Vlákno názorů k článku
Eset: útočník má pod kontrolou 10 tisíc linuxových serverů od feri - moze mi niekto povedat naco je -G dobre...

moze mi niekto povedat naco je -G dobre (velke G)?

$ ssh -G
ssh: illegal option -- G
usage: ssh [-1246AaCfgKkMNnqsTtV­vXxYy] [-b bind_address] [-c cipher_spec]
[-D [bind_address:]por­t] [-e escape_char] [-F configfile]
[-I pkcs11] [-i identity_file]
[-L [bind_address:]por­t:host:hostpor­t]
[-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]
[-R [bind_address:]por­t:host:hostpor­t] [-S ctl_path]
[-W host:port] [-w local_tun[:re­mote_tun]]
[user@]hostname [command]

Ah :)

http://www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.pdf Strana 57

A.1.1. Host-based Indicators
A.1.1.1. Linux/Ebury

The command ssh -G has a different behavior on a system with Linux/Ebury.A clean server will print
ssh: illegal option -- G
to stderr but an infected server will only print the usage. One can use the following command
to determine if the server he is on is compromised:
$ ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo
“System clean” || echo “System infected”