Dear fellow Fedora users,
As I am also a regular visitor of Slax forum, I was also a particiant of a thread "Myths or reality about linux and security"
http://www.slax.org/forum.php?action=view&parentID=36246
, someone posted the following link:
http://www.eweekeurope.co.uk/news/developer-ponders-release-of-linux-malware...
In that page it is mentioned that malware can be made for linux and it can do harm too :(, Selinux can catch it(crossing fingers) according to them, but is one safe from all those threats?
Regards,
Antonio
Antonio Olivares wrote:
Dear fellow Fedora users,
As I am also a regular visitor of Slax forum, I was also a particiant of a thread "Myths or reality about linux and security"
http://www.slax.org/forum.php?action=view&parentID=36246
, someone posted the following link:
http://www.eweekeurope.co.uk/news/developer-ponders-release-of-linux-malware...
In that page it is mentioned that malware can be made for linux and it can do harm too :(, Selinux can catch it(crossing fingers) according to them, but is one safe from all those threats?
Regards,
Antonio
If you think your safe because you run Linux then please step away from computers. My windows box at home has never been compromised or had problems and obviously as a gaming box it see's a lot of patches/mods downloaded. You could be running OpenBSD and still get caught out. The amount of people that get caught out by such things as "Check the pics that where uploaded of you, they are BADD!! etc etc and fall for it is ridiculous. Don't think that just running Linux makes you safe...
On Wed, Dec 02, 2009 at 02:48:09PM +0000, Michal wrote:
If you think your safe because you run Linux then please step away from computers. ...
Yes, but with qualifications. The problem with Windows has been, and generally is, that the user usually runs with elevated privileges--compromise that user, you compromise the entire OS. Microsoft tried (clumsily) to batten down that hatch with Vista--got fried for it (among many other shortcomings), and with Windows 7 has loosened security again, to the point the problem is back.
Linux (or Unix) isn't immune to any program that a cracker can get you to run (Trojans). What it *is* generally immune to is system-wide corruption of the OS, since privilege separation is native to the OS model. That is, if you only run as user 'foobar', and are tricked into running a trojan, YOU, as user foobar, are infested. If security is properly configured, you can't modify general OS files.
Now, there are caveats all OVER the place. First, there are almost certainly people out there who run as root. All bets are off in that case--they get compromised, the box is compromised.
Secondly, once you (as the bad guy) get a user to run something for you, you can start poking at the system itself. In this case, you're looking for a flaw in the system security itself--either misconfiguration, or an actual hole in some program or service that a normal user can run or use. Much harder than Windows, but such flaws have been encountered in the past. Failure on the user's part to maintain updates helps this kind of attack; the probability of a zero-day or longer term unknown flaw is low, and the Linux developer community is very responsive to repairing security-related bugs as they're discovered.
SO--Linux provides a deeper level of protection through integral privilege separation than Windows. While no OS is unbreakable, the barrier IS higher for Linux.
You can help it--run as an unpriviliged user except when necessary. Don't put in hacks that make it easy to elevate to root without a password. Maintain your updates.
Cheers, -- Dave Ihnat dihnat@dminet.com
On 12/02/2009 10:09 AM, Dave Ihnat wrote:
Secondly, once you (as the bad guy) get a user to run something for you, you can start poking at the system itself. In this case, you're looking for a flaw in the system security itself--either misconfiguration, or an actual hole in some program or service that a normal user can run or use.
As has been pointed out, however, serious damage can be done even if the cracker never gets root privileges. One could install new extensions to Firefox, for example, that would give the cracker access to passwords. Or install programs into the user's home directory, run them from .bash_profile, or whatever, and send spam around the world just using "mail", the messages themselves being downloaded via wget. Etc, etc. All very dangerous.
Richard
On Wed, 2009-12-02 at 11:04 -0500, Richard Heck wrote:
As has been pointed out, however, serious damage can be done even if the cracker never gets root privileges.
Many people lose sight of the fact that their important data is in their home directory.
If I lose /bin I can download and reinstall stuff to create it again.
If I lose my home directory, all of my data is gone and I can't just download it from some random ftp server and reinstall.
Yet /bin is much better protected (from me) than my home directory.
On 12/2/09, Frank Cox theatre@sasktel.net wrote:
Many people lose sight of the fact that their important data is in their home directory.
If I lose /bin I can download and reinstall stuff to create it again.
If I lose my home directory, all of my data is gone and I can't just download it from some random ftp server and reinstall.
Yet /bin is much better protected (from me) than my home directory.
Doing frequent backups is the way to protect your home directory.
Andras
On Wed, 2009-12-02 at 10:29 -0600, Frank Cox wrote:
On Wed, 2009-12-02 at 11:04 -0500, Richard Heck wrote:
As has been pointed out, however, serious damage can be done even if the cracker never gets root privileges.
Many people lose sight of the fact that their important data is in their home directory.
If I lose /bin I can download and reinstall stuff to create it again.
Not if it's been replaced by something else without you noticing.
If I lose my home directory, all of my data is gone and I can't just download it from some random ftp server and reinstall.
So back it up.
Yet /bin is much better protected (from me) than my home directory.
Linux is a multi-user system. The fact that it often has only one user doesn't change that.
poc
On Wednesday 02 December 2009 16:04:58 Richard Heck wrote:
On 12/02/2009 10:09 AM, Dave Ihnat wrote:
Secondly, once you (as the bad guy) get a user to run something for you, you can start poking at the system itself. In this case, you're looking for a flaw in the system security itself--either misconfiguration, or an actual hole in some program or service that a normal user can run or use.
As has been pointed out, however, serious damage can be done even if the cracker never gets root privileges. One could install new extensions to Firefox, for example, that would give the cracker access to passwords. Or install programs into the user's home directory, run them from .bash_profile, or whatever, and send spam around the world just using "mail", the messages themselves being downloaded via wget. Etc, etc. All very dangerous.
Social engineering cannot be solved by technology. If one is stupid enough to accept a trojan and gets compromised, it is one's own fault. However, the main advantage of Linux in this situation is that *other* users are still pretty much safe, while in Windows compromising one user usually means compromising the whole machine, which opens a door to *all* users on that machine. And that is far worse --- if you share the machine with a fellow user who is dumb enough to fall for trojans, he is compromising *your* security if on Windows, while only his own if on Linux.
Best, :-) Marko
On Wednesday 02 December 2009 16:29:15 Frank Cox wrote:
On Wed, 2009-12-02 at 11:04 -0500, Richard Heck wrote:
As has been pointed out, however, serious damage can be done even if the cracker never gets root privileges.
Many people lose sight of the fact that their important data is in their home directory.
User's data is user's responsibility. No amount of technology and clever programming will help me if I do a "rm -rf ~" or tell someone the password for my bank account.
If I lose /bin I can download and reinstall stuff to create it again.
If I lose my home directory, all of my data is gone and I can't just download it from some random ftp server and reinstall.
Losing != compromising. It would be stupid for an intruder to simply delete /bin. Instead, he will modify the binaries in order to gain sufficient control over the machine.
Yet /bin is much better protected (from me) than my home directory.
If your home directory gets compromised, *your* data gets compromised. If /bin gets compromised, *everyone's* data gets compromised. /bin is better protected from you than your home dir because you may not be the only user on the machine. While it is impossible to protect your own data from you, it *is* possible to protect data of *other* users from you (in case you get compromised). Linux is designed as a multiuser OS (unlike Windows), hence better protection for system files.
Best, :-) Marko
On Wednesday 02 December 2009 15:09:46 Dave Ihnat wrote:
Secondly, once you (as the bad guy) get a user to run something for you, you can start poking at the system itself. In this case, you're looking for a flaw in the system security itself--either misconfiguration, or an actual hole in some program or service that a normal user can run or use. Much harder than Windows, but such flaws have been encountered in the past.
SELinux exists precisely for this purpose --- to combat privilege escalation and contain misbehaving apps. Only kernel vulnerabilities are out of its reach, AFAIK.
Best, :-) Marko
On Thu, Dec 03, 2009 at 00:06:29 +0000, Marko Vojinovic vvmarko@gmail.com wrote:
If /bin gets compromised, *everyone's* data gets compromised. /bin is better protected from you than your home dir because you may not be the only user on the machine. While it is impossible to protect your own data from you, it *is* possible to protect data of *other* users from you (in case you get compromised). Linux is designed as a multiuser OS (unlike Windows), hence better protection for system files.
SELinux allows for some protection of your data from you. For example you can have policy keep web browsers, email readers or other dangerous (in that they process externally provided data or are provided by corporations whose marketting departments reign supreme) applications from reading parts of your home directory.
On Wed, 2009-12-02 at 09:09 -0600, Dave Ihnat wrote:
Yes, but with qualifications. The problem with Windows has been, and generally is, that the user usually runs with elevated privileges--compromise that user, you compromise the entire OS.
Not to mention that with Linux, you generally have to work at something to make it executable (e.g. some unexpected download that happens in the background is very unlikely to be able to run as a program, all by itself).
Compared to Windows, which places very few restrictions against running programs thrown in its direction. e.g. Malicious executable files running in received spam mail because they were falsely declared to be midi files (they're sent as background music to be played along with a HTML mail, midi files are supposedly safe so it's supposedly safe to get the system to automatically handle this supposed midi file, the system gets passed the file and discovers that its an executable file, the system does what it normally does to executable files and runs it, rather than do what it normally does to midi files and fail trying to play a non-midi with a midi player). That kind of problem's existed for years.
Windows... proving that it's the thought that counts...
On Thu, Dec 03, 2009 at 11:07:25 +1030, Tim ignored_mailbox@yahoo.com.au wrote:
Windows... proving that it's the thought that counts...
Self extracting archives are another great feature. shar files went away on unix systems years ago. I have had discussions with people about the sanity of using self decrypting archives sent via email. They didn't seem to see any problem with typing a password into an unsigned program received via email.
On Wed, 2009-12-02 at 18:55 -0600, Bruno Wolff III wrote:
On Thu, Dec 03, 2009 at 11:07:25 +1030, Tim ignored_mailbox@yahoo.com.au wrote:
Windows... proving that it's the thought that counts...
Self extracting archives are another great feature. shar files went away on unix systems years ago. I have had discussions with people about the sanity of using self decrypting archives sent via email. They didn't seem to see any problem with typing a password into an unsigned program received via email.
Many (many!) years ago I used the exmh mail client, which is a front-end to MH written in TCL. It was pretty nifty for it's time (the 90's) and of course being in TCL meant that all sorts of cool hacks could be played with. One day someone proposed on the list a trick for sending auto-executable content in a mail message. Even though this was in a Unix environment, everyone instantly yelled "Are you INSANE?".
Somehow I don't think Microsoft got the memo.
poc