Comments on: On Linux security http://www.happyassassin.net/2009/01/20/on-linux-security/ Fri, 30 Jul 2010 16:17:43 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: tech78 http://www.happyassassin.net/2009/01/20/on-linux-security/comment-page-1/#comment-565 tech78 Mon, 02 Feb 2009 20:42:17 +0000 http://www.happyassassin.net/?p=484#comment-565 As a support tech who's cleaned up more than his share of virus & malware infected Windows machines, I've seen nothing comparable to the "drive-by" vulnerabilities posed by ActiveX scripting. I know Java and Javascript come close, but still nothing like the gaping hole provided by the Internet Explorer/ActiveX combo from what I see in the field. As a support tech who’s cleaned up more than his share of virus & malware infected Windows machines, I’ve seen nothing comparable to the “drive-by” vulnerabilities posed by ActiveX scripting. I know Java and Javascript come close, but still nothing like the gaping hole provided by the Internet Explorer/ActiveX combo from what I see in the field.

]]> By: Boycott Novell » IRC: #boycottnovell @ FreeNode: January 21st, 2009 - Part 1 http://www.happyassassin.net/2009/01/20/on-linux-security/comment-page-1/#comment-488 Boycott Novell » IRC: #boycottnovell @ FreeNode: January 21st, 2009 - Part 1 Thu, 22 Jan 2009 10:01:28 +0000 http://www.happyassassin.net/?p=484#comment-488 [...] AdamW is still insisting that Linux is not secure (et tu, Adam?): http://www.happyassassin.net/2009/0… [...] [...] AdamW is still insisting that Linux is not secure (et tu, Adam?): http://www.happyassassin.net/2009/0…; [...]

]]> By: vfmmeo http://www.happyassassin.net/2009/01/20/on-linux-security/comment-page-1/#comment-487 vfmmeo Wed, 21 Jan 2009 13:13:04 +0000 http://www.happyassassin.net/?p=484#comment-487 @Dark: That's the key! @Dark:

That’s the key!

]]> By: Dark_Schneider971 http://www.happyassassin.net/2009/01/20/on-linux-security/comment-page-1/#comment-486 Dark_Schneider971 Wed, 21 Jan 2009 10:45:38 +0000 http://www.happyassassin.net/?p=484#comment-486 adamw> I wrote a more complete follow-up on my blog : http://linux-wizard.net/blog-follow_up__on_linux_security-250.html adamw> I wrote a more complete follow-up on my blog : http://linux-wizard.net/blog-follow_up__on_linux_security-250.html

]]> By: Dark_Schneider971 http://www.happyassassin.net/2009/01/20/on-linux-security/comment-page-1/#comment-485 Dark_Schneider971 Wed, 21 Jan 2009 10:44:59 +0000 http://www.happyassassin.net/?p=484#comment-485 boklm> Sure, but it's also because on Linux we are not used to install third-party software. But when you may have a mass market for Linux, you will have more third-parties softwares ( i.e proprietary softwares ) that people will have to install themselves manually as some may not be packages by the distro. Thinks of some games, Photoshop, iTunes, etc .... Ok, we have nearly equivalent, but at the end, it's the user who takes the decision. boklm> Sure, but it’s also because on Linux we are not used to install third-party software. But when you may have a mass market for Linux, you will have more third-parties softwares ( i.e proprietary softwares ) that people will have to install themselves manually as some may not be packages by the distro. Thinks of some games, Photoshop, iTunes, etc …. Ok, we have nearly equivalent, but at the end, it’s the user who takes the decision.

]]> By: boklm http://www.happyassassin.net/2009/01/20/on-linux-security/comment-page-1/#comment-484 boklm Wed, 21 Jan 2009 09:56:24 +0000 http://www.happyassassin.net/?p=484#comment-484 @vfmmeo: yes you can also install software manually on Linux, but that's not what you do most of the time. On Windows that's what you have to do most of the time because there is no other way. That's the difference. @vfmmeo: yes you can also install software manually on Linux, but that’s not what you do most of the time. On Windows that’s what you have to do most of the time because there is no other way. That’s the difference.

]]> By: vfmmeo http://www.happyassassin.net/2009/01/20/on-linux-security/comment-page-1/#comment-483 vfmmeo Wed, 21 Jan 2009 08:19:42 +0000 http://www.happyassassin.net/?p=484#comment-483 @boklm <i>"- On Linux you use the package manager."</i> Not ever is true. That's the matter. If your distro has not packaged the soft, if the propietary driver isn't available, if you're new on Linux and all you know to do is the windows way... And, what's the difference (again) between "halleberrynude.rpm" (or .deb) and "halleberrynude.exe". You only need a double-click and a root password? @boklm

“- On Linux you use the package manager.”

Not ever is true. That’s the matter. If your distro has not packaged the soft, if the propietary driver isn’t available, if you’re new on Linux and all you know to do is the windows way…

And, what’s the difference (again) between “halleberrynude.rpm” (or .deb) and “halleberrynude.exe”. You only need a double-click and a root password?

]]> By: boklm http://www.happyassassin.net/2009/01/20/on-linux-security/comment-page-1/#comment-482 boklm Tue, 20 Jan 2009 18:53:10 +0000 http://www.happyassassin.net/?p=484#comment-482 I agree with what you said, but I think there is still a reason why it's much more easy to create a virus on Windows : - On Windows the usual way to install a software is to use google and download it from a randow web site. And some of those web sites are created by people who happen to have a virus on their computer. - On Linux you use the package manager. - On Windows because you have to download programs yourself, people often keep executable files in some folders on their hard drive, a few months later they burn them on a CD, and use them on an other computer or give it to their friends. A virus infecting all executables on a computer can easily move to an other computer this way. - On Linux everything is available in the packages repository. Keeping a collection of packages on your hard drive is not very useful so most people don't do it. I agree with what you said, but I think there is still a reason why it’s much more easy to create a virus on Windows :
- On Windows the usual way to install a software is to use google and download it from a randow web site. And some of those web sites are created by people who happen to have a virus on their computer.
- On Linux you use the package manager.
- On Windows because you have to download programs yourself, people often keep executable files in some folders on their hard drive, a few months later they burn them on a CD, and use them on an other computer or give it to their friends. A virus infecting all executables on a computer can easily move to an other computer this way.
- On Linux everything is available in the packages repository. Keeping a collection of packages on your hard drive is not very useful so most people don’t do it.

]]> By: adamw http://www.happyassassin.net/2009/01/20/on-linux-security/comment-page-1/#comment-481 adamw Tue, 20 Jan 2009 18:24:25 +0000 http://www.happyassassin.net/?p=484#comment-481 Dark: "In fact the strength of Linux is the fact that … it’s not easy to install third-party applications ! Indeed to install third-party applications you have to deal with several issues : package format ( TGZ vs RPM vs DEB ), API/libraries versions issues, compatibility issue, need to know root password eventually." Well, I'm not really sure that's a big deal, to be honest. Sure, it's an issue for legitimate code. But most malicious code is fairly simple. To wipe your hard disk, all it needs is dd and /dev/zero, after all. No APIs or libraries involved. I don't see package format as a big deal, either. Just pick one and attack it, or provide two malicious packages. Again, a malicious *package* only needs to be very simple, so all the complexities of the different formats don't really matter. "or easier : only install packages from trusted sources. However, is Mandriva checking all the code in all of its packages ? I don’t think so." No, exactly. I was going to extend the post to cover that, but it was getting rather long. Never mind Mandriva - practically speaking, no popular end-user distribution is remotely close to reliably auditing all the code it contains. I can believe that, say, whatever the NSA runs on its critical systems, that's 100% audited. But Fedora? Ubuntu? Mandriva? Nope, not a chance. Even if we assume that it would be difficult for a malicious person to become a trusted packager (which, as you point out, isn't really true), no packager audits all the code they package. They just trust upstream. Dark: “In fact the strength of Linux is the fact that … it’s not easy to install third-party applications ! Indeed to install third-party applications you have to deal with several issues : package format ( TGZ vs RPM vs DEB ), API/libraries versions issues, compatibility issue, need to know root password eventually.”

Well, I’m not really sure that’s a big deal, to be honest. Sure, it’s an issue for legitimate code. But most malicious code is fairly simple. To wipe your hard disk, all it needs is dd and /dev/zero, after all. No APIs or libraries involved. I don’t see package format as a big deal, either. Just pick one and attack it, or provide two malicious packages. Again, a malicious *package* only needs to be very simple, so all the complexities of the different formats don’t really matter.

“or easier : only install packages from trusted sources. However, is Mandriva checking all the code in all of its packages ? I don’t think so.”

No, exactly. I was going to extend the post to cover that, but it was getting rather long. Never mind Mandriva – practically speaking, no popular end-user distribution is remotely close to reliably auditing all the code it contains. I can believe that, say, whatever the NSA runs on its critical systems, that’s 100% audited. But Fedora? Ubuntu? Mandriva? Nope, not a chance. Even if we assume that it would be difficult for a malicious person to become a trusted packager (which, as you point out, isn’t really true), no packager audits all the code they package. They just trust upstream.

]]> By: Dark_Schneider971 http://www.happyassassin.net/2009/01/20/on-linux-security/comment-page-1/#comment-480 Dark_Schneider971 Tue, 20 Jan 2009 17:56:02 +0000 http://www.happyassassin.net/?p=484#comment-480 You're are 100% right Adam. In fact the strength of Linux is the fact that ... it's not easy to install third-party applications ! Indeed to install third-party applications you have to deal with several issues : package format ( TGZ vs RPM vs DEB ), API/libraries versions issues, compatibility issue, need to know root password eventually. So one of the main weakness of Linux to be able to be easy to use for mass consumer market is fact also what allow Linux to be less targeted by malware. When everybody will be running ubuntu with full sudo power for first user, then we will have the same issues than Windows users ;-) SELinux/AppArmor may help, but most of the time only for known applications as you can provide rules saying that application X is allowed to this, but not allowed to do that. But for a third-party application ? as you don't know, you will let the application do whatever he wants, and then he can just open a port on a unprivileged port and listen or send informations ... The only way to be protected against theses kinds of issues are : - monitor changes to critic system configuration files or binaries ( chkrootkits for example ) - prevent unknown or unwanted applications from communicating to outside world with a Firewall ( however at one point users will just answer yes to everything ). - monitor system activity for abnormal ones ... in short running an AntiVirus/AntiTrojan/AntiMalware ... - or easier : only install packages from trusted sources. However, is Mandriva checking all the code in all of its packages ? I don't think so. It's easy to become the packager for a distribution, doing a good job at the beginning, and when you are ready, ad some subtle change that will allow you to install a rootkit or trojan in the users computers. And you don't even need to do a "rm -fr /" right after the package installation. Just edit root crontab or put a file in /etc/cron.monthly or cron.yearly. You’re are 100% right Adam.

In fact the strength of Linux is the fact that … it’s not easy to install third-party applications ! Indeed to install third-party applications you have to deal with several issues : package format ( TGZ vs RPM vs DEB ), API/libraries versions issues, compatibility issue, need to know root password eventually.

So one of the main weakness of Linux to be able to be easy to use for mass consumer market is fact also what allow Linux to be less targeted by malware. When everybody will be running ubuntu with full sudo power for first user, then we will have the same issues than Windows users ;-)

SELinux/AppArmor may help, but most of the time only for known applications as you can provide rules saying that application X is allowed to this, but not allowed to do that. But for a third-party application ? as you don’t know, you will let the application do whatever he wants, and then he can just open a port on a unprivileged port and listen or send informations …

The only way to be protected against theses kinds of issues are :
- monitor changes to critic system configuration files or binaries ( chkrootkits for example )

- prevent unknown or unwanted applications from communicating to outside world with a Firewall ( however at one point users will just answer yes to everything ).

- monitor system activity for abnormal ones … in short running an AntiVirus/AntiTrojan/AntiMalware …

- or easier : only install packages from trusted sources. However, is Mandriva checking all the code in all of its packages ? I don’t think so. It’s easy to become the packager for a distribution, doing a good job at the beginning, and when you are ready, ad some subtle change that will allow you to install a rootkit or trojan in the users computers. And you don’t even need to do a “rm -fr /” right after the package installation. Just edit root crontab or put a file in /etc/cron.monthly or cron.yearly.

]]>