There's a new threat to Linux Systems. It's called Fokirtor. "It's is different from any other Linux backdoor that its security researchers have previously analyzed Malware on Linux systems is mostly a server-side problem and incidents of worms and Trojans". I used a Linux App called Net Activity Viewer. To check my Network Traffic and Thankfully came up clean. No (“:!;.”) in my Traffic.

Netactview is a graphical (GTK) internet/network connections viewer for Linux, similar in functionality with netstat. It is also similar with Windows programs like TcpView or CurrPorts. It's main advantage over netstat is asynchronous data retrieval and display. You can view information fast and easily about large lists of connections including the host name information.

Netactview is a graphical network connections viewer for Linux, similar in functionality with Netstat: Net Activity Viewer; SourceForge.net: netactview

Read More about Fokirtor below..

Don

Linux Back Door Uses Covert Communication Protocol

Created: 13 Nov 2013 16:54:16 GMT | Updated: 14 Nov 2013 03:58:29 GMT | Translations available: 日本語

Symantec Security Response Symantec Employee

In May of this year, sophisticated attackers breached a large Internet hosting provider and gained access to internal administrative systems. The attackers appear to have been after customer record information such as usernames, emails, and passwords. While these internal administrative systems had access to customer records, discovery of the attack and certain security implementations mitigated the scope of the breach. Customer passwords were accessible, but these passwords were hashed and salted making mass password cracking difficult. Customer financial information was also accessible, but encrypted. Unfortunately, access to the encryption key cannot be ruled out. While breaches of organizations and mass customer record dumps are posted almost daily, this particular attack was more sophisticated than we have seen in the past.
The attackers understood the target environment was generally well protected. In particular, the attackers needed a means to avoid suspicious network traffic or installed files, which may have triggered a security review. Demonstrating sophistication, the attackers devised their own stealthy Linux back door to camouflage itself within the Secure Shell (SSH) and other server processes.
This back door allowed an attacker to perform the usual functionality—such as executing remote commands—however, the back door did not open a network socket or attempt to connect to a command-and-control server (C&C). Rather, the back door code was injected into the SSH process to monitor network traffic and look for the following sequence of characters: colon, exclamation mark, semi-colon, period (“:!;.”).
After seeing this pattern, the back door would parse the rest of the traffic and then extract commands which had been encrypted with Blowfish and Base64 encoded.

Read More...
http://www.symantec.com/connect/blogs/linux-back-door-uses-covert-communication-protocol