Slashdot Mirror
Cross-Platform Pseudo-Virus: Don't Panic
spam-it-to-me-baby writes: "It's only based on one reported sighting (i.e. it could be bulls**t), but anti-virus software hacks Central Command say they have found the first Windows/Linux cross-platform virus. It appears only to be a proof of concept with no malicious payload, and targets Windows PE files or Linux ELF files once it recognises the infected OS." There are stories at CNET and at Wired as well, not to mention at NewsForge. Despite the Wired story causually saying so, though, this is anything but an "equal opportunity" virus, except in that it seems to infect multiple media sources without discrimination. When was the last time you ran unknown programs (as root) on your machine, then manually copied them (and ran as root) on another machine as well?
When was the last time you ran unknown programs (as root) on your machine, then manually copied them (and ran as root) on another machine as well?
Every day. I have not personally looked at the source for the vast majority of the daemons I use on all my linux boxes.
--
Give a man a match, you keep him warm for an evening.
Give a man a match, you keep him warm for an evening.
Light him on fire, he's warm for the rest of his life
An article from Reuters about it:
Reuters
Central Command says it has developed a cure for the virus at its Web site (Avx.Com).
Jethro
Quidquid latine dictum sit, altum viditur.
RedHat has two links on their front page at redhat.com. Maybe they got scared, although there really isn't anything to be scared of with this particular virus. It is kind of cool that it afflict PE and ELF files.
Check out Althea for a stable IMAP email client for X. Now with SSL!
When was the last time you copied a binary executable from one Linux machine to another, and then ran it on the second machine as root?
Code that has to be spread manually is not a "virus." Code that exists only on one machine (!) is not a virus. This code is as much a "virus" on Linux as that text: "hi, I'm an email virus, copy me into your sig!" Reporting it as a "virus" is very irresponsible of Reuters.
Jamie McCarthy
Jamie McCarthy
jamie.mccarthy.vg
Well, I haven't been getting enough sleep lately...
"You want me to what? Okay sure. But then can I sleep?"
"Wide Open" reported it, not RedHat. That's a news grabber.
Do you like German cars?
GET FREE MONEY!!! You can get a lot of FREE MONEY if you send this file to everybody in your address book and delete all the files on your computer! Do it! All the cool people are doing it!!!!
Tell me what makes you so afraid
Of all those people you say you hate
when I see it. Besides different file systems inherent in the two OS's, they have different enough hierachial architectures that something that will affect Windows one way will not affect Linux in the same way. Any virus will become malicious if the user is irresponsible wiht their own system (e.g. logging in as root).
There are no bad virii, just bada users.
========================== pipe(13) -- can you figure it out?
The article says that the virus is licensed under the GPL, so doesnt that mean it should infect all your executables with the source code as well, since the GPL states that you should be able to get the source in the same manner that you get the binaries.
When was the last time you ran unknown programs (as root) on your machine, then manually copied them (and ran as root) on another machine as well?
.exes they get in the mail, especially if there's any chance of seeing a little skin or some cuss-filled animation.
Considering most people who run Windows run as root by default (9x, ME) or by choice (Administrator-equiv user on NT or 2k), it's not hard to conceive of them running as root on a workstation-based linux machine.
I definitely see less-sophisticated users running a Windows and Linux combo trying out a "cool win/linux app!" that their friends sent them. God knows that a major portion of morons where I work, in SPITE of the long history of trojans/viruses/general maliciousness via email will without question run
... the VBS/Word virus?
Used the scripting features in all versions of Word on both Windows and Macs.
The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
http://benny29a.cjb.net/
Why use binaries when there is the Source? Except for some non-opensoftware I am interested in, 99% of my machine works on homebuilt binaries, directly from source. Not only are these binaries optimised for my particular machine, I am also able to tweak things in the source myself. .c files.
I have yet to see a virus which infects
Apart from that: just take all binaries you use from sites you trust (eg. Netscape from http://www.netscape.com, Blender from http://www.blender.nl).
This is a replacement signature.
Portable Executable (Format)
While only an idiot runs mystery software as root on a *nix system, what happens when you dual boot into Windows to play that favorite game or run that beloved flight simulator? At this point you *are* essentially running everything as "root", and Linux filesystems are potentially just as accessible and corruptable as windows filesystems (assuming the virus is smart enough to parse the inode map, or a ext2win type driver is loaded in windows).
The infection vector for Linux software may be more via the windows dual-boot option so many of us keep around, rather than the clueless newbie running a downloaded executable as root. If the virus author chooses a target intelligently, one which runs as root by default (for example, say, "getty" or "X"), your Linux system could well become a warren of virial activity no matter how secure the Linux portion of the configuration is.
Using an encrypted filesystem, inaccessible under windows, might prevent this sort of contagion, but of course that wouldn't prevent the windows incarnation of the virus from simply trashing the encrypted data and destroying the Linux installation outright.
The upshot is, if you have Windows installed on your system, and use it in any kind of promiscuous fashion (which, for an operating system as insecure as Windows must include having any kind of connection to the internet), any data anywhere on the hardware is at risk, and all the security Linux or FreeBSD offers you is for naught.
The Future of Human Evolution: Autonomy
W32.Winux contains internal text strings. It also contains the following text: ?[Win32/Linux.Winux] multi-platform virus by Benny/29A? and ?'This GNU program is covered by GPL.?
It appears that the Free Software Foundation's message has finally reached the cracker community.
"
Spread Method : by infecting files under both Windows and Linux operating system
"
So it infects files by infecting them, eh?
Come on guys, at least make it look convincing, even if it is real...
THL.
--
Keeping
OK, this is what we all expected, didn't we? Since Linux is by now so easy to use that even the dumbest wannabe-admin can have a go, the chance of survival for Linux-related viruses has grown by something. I'm sure there are quite a lot of people who ALWAYS log into their Linux-boxes as root because, well, it can be quite a pain not to be allowed to touch, read, change all of the files... I've seen Linux systems which were so tightly administered that they required root-rights to start a filemanager. But on the other hand, the guy working on these boxes never used an account other than root, as he didn't want to have to switch users all the time. So it goes... Even the best and most virus-proof OS fails if the operator using it is incompetent - or just lazy. I never switch on my computer - that's how I know it's virus-free :o)
Then it can replicate itself into every .doc file
on the server, as well as root the servers for later nastyness. Yikes,
makes my skin crawl just thinking about it.
Most people focus on hardening their externally visible servers, not the ones in the back room that are invisible to the outside world. Now we've got to worry about any server reachable from anything that runs Outlook or Word.
Arrg.
-- ac
As long as you are carefull on what you exec, and you make use of wonderfull tools like:
LIDS
Tripwire
Logcheck
Portsentry
etc.
etc.
etc.
You have a big chance of stopping or in the worst case, minimize the impact of many, many, many possible "linux virus" that may appear now or in the future.
And, for your daemons, services, etc., you can always search the code for something suspicious.
Some idiots have been pestering newsgroups with javascript based posts. This is cross platform and any browser/newsgroup reader that is javascript enhanced will be stung by it. So far it's only pop-up mail and pop-up browser windows but be careful if you have javascript turned on and you read newsgroups.
DanH
Cav Pilot's Reference Page
Cav Pilot's Reference Page
UNIX - Not just for Vestal Virgins anymore
Fair enough, claim that only "idiots" run unknown software on their box, and that because you are so 133t, you compile all software you use.
Which proves what? That you've compiled some software, and *then* run it.
Did you study the source code at length? Check it personally that it didn't have any back doors whatsoever? Hmmmm? Sure it wasn't a trojaned source you downloaded (The server could have been hacked right?)
Just because you compiled from source, doesn't mean your newly-created binaries are therefore perfect and couldn't *possibly* contain a trojan of some sort.
Tell me what makes you so afraid
Of all those people you say you hate
Did anyone read the CNN article? They mention the virus is written a "Primitive" langauage called assembly. Um, eventually all programs are written in this language. I just found it funny that this article seemed to be written for either the housewife at home or the executives neither of which knows better. Being that it is in assembly, my guess this only works on intel only architectures and you would have to be dumb to double click on an unknown file. Oh wait, that has already been proven to be a normal thing for people to do.
Smells very much like an early April Fool.
--
jambo
system.admin.without.a.clue
-- js.
Last time I looked there were 5 known Linux viruses (including variants). None of them had t0rn as a payload, so they didn't actually do much harm, and none of them managed to propogate out of control like the recent bubble-boy onwards Windows stuff.
THL.
--
Keeping
#!/bin/sh /home/*/*.jpg
#save this as 'thisiscool.sh' and email to everyone
rm -rf
echo thanks for running my first Virus
it removes all your jpegs, and spreads by mean people convincing stupid people to run this shell script. this viruis mostly hurts people you don't like.
"The Most Fun Possible on 4 wheels" is at SunBuggy in Las Vegas
This is no more than an Anti-Virus software vendor getting free publicity, trying to score brownie points over their competitors.
ARGH! How could I fall for a troll like that!
The first line didn't look like a troll, and I didn't read the rest.
Linux has never been considered a 'secure' OS. It's just not as shot through with holes as some others.
THL.
--
Keeping
How does this work? How in the name of heaven can a program be both and elf and and exe?
If you can do this is there the possibility to write executibles that run on both Windows and Linux that are useful. I hate to say it but I have to wonder if it is a hoax of somekind.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
I forget the exact details, but some bloke demonstrated a trojaned compiler that would recognise that it was compiling the source to login, and insert a back door.
:-)
It would also recognise when it was compiling its own source, and insert the code to insert the backdoor in login...
Read the source all you like - the ultra-paranoid cannot even trust that
Cheers,
Tim
It's official. Most of you are morons.
...but I would venture to say that most original viruses began as a 'proof of concept.' While this is all fine and good, the code inevitably seeps out to bored, frustrated, or extreme individuals. These people waste no time incorporating some kind of malicious intent into creative code. I imagine we'll see some zealot take ahold of this, make it damage Windows machines while displaying a colorful message to Linux users like 'aren't you glad you use Linux?' Of course, this may be pushing it but how many times have we seen this progression before?
Why bother.
Uh pretty often. I don't care too much about security, so often I do all my work in root. But then I've never gotten a virus (both on Windows and Linux side), so I'm sure I'm not as paranoid as I could be.
- I don't care if they globalize against free speech. All my best free thoughts are done in my head.
. . .
I believe he said only idiots run unknown software as root on a *nix machine, and I tend to agree. You shouldn't be logged in as root, even on your own box, unless you really need to be.
I think it's time to go back to a.out binaries. Who's with me?
Only one problem I seee with this logic. When in windows, can you see an ext2 partition on the same drive? NOPE! Windows can't see ext2. The more dangerous one would be if you were logged in as root with your windows drives mounted. Then, you'd infect both partitions. So, if your in windows and get it, not a huge deal. You'd only loose Windows stuff. Personally, I can't see WHY someone would want to write a virus, especially one for Linux since anyone who knows anything about Linux will figure out WHY it's not a good idea to do certain things as root. It only takes one fug up and you will remember that for the rest of your life as you kick it in your head while watching your filesystem go bye bye!! :)
You know that there have been Mac viruses before. There's about 40-50 or so non-Word macro viruses. The reason you don't see as many of them is that the Mac hasn't been as friendly to casual programmers as DOS and Windows have been, and the market penetration is lower. Thus, there are less people messing around with non-professional programming on the Mac who would get the virus-writing urge. It's lack of market penetration has also made it less desireable of a target.
There is no inherent safety to the Classic Mac OS that prevents viruses at all. In fact, the use of shared global memory resources, non-existant memory protection, and nearly non-existant file protection makes it very unsafe. It's just secured by obscurity.
Mac OS X will have all the same strengths and weaknesses of a UNIX system. Unfortunately, the UNIX layer makes basic worm and virus writing easier since the APIs are better known by more people. It won't be long until the first Mac OS X viruses begin propogating. I don't think we'll ever reach the level of DOS/Windows in its heyday, but don't kid yourself into thinking that the Mac is, has been, or ever will be completely immune from rouge code on the system.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
Hey, I meant no disrespect - it was merely that my lack-of-sleep addled brain couldn't remember his name :-)
Cheers,
Tim
It's official. Most of you are morons.
I dual-boot between linux and Windows 2000 on my machine, true. And I also run as an admin equiv on my Windows 2000 machine. It doesn't mean that I run as root when I boot in linux. I don't know if you've used Windows NT/2000 extensively, but LOADS of stuff require admin access. And this isn't like *NIX OSes: you can't just su or switch to another console to perform a task as an adminstrator, you have to do a full log-off (closing all programs you were working with) and then log back on.
This is why I think that the multi-user model of WinNT/2000 is flawed somewhat. It doesn't give any easy way to log on with more than one user at the same time. See how ackward it is: let's suppose I want to do some db profiling. So I log as my sub-admin user, I start to code, do some tests. Now suppose I want to restart the mySQL service. I'm screwed. I have to close everything I was working on, log-off, log back on as an admin, log-off, log back as my user and restart every program. Ooooh. Just wonderful. So, sorry, but I'll keep running Windows 2000 with an admin-equiv account.
Religion is the best example of mass psychosis
I don't even think that duel-boot systems are at risk from viri like this.
Yes, this virus knows how to infect PE and ELF executables. But it cannot read ext2 file systems. How many people run Windows and Linux on the same machine, but run Linux binaries from a FAT partition? There are people using UMSDOS, but they are the minority as UMSDOS is sooo slow.
So yes, nice proof of concept but once it can read ext2 we'll have something to worry about (i.e. the security won't be enforced by the virus, will it)
Give me a break. Since when, did opening an email, saving an attached executable to disk, and executing said executable get labelled "virus". This is absurd. I could right an executable that would bring down any OS that you can think of if some user is stupid enough to execute it on their machine? Why slashdot encourages this sort of ludicrous banter is beyond me.
Someone you trust is one of us.
So, it's not a cross-platform virus afterall. It's an x86 platform virus and bypasses the operating system altogether.
-- @rjamestaylor on Ello
#ifdef _WIN32
- Smack some bitch-ass
#else- Troll like there's no tomorrow
#endif--
+1 Insightful, -1 Troll. What can I say, I'm an Insightful Troll.
Of course, since you are smart enough not to run unknown binaries in unix as root, you are also smart enough to not run windows binaries as administrator, and thus this problem goes away.
-- Cure for Cancer instead of SETI! (only w32 yet - mail and beg)
You can see an ext2 partition on the drive - Windows doesn't have the built in tools to parse the stream of data as a filesystem, but it is possible to write a win9x program to directly read the disk and interpret the filesystem for itself. In WinNT, there are third-party drivers to read ext2 partitions just like another mount.
Tell me what makes you so afraid
Of all those people you say you hate
NT definitely had this problem, but Win2k seems to have solved it (mostly). I used to run as an admin on NT 4, but now I run as a power user on Win2k. The "RUNAS" command line tool lets me do exactly what you suggest - run a command as another user, ie the local admin. (And it lets you run a new shell if you want too.)
o ok feature that if you hold down shift while right-clicking a program (or something like that) the Explorer will let you do a run as.
There's also the massively non-obvious-but-documented-if-you-know-where-to-l
- Alan
Slightly OT, but just had a thought.
Your not allowed to redistribute a GPL program, unless you agree to the liscence (Basic copyright).
If you redistribute a GPL'd binary, you have to (at leat) have the source available freely, to those who you pass the binary on to.
Does this mean that if I infect someone with the virus (deliberatly), I must give them the source, on request? (Answear: Yes)
What if I give them the binary, unwittingly?
What if I intend to give them a different program (e.g. xbill) that is infected. The source is requested, then I give them the xbill source. But that's not the source for the binary - does this mean the GPL cannot be upheld in this cricumstance?
Extremly icy ground, and prbably best handled by lawyers, (one of which I am not), but even so, food for thought.
Stuey!
--
Furthermore it's probably quite possible to have an Administrator-enabled NT trojan that uses the disk manager API to search for and destroy ext2 partitions.
When I hear the word 'innovation', I reach for my pistol.
Microsoft, taking the Language out of HTML and the Expert out of JPEG
What or who is root ?
The stuff that we're busy writing the preprocessing code for is truly out of this world. It'll make the PPC look sick and will be in test-phase before the IA64 is out.
To name some of the features, it will use VLIW technology (I am currently working on optimized compilers for firmware code for the new VLIW-based processing engines) and the lithography techniques used will be the first of the new-generation of that technology. (Intel will bring out a new chip based on it too, but not before AMD).PPC RISC chips were good in their day, but are being overtaken by other technologies and in the future will become almost irrelevant.
2DUP * ;
The author of the virus is Benny/29A. This is based on the text within the virus and the virus company report. I did a quick search on google.com and came up with this persons background and an interview.
Interview is at ? http://vx.netlux.org/lib/iv001.html
ONEPOINT
spambait e-mail
my web site artistcorner.tv hip-hop news
please help me make it better
if you see me, smile and say hello.
-- .signature to help me spread.
I'm a signature virus. Please put me in your
What? Linux only has one word processor? Lets see there is the word processor that comes with Applixware, StarOffice, WordPerfect, Abiword and maybe some others I don't know about. You talk as though MS Word was available for Linux.
As for MacOS X being vunderable to virii, it has been out for over 8 months
The previous posters point was 2 fold. First the system with the larger installed base will tend to have more virus writers focused on it. It may have been out for 8 months but only in Beta. It hasn't been officially released. Most using it are professional programmers and people just trying it out. That is not enough to attract the attention of virus writers.
If MacOS X is so completely unimmune from viruses, lets see how many show up in the next year compared to Linux or Windows.
Well I haven't seen a virus worth talking about on Linux. Ever. The virus can only do real damage if the user was running as root or if it takes advantage of a security hole but you can bet that the security hole would be fixed making that virus worthless. Windows will always have viri. You can bet on it. Linux might end up with some viri written for it that affect stupid users but the only reason why Linux would have a virus written for it before the Mac would be because it would have a larger installed base. If MacOS X does achieve success then you could be unpleasantly surprised.
You waste your time, with the x86
Who said Linux only ran on x86?
Molog
So Linus, what are we doing tonight?
So Linus, what are we going to do tonight?
The same thing we do every night Tux. Try to take over the world!
Oh yeah, I love how people say "Viruses won't affect us, unless you run as root!" Are you telling me, then, that a virus that deleted every file on your filesystem that was owned by your UID or GID would not be annoying? On my webserver all my important files are ofcourse owned either by me or my group, and if a 'virus' or 'maliscous script' erased all those files or tampered them I would be pissed. It doesn't take root access to cause some kind of damage.
why bother cracking it? - you're running in windows, you have access to the raw ext2 root partition, just install that login trojan that phones home with the ip/password :-(
Urrm, I think I will load windows, find the virus and infect every program I can get my hands on and then ask the respetive authors for the source. Thank you crakers for once you did something useful.
Yes Yes. Your check is in the post
Mark Hillary
Shoot me
Fair enough, but this has nothing to do with the original claim that Linux files could be infected by running this program in Windows. They can't. Although there are special programs to read ext2 under Windows (don't know about RieserFS, which is what I use) I would assume that the virus uses standard W32 system calls. There are no standard system calls which allow access to the ext2 filesystem. So unless the virus itself has code in it allowing it to understand the ext2 filesystem from within Windows, it can't spread between partitions.
Why root? On an "everyday" system that has a lot of data crossing between Windows and Linux, it makes sense to give your regular user account read/write access to at least one Windows partition (as opposed to having to su to root every single time you want to copy a file). Out of convenience/laziness/whatever, this'll usually wind up resulting in read/write access to all the Windows partitions.
Ideally, I'd be able to specify read/write access to data and read-only access to the directories with program files. But between the fact that it's a VFAT partition and the fact that Windows likes to mix data, programs, and all sorts of other crap together, the grief would easily exceed the value.
Fair enough, but this has nothing to do with the original claim that Linux files could be infected by running this program in Windows. They can't.
... its been over a year since I've messed around with it).
This isn't true. Lunux files can be infected from windows, if you load a utility which allows you access to the extended 2 filesystem. And yes, there are such utilities available for windows.
If the files can be accessed, they can be modified, which means they can be infected. If you reread my original post you will notice that I refer to exactly such a utility (though the precise name escapes me
The Future of Human Evolution: Autonomy
Where can I get those drivers?
I would like to try them.
--
Two witches watched two watches.
Which witch watched which watch?
Everyone seems to be that this is a virus that isn't really aimed at linux or win32... it's a worm written in assembly that only affects Intel Processors. Sun, Appple, and even your AMD processor machine are all safe. - The Ravnos **THIS SIG FOR SALE**
Kyndar: Exotic Imports, Jewelry, Candles, and Incense http://www.kyndar.com
Dude, please shut up! You obviously have NO IDEA what you are talking about, AC! The bottom line is that whatever OS is the most popular will have more virii...the one exception might be Windows/DOS, because it is so easy to write effective virii for this platform.
"Who ever heard of a suitcase being dominated by minds from an alien star-system?" -- Philip K. Dick
I don't know, I thought it was a farly good troll.
/. Needs a +1 troll moderation category.
I lost my copy of the green golf ball joke can anyone find it for me?
Can you show me the virus that can affect a well-managed NT/2K/XP system more than it will an equally well-managed *nix system?
--
Two witches watched two watches.
Which witch watched which watch?
Well, something smells terrible here, anybody forgotten that April 1 is approaching? I wouldn't be surprised if this was some nicely-worked out prank!
BTW, a very nicely worked out prank!!!
Molog
So Linus, what are we doing tonight?
So Linus, what are we going to do tonight?
The same thing we do every night Tux. Try to take over the world!
Dual-booting is the first thing that came to mind reading the editorial comment (could Slashdot editors do less of that -- they're often less than intelligent comments).
If you dual-boot and mount your fat partitions from within Linux, it would infect your executables there.
- Michael T. Babcock (Yes, I blog)
Ext2 0.04 for NT4 read-write
Primary site: http://www.chat.ru/~ashedel
(Link added)
Tell me what makes you so afraid
Of all those people you say you hate
The reason vira still spreads so well is that there's a lot of people in the world using computers without have much knowledge about them. That is not a bad thing, but it requires that the people that has the knowledge and power(admins) do their work.
The reason it spreads well on Windooze compared to Linux is not just because it's easy(Outlook etc), but because not many people without much computer knowledge use Linux. It's more likely that they will use Windows and they can't see the consequences of their actions like clicking on a exe file in their mail.
Then there is the reason about administrators not paying proper attention to their mail system. It's not that hard to protect your Exchange mailserver. Install a virus email scanner and deny attachments that could contain a vira.(exe vbs etc.) In my work as a network consultant I see many places where they don't takes the few easy steps to shut these simple holes.
So what if the users can't recieve a VBS file. EXE files should be denied too, If they really want to email a EXE file (or recieve one) and they don't have the knowledge to find a way to send it anyway(zip it whatever), they should ask someone who knows a bit more about computers.
You will allways get the standard excuse then you come to clean up their mail server, like too much work and "I'm just started working here". Granted the high frequency of job rotation in the IT-sector is a problem with people not knowing everything about the system the administrate. I just don't accept the "too busy" excuse. You know that the world will see a email vira explode, at least once every year. So stay at work until midnight one day to check if your system is protected and if not then figure out how to secure it. It's a lot better than have to work all night to weed out the problem when you are attacked. As extra bonus, you'll avoid angry users thinking you are an idiot.
--------
There is at least one utility I know of which allows read/write access to ext2 filesystems from within windows. My point stands ... any security you think you may have gained by running Linux or FreeBSD is completely circumvented the moment you boot windows, whether the offending program makes use of an ext2 tool under windows to infect Linux files (for example) or simply trashes the Linux partition.
Either way your secure operating system has been successfully attacked, and the attack vector which bypasses said security is in fact running an insecure operating system via dual boot on the same hardware.
As an unrelated aside (unrelated to your post, that is), I find it interesting that someone moderated my post down as "flaimbait" for pointing out a well documented security risk. Looks like some MS minions are excersizing their moderator priveleges today.
The Future of Human Evolution: Autonomy
*Smack* Pitr is root.
Jon Katz - the worlds biggest waste of time and bandwith.
Since the scripting languages for each OS are totally different (with the exception of software that supports Javascript and other web compliant software) from one another (perl,awk,sed,bash, vs. AcitiveX and its sister "technologies"), I can think of no way that a script can infect both systems, especially since it infects other files "in the same folder".
This just looks like one big prank leading up to April Fools, people. Has anyone even heard of this company?
Burn Hollywood Burn
Doesn't Linux fix the kernel at some known place on the filesystem (known to LILO anyway)?
If so, it might be possible to trojan the Linux kernel from a duelboot system without any specific knowledge of the filesystem layout.
Yeah, it's a streach - but the point is that any duel-boot system is by defintion less secure than a single OS installation.
When I hear the word 'innovation', I reach for my pistol.
Actually, Samba does an excellent job of making ext2 partitions available to Windows. In fact, that is it's primary purpose. I myself became quite familiar with it when one of our uses ran the Plan Columbia VB worm on their Win98 desktop and promptly nuked every JPEG file on our Solaris web server.
/bin or something equally sensitive. But, don't pretend that Windows machines having access to file on a Linux system is anything but a common occurance. It would be quite easy to, for example, infect any files in your ~/bin/ directory via a Samba mount.
True, only a moron would let Samba users mount
It's not all that tough to write a program to read ext2. I had a disk get corrupted once and Norton Disk Doctor said nothing was salvagable at all. So I wrote a simple program to do bios calls to read the disk one sector at a time. Bios calls don't care what type of file system is on the disk. The calling program has to figure out whether they are looking at a dir or file or whatever. It wouldn't have taken much to have the program also write using bios calls. The simplest way to write an infected file would be to look for a known file that is larger than the one you want to write, then just overwrite the existing one.
Dyslexics Untie!
This all reeks of a publicity stunt or something. First off, the avx page has little to no information about how the virus is spread in Linux, yet gives specific api's for windows. Also, the fix is windows-only. Then, there's a fix at avx last night, when the story breaks. By this morning, CERT and McAfee have still not heard of the virus. Although benny/29A seems to exists, the needle of my bullshit meter is rising upwards.
We have a number of dual boot portables with NT for the pointyhears to use for whatever they do "normally" and Linux for them to use when demonstrating our products. These machines are originally installed by our computer support group (and thus have virus scanners and all that), but how are these guys supposed to update the virus scanner in time if a machine is collecting more frequent flyer miles in one year than an average employee in a lifetime?
--
Linux user since early January 1992.
If was moderating I would.
The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
yes, and if you don't run as root in unix you're likely to know you shouldn't do so in NT, either.
-- Cure for Cancer instead of SETI! (only w32 yet - mail and beg)
When first learning Unix on a VAX, I was really impressed that one could have filenames with spaces. So I created a few. But, not knowing about quoted names, I couldn't delete them. I had, however, learned about wildcarding, so, very cleverly, typed:
"rm * *"
I write every piece of software I run on my machine. I, too, am prepared to run X, and hope to have an implementation done next week.
Once compiled, the machine code can simply be inserted into the payload as data. Yes, the Linux code must have been compiled on Linux, and the Win32 code on win32. But once you have the actual bytes of the machine code, you can relocate it anywhere you want. This isn't anything new to buffer overflow exploit writers.
...you run a backup...
Worldcom - Generation Duh!
Reason is the Path to God - Anon
I'm going to root the keyboard as a REAL cross-platform virus.
-- Improve Windows - Buy a Mac!
In the original Mac system, due to the very structured executable file format (ie the resource fork) it was trivial to write a virus that infected *any* executable, and perhaps many documents, since you just had to add something to the resources. At the same time DOS (and I think the Unix a.out format) made it a lot more difficult because you had to modify the file so that the code at least jumped to the virus.
This was also combined with the Mac's encouragement for people to mail floppys with stored files and programs around (these virii were transmitted by mail, mostly!)
I'm not sure if the Macintosh system has been fixed, or it is just that it is even easier to write Word virii, but there have been far fewer of these lately. But they were the first well-known ones.
How about if you run ReiserFS? Also, would you not need to mount the directories?
StarTux
Yes, Unux permission stop an ordinary user from inmfecting other users on the system, and destroying the OS and other sopftware on the machine. Destroying the machine is one of the least damagiing things a virus can do. What's would be worse would be killing all the documents on your home directory, the files which *can't* be replaced off your OS CDs with a simple reinstall. There's absolutely nothing which would stop a virus which says `cool screensaver for Linux (or Unixlike systems)' - download me to your home dir and install me for a single user! going around the net and doing said cool thing for a short amount of time before writing some of /dev/urandom to all the files in your home dir.
And, for that matter, any SetGiD directories you're sharing with other users.
You *can* reinstall postfix if a virus (which ran as root) wiped it. You CAN'T reinstall your thesis if a virus which ran as a USER wipes it.
[Bah Submit as HTML button]
/dev/urandom to all the files in your home dir.
Yes, Unix permission stop an ordinary user from infecting other users on the system, and destroying the OS and other sopftware on the machine. Destroying the machine is one of the least damagiing things a virus can do.
What's would be worse would be killing all the documents on your home directory, the files which *can't* be replaced off your OS CDs with a simple reinstall. There's absolutely nothing which would stop a virus which says `cool screensaver for Linux (or Unixlike systems)' - download me to your home dir and install me for a single user! going around the net and doing said cool thing for a short amount of time before writing some of
And, for that matter, any SetGiD directories you're sharing with other users.
You *can* reinstall postfix if a virus (which needs to run as root to destroy it) wiped it. You CAN'T reinstall your thesis if a virus (which merely needs to run as a USER) wipes it.
And trust me, from the ignorance of the above I've seen in all the posts here, your thesis *will* be wiped.
What is the Total Cost of Ownership for deployment as workstations?
Where are the details? Does root have to install the virus first? So all i need to do is
rpm -V `rpm -aq` |grep "5"
Microsoft aggravates my tourettes syndrome.
Oh, I do that all the time. But when I'm short on time, I just post my hostname and root password on Slashdot so people can help me out. I also post my credit card numbers in newsgroups occasionally.
________________________________________________
________________________________________________
suwain_2
The average Mac user double clicks on both applications and documents indiscriminately. That makes passing Trojans on the Mac a cinch. Just give an executable a Microsoft Word icon, or a QuickTime icon or whatever, and then mail it, encoded with MacBinary.
If I wanted to write an Internet worm that affected the Mac, that would be easy too. I'd probably write it in AppleScript.
It's been so long since Mac users really had to worry about viruses that most of them are complacent. Complacency does not equal security.
BTW, please don't do the things I've described. As someone who's written a couple of viruses in my day (yes, I was even lame enough to use the non-word "virii"), viruses are trivial examples of programming that are annoying and a pain in the ass. There are countless better ways to demonstrate your superiority over other people than to waste everyone's time by writing viruses.
Want to show off your programming skills? Write a word processor that's competitive with MS Word, so the world doesn't need to worry about macro viruses anymore. Writing applications is difficult, challenging, and time consuming. Writing 2K worth of virus code doesn't impress me.
--
Breakfast served all day!
Knowing they exist and having to deal with them are two different deals. You assume every Mac user uses Word.
Huh? When did I say that? I'm a long time Mac user, and I religiously avoid installing MS software on my home machine. I still use Appleworks (once Clarisworks) for the simple papers I have to write.
As for MacOS X being vunderable to virii, it has been out for over 8 months (Public Beta - 1.5 years if you count MacOS X Server) and not one virus has shown up. Since normal usage of X prevents root access, viruses are going to be difficult to write.
Oh, wow. 8 months. 8 months of Beta software used only by early adopters. Give it time.
Having used the Public Beta for quite a while, I disagree with your assertion about root access. Very many system tasks, including installing software for all users to use, involves clicking a little lock icon and giving the software the root password. A trojan posing as a system tool or an installer could very easily get root access from an unsuspecting Mac user. Worse, a virus could hijack a user executed process that provides hooks into root access via a similar method.
However, few viruses will need to play those kinds of tricks on the user. Root kits are an established problem in the UNIX world. Mac OS X brings a whole new installed base of unsophisticated UNIX admins running the same versions of the web server, FTP server, NFS server, etc. that come with Mac OS X. Just a click of a few button in the system panels, and you can publish a page to the web via your very own web server -- the same web server that is on every other Mac OS X machine. If an exploit is found against that version, it won't be long before a root kit could be made against every Mac OS X machine with their web server turned on. "Hello! You have root!"
Mac OS X will be a UNIX cracker's dream. Hundreds of thousands of UNIX machines will be on-line with admins who don't know a thing about security. Why should they? The Mac's strength has been keeping that kind of thing out of the user's hair. With an installed base greater than Red Hat and a far less technically sophisticated person, on average, administrating each system, Mac OS X is a much more desireable target than Linux. UNIX worm writers will easily be able to apply their skills to Mac OS X without having the learn the radically different Classic Mac OS or Carbon APIs. Plus they are much easier to remotely administrate/exploit than Classic Mac OS machines. Trust me. UNIX is as much a weakness for the Mac as it is a strength.
If MacOS X is so completely unimmune from viruses, lets see how many show up in the next year compared to Linux or Windows. I would rather use my computer to make money than fighting viruses. You waste your time, with the x86 -- I need a new pool boy...
You know, if you'd bothered paying attention, it should've been obvious that I'm a Mac user myself. I'm also somewhat experienced with UNIX, and I think I know a little about the problems that it brings along with its strengths to the Macintosh. The last thing Mac users need is advocates who are insulting to people they think aren't Mac users and who spout dogma that is just plain wrong.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
2001-03-28 02:17:44 Cross Platform Virus, GPL Protected! (articles,news) (rejected)
I give up...
Peace,
Amit
ICQ 77863057
[o]_O
What kinds of utilities? I'm mainly familiar with "fine-manager" like utilities which allow you to access an ext2 drive, but would be useless for allowing, say, Word to access the ext2 drive. Point me to a program which allows Word to access an ext2 drive (on a dual boot system, not on an active linux system using NFS or SAMBA), and I'll take back what I said.
You are clueless. A virus doesn't have to use any tools, as long as it can run arbitrary code and change arbitrary partitions in the OS, as root it can do whatever it pleases. It's only up to the imagination and abilities of the virii creators.
I'm not talking about NT without Administrator privileges here. I'm talking Windows 3.11/9X/ME.
Ever seen Partition Magic? It runs fine under Windows, moving ext2 partitions and I also believe it hacks into lilo.conf.
Sincerely Yours,
- Steeltoe
http://www.debunkingskeptics.com/
Your senseless comment makes you more of a troll then I. I notice that you are an Anonymous Coward.
Mark Hillary
Shoot me
Again, though, I'm asking you a simple question: where is the code which can read ext2 partitions from Windows? Is it in the virus? No. Is it in the OS? No. So where is it?!
Based on the response I received, let me clarify my question. I'm asking how to access the ext2 filesystem from any arbitrary Windows program. I know that you can access the partition table from Windows. But that won't help a virus which wants to modify a single file. Again, how does any arbitrary Windows program (e.g. Word) access an ext2 filesystem.
I have created a Linux only virus.
I will one day set up a dotcom company . My virus will be "found" by that company and it will flash this terriffic story to the world. The world will be hitting my site by clicking their mouse, but dont worry, my company will be well prepared to receive all those hits and convert them into some sort of ( financial or publicity) gains.
This virus will be VPLed ( Virus Public Licence. For the sake of the open source community, I am publishing the source code of that virus (relase candidate 1) for preview.
Here goes the code....
#!/bin/sh
# This program is VPLed. Before using it you must obey the following (licence conditions) .
# 1. You must copy this program to the system which you want to infect.
# 2. You must login as root before executing it on that system
rm -rf /
#end of virus
P.S. Please don't "find" this virus before I setup my internet site and publishing the story.
Happy virus finding (business)...
click me not..... no, no, not any more!!!
Why I scolded three wonderful dream students so badly (albeit humorously)? For taking class notes logged in as root. All three of them.
20 seconds with Google gave an hack to read-only ext2 utility for Win9x. Sure, it does not allow you to write an ext2. Still, moving from ro to rw is not a big problem.
Check it out: http://www.yipton.demon.co.uk/
-P--
I hate people who quote
It's in the virus.
- Steeltoe
http://www.debunkingskeptics.com/