebury. A clean server will print
ssh: illegal option -- G
to stderr but an infected server will only print the typical “usage” message. One can use the following command to determine if the server he is on is compromised:
$ ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected"
Linux/Ebury relies on POSIX shared memory segments (SHMs) for interprocess communications. The current version uses large segments of over 3 megabytes of memory with broad permissions allowing everyone to read and write to this segment.
Other processes could legitimately create shared memory segments with broad permissions. Make sure to validate that sshd is the process that created the segment like we show below.source : http://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/
J’ai trouvé les réactions globalement bizarres, ici : Soit très peu de réactions, soit des suspicions, comme si un système unix ne pouvait pas être infecté… Alors que le sujet me paraît quand même sérieux. ESET ne me paraît pas être le premier pinpin venu, en terme de sécurité informatique.
)