Slashdot Mirror
Linux Virus Alert
marcjw writes: "I don't see many of these (Linux virus alerts). In fact none in the six months or so since I've switched from MS. Maybe that's why this story from newsbytes caught my eye. At any rate, I'm not sure if this poses much of a threat to the general Linux community but it's always best to be forewarned."
Any smart Linux user doesn't usually run their computer with root permissions. Until Windows XP, all consumer versions of Windows (9X, Me) ran all users at an eqivalent to root level, enabling viruses to wreak havok at any time. Macs were the same way before OS X, but virus writers still targeted Windows because of the large installed base.
Part of it's because of the relative lack of security on a Windows box; only NT and XP had/have an administrator level where regular users aren't allowed to do things.
95/98 let anyone run just about anything as default. And XP actually does this too... Default accounts are set up as administrator without passwords.
And while you can run everything from an administrator account (got root?) under Linux, the type of person who installs Linux generally knows better than to do so.
It's because of the limited access that most accounts have that makes viruses difficult to write under Linux.
As to why malicious coders concentrate on MS, it's because it's easy. The coders at MS keep making the same mistakes over and over again. Look at the UPNP exploits.
I like you, Stuart. You're not like everyone else, here, at Slashdot.
hmmm.. social engineering anyone?
./runme
./runme
localhost:~$ tar zxf some-random-binary-0.0.1.tar.gz
localhost:~$ cd some-random-binary-0.0.1
localhost:some-random-binary-0.0.1$
This program must be run as root.
localhost:some-random-binary-0.0.1$ su
Password:
localhost:some-random-binary-0.0.1#
Sucka!
Another point.. when was the last time you actually checked the code of something you've compiled? lets say instead of some-random-binary, it's some-random-young-sourceforge-app. Jeez, get off your fucking high horse.
Well, the primary reason would be the lack of any viruses to scan for.
It is only "crazy" to not scan for viruses from the mindset that viruses are out there. It isn't crazy to take a road trip in a car that doesn't have a spare innertube if the car uses tubeless tires.
It is also important to note that this article is not about a virus. It is about a trojan. There isn't really any way to do an automated check for unknown trojans on any platform, since the scanner can't know what the program is supposed to do in to first place to figure out if it is doing something else as well.
The question with Linux binaries is are they what they claim to be. That question is generally answered with an MD5 sum from a trusted source. This renders the case of unknown trojans moot.
-Peter
and so on. Symantec/Norton also has a Linux/UNIX binary which is certainly bundled with the network-wide thing, I don't know if it's available separately. The trouble with all of these things is that although they are Linux applications, they detect Windows virii - they use the same signature files as the versions on other platforms do. This means they're very good for running on file/e-mail servers to protect the poor Windows machines behind them (which is what they're intended for) but they probably won't stop the subject of this post, for example. Basically, yes, they exist and work well but make sure you know what you're hoping for them to do...
RPMs or other packages that are downloaded from more or less untrusted locations without encryption signatures might very well run a few evil scripts during the installation process (which, of course, is done as root).
To be really sure, one should always install new programs in a chrooted jail; the software should be installed in a totally new branch of the filesystem tree and the installation process should not be able to read of write to other parts the filesystem.
A lot of smart alecs here are making light of this, but let's face it, the smart thing is to give time to any virus at all. Tell me you've never, ever, left yourself in as root by mistake. OK, now tell me no-one else has. 'Nuff said.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
OK, I'm really sick and tired of those people who say "Oh, I run binaries as root, so you do too."
/usr/local?
/usr/local is writable by my staff. My staff consists of... me. So, I have root, my desktop login and staff. Just install stuff on /usr/local, as staff. Voila. Staff can't touch my $HOME or any of the system binaries. So any malicious script (at install time aka make install) is pretty much contained in... /usr/local.
/usr/local/bin as my desktop login. I loose my stuff. You can argue that this is just as bad, but my system is still not compromised.
Have you every thought of
./configure --prefix=/usr/local?
My
Let's say I run a infected binary in
This isn't rocket science, guys.
He was probably mailed a copy, same as I was. (That is, someone said "here's a virus I found", not that they were trying to hide it.)
I've got no way to tell that the person who sent me my copy isn't the author, but I've also got no reason to suspect he is.
In any case, this is why I can't speak to whether the virus is "in the wild". But, it exists, and it works, so I passed the info along.
Use checkinstall. Run it instead of make install and it'll create a rpm | tgz | deb package to install (and uninstall, if need be) with your packaging system.
It's hard to be religious when certain people are never incinerated by bolts of lightning.
# Save this as Makefile and try "make -n install" /sbin/shutdown now)
# with GNU Make.
#
# This runs even with -n, and doesn't print first.
foo:=$(shell
#
# This too runs with -n, but is displayed.
# (I use a semicolon in case slashdot loses tabs.)
install:; +echo this runs too
Is that so? I believe you are mistaken - SDL is only a wrapper library which calls out to existing methods of doing graphics (among other things).
One such method is Xlib, and I don't want to run an X server. Another is the Linux kernel framebuffer, and I'm not so interested in taking the performance hit of running in frame buffer mode (why do you think I use a text console in the first place - mostly for speed). A third is aalib, and I don't want to run Doom in ASCII art (slashdot reports about Quake notwithstanding). Which leaves me running SDL applications in ... svgalib mode. Which requries root.
"Xlib is really old.. Gtk+ is the way now."
The two statements are equivalent.
"How can you claim that you are anti-crack, while still writing a window manager?" — Metacity README