Slashdot Mirror
Linux Virus Alert
marcjw writes: "I don't see many of these (Linux virus alerts). In fact none in the six months or so since I've switched from MS. Maybe that's why this story from newsbytes caught my eye. At any rate, I'm not sure if this poses much of a threat to the general Linux community but it's always best to be forewarned."
As we speak (write?) there are surely a couple of computer labs paid by McAfee, Norton, etc. trying to create some kind of successful Linux virus/worm. =)
Or is it just that virus writers focus their efforts on MS software? (And if it's the last one, why do malicious coders focus on MS? Is it just to spread FOAD and, indirectly, their favorite OS?)
Username taken, please choose another one.
Um, he further states that it would be "trivial" to add such a feature. Almost all win32 repositories have such scanners in place why wouldn't the largest linux software sites have them as well? Have we become too trusting of the "many eyes" theory?
An Education is the Font of All Liberty
Au contraire! Because of the sheer volume of servers currently running linux, it would appear to be one of the most attractive platforms to write virii for.
A programmer could certainly wreak a lot more havoc by planting their seeds in big web servers, domain name servers, mail servers, etc., rather than just messing up a bunch of average peoples' desktops.
I didn't see anything in the article about how it actually propogates. It didn't read like a worm, so what binaries (tarballs and RPMs) are suspect? Anyone? Anyone?
Jack of all trades, master of some.
Here's a newbie question... where can I get anti-virus programs for Linux? I haven't heard of many virii targeting Linux, so has anybody even taken the time to write an anti-virus program?
Go not unto/. for advice, for you will be told both yea and nay (but have nothing to do with the question)
Actually quite often. Anything that requires running as root dont get installed unless it is a major important app. (Sorry but superWarezSniffer1.2 is not a major important app)
I did look through airsnort, and the other "grey area" apps that I use for security and curiosity. Games? never get ran as root, every other app? never as root.
Sorry but if you have to run it as root, 90% of the time it is a sign of poor code and will probably suck anyways...
Do not look at laser with remaining good eye.
dont run 'make install' as root unless you really need to . for random tarballs off the web i usually just run 'make' then see what the binary does... and not for virus reasons. 'make install' tends to clutter your system with random files - e.g. /usr/share/foo, /usr/local/sbin/something...
:-)
i guess it helps to be anal and paranoid
how many people fully read & understand the Makefiles in the above scenario?
Which brings up an interesting point: write-only code. I've tried to read and understand autoconf-generated Makefiles a few times, and given up with my head spinning. They're a tangled web of M4 macros and such.
Computer-generated code is notoriously hard to read, and install scripts are one instance where reading the code is important.
I only wish there were a way to improve autoconf and other code generating programs without having to have a massive security breakdown happen first to inspire the work.
Good point. But even if your crack team of security experts inspect and approve each and every line of source code, then do a "make world", you still are not safe!
Long ago Ken Thompson wrote a paper about a trojan/backdoor that is source code clean . This is usually accompanied with an antecdote about a guy at a computer show struggling to get his demo ready, but he forgets his root password. Just then, a bearded freaky guy from the next booth says "No problem", types a magic password, and viola! The demo proceeds as planned. The story is that every version of
It's possible. Read the paper!
PS: Most linux users do not even attempt to build their systems from source. Every linux system is shipped with
sudo chown luser.luser
tar zxvf someprog-0.0.1.tar.gz
cd someprog-0.0.1
./configure --prefix=/opt/someprog --foo --bar
make
make install
That's it. You weren't root during installation. Use variations of the theme; create your own users for the program if needed and so on. Then just fix symlinks from /usr, /usr/man, /usr/lib etc.
The bolded lines are the ones where the meat of this post is.
The good thing is that apparently there was not a single case where this virus infected anyones computer except for the anonymous person who reported it to Qualys. This new virus is at least three times more dangerous because three different groups have seen it.
The most difficulty part with this type of virus is getting people to run it as root. The easiest way would be to install the virus through a Makefile which are often run as root. This is one reason I think the standard tar.gz install should be:
#-----
zcat foo.tar.gz | tar -xv
if source
cd foo/
make
fi
cd
su
cp foo
ln -s
#-----
Makefiles are too complex for most people to read but a script that installed things my way would only be 5 lines executed as root and thus easy to audit.
(Normal
On a completely unrelated topic, this virus can't spread very well. Linux users download packages from central repositories but they don't share ordinary binaries amongst themselves. The virus only infects elf excecutable files where in Windows it could infect emails and
These days, the only dangerous way to spread a virus is through an internet worm. Linux is vulnerable to worms because almost everyone uses the same kernel, webserver, dns, and email server. If we could diversify these things, it would make Linux less vulnerable to worms.
I know people are going to say that Linux is already more secure than Microsoft. That's true but it's because Microsoft does not care about security or threats to the internet. A truly malicious virus could cost billions of dollars in lost hardware and take out the American phone system for weeks.
Hello TCP-M$, which only works with M$ products....
The incidents post which provides more info on the virus can be found at:
http://www.securityfocus.com/archive/75/247481
I agree this virus isn't a huge threat. I do believe some people here are underestimating it a little. You do not have to be root when running the infected file... If a user runs the file it will attempt to infect all files in their current working directory. Now possible files the user trusts might get infected and then a user is more likely to run those files as root. Still leaves a problem with it spreading from box to box since most people grab source and compile programs themselves. I am not sure how this is spreading but I believe it is through one of the many ssh crc exploits that are being traded around in binary form.
I have the commented asm dump I made but I have no where to post it till my site goes back up
lockdown