Slashdot Mirror
Viruses and Market Dominance - Myth or Fact?
rocketjam writes "An article at The Register, authored by Scott Granneman of SecurityFocus, examines the conventional wisdom that if Linux or Mac OS X were as popular as Windows, there would be just as many viruses written for those platforms. Mr. Granneman bluntly says this is wrong, then proceeds to detail the fundamental differences between those OS's and Windows which make Windows an easy and inviting target for virus-writers, as opposed to the Unix-based platforms."
He says "There are about 60,000 viruses known for Windows, 40 or so for the Macintosh, about 5 for commercial Unix versions, and perhaps 40 for Linux."
What about root kits? I would consider that a virus, not technically speaking, but it's still along the same lines.
there would be just as many viruses written for those platforms Probably, there would be as many viruses written, or more, but the effect of the viruses would have been different. As to whether the effects would have been not as bad, equal or worse is difficult to answer.
New year Resolution: Don't change sig this year
is that the relative difficulty a newbie has doing things in Linux makes it more secure.
And the network effect he mentions is really just a more sophisticated version of the "everybody uses Windows" argument he disparages.
I'm not qualified to comment on his technical arguments...
The author seems to have a single point--Unix machines have security built in at a ground level (primarily because the root user really is the only one with power to mess things up) and a bunch of fluff material to fill out the article. I figured this guy would look at the systems from a usability standpoint and realize that sometimes you need an OS that has to allow you to install things even if you are clueless, because you don't have a full time system admin. Maybe if he spent more time researching what people actually use computers for instead of using his security buzzword hammer (Social Engineering!) he might have actually put together an insightful article instead of a bunch of not well thought out drivel.
Seems the author misses the very obvious point that many of the weaknesses in Windows are there for user-friendliness. Making it easier for users to open attachments & see HTML mail is practically a requirement for the great mass of users. Yes, they're clueless, and yes, it would be nice if they could get over their fear of slightly more complex interfaces. But it ain't gonna happen.
... Linux in its current form will never be as popular precisely BECAUSE of those same limitations. It's practically a tautology that any popular operating system, in order to become popular, must make compromises that make worms inevitable.
Yes, if Linux _in its current form_ was as common as Windows, it would be be much more secure. But we might as well wish for green eggs & ham
Symantec's new 2004 package with required product activation is highly entertaining, as it now suggests that I buy four! copies for my personal PCs alone.
Give them a call and tell how you feel.
1-408-253-9600. Hit 3, and then ask to speak to a senior supervisor.
If Linux becomes more popular, media recognition and increasingly "dumbed down" distros will make it a good platform virus writers.
No.
The very fact that Unix-like OSs have a concept of a "root" account (which the Windows "equivalent", "administrator", does not even come CLOSE to matching in terms of actual separation of permissions), makes it all but invincible to virii.
Yes, if Linux becomes popular enough for virus authors to target it, we'll see a round of trojans using root exploits - But unlike Windows exploits, very few of these exist to start with, and they will (and do) get fixed within a few hours of discovery.
Actually, for that reason, I think more Linux virii would help Linux security overall, as it would expose those root exploits faster than we can discover them normally. Yeah, a few boxes would suffer, but the community as a whole would benefit.
In MS clients "Exchange Client" and later "Outlook" somebody who receives text in written with Word (yes they did it before) or HTML simply can't even choose "view always as plain text".
MS added it this feature to Outlook 2002, but you get it together with the famous "activation" which is there not "to protect piracy", but to make you pay for a new Office each time you change machine (since activation IS bound to the hardware)! Talk about MS tax.
My thoughts exactly. While I was reading his arguments, I was thinking "Y'know, half of these reasons are *why* more people don't use Linux...".
Ditto.
His argument boiled down to; linux is more secure because it is harder to deal with. By harder, I mean more steps (save, chmod, etc).
There are plenty of linux servers out there right now that have been 0wn3d by nefarious types, to do their bidding. spamhaus.inc doesn't just 0wn windows servers to do their bidding. But that is not a convenient argument, so I guess we shouldn't go there.
The premises of his entire argument are not very sound. He talks about how Linux is safer because it is difficult to run an attachment without knowing how to save it / set execute permissions, and how you can 'only screw up your /home directory' since you don't run as root.
_Really_ think about this one. In order for Linux to become as popular and intuitive [shiver] as Windows, things like "setting execute permissions" need to be automatic. Installing apps should be relatively simple as well. Look at Lindows! You run as root. Tie that in with a couple of "intuitive" features in a mail client, and you have a handful of rootkit'ed machines.
Plus, what if everyone magically rolled to Redhat 7.3 when it came out, ditching Windows all together? Since then, we've had two SSH vulnerabilities. Sure, those using Linux applied the necessary patches / updates and we're all safe again... probably within minutes.
But "Regular User Guy" won't apply that patch. Multiply that by a million users. Now you have millions of machines out there running a rootable linux box.
OSes will have vulnerabilities. They need to be patched. It ALWAYS comes down to the user. Will Linux be 'safer' than Windows (i.e. less vulnerabilities / worms)? Possibly. But it certainly has nothing to do with its difficulty to become root or inconveniences of a mail application.
DrPascal: Not the language, the mathematician.
Ah, the strawman. You're arguing against something he didn't say.
The platform isn't the issue. RMS said that Free Software developers seem to do a better job. This may be because of peer review, or even the threat of peer review etc.
Ciaran O'Riordan
Expert in software patents or patent law? Contribute to the ESP wiki!
The part I find ironic about this article (most of which I agree with) is that some of the world first viruses were written for, and designed to run on, UNIX.
At least the early work by Dr. Fred Cohen was certainly done on a variety of boxes, and UNIX figured prominently.
The shell viruses were particularly interesting to me.
His book A Short Course in Computer Viruses, ASP Press (1991) is a fantastic read, even for it's age.
-- clvrmnky
Is becouse I havent written them yet.
J/K
It is an interesting point that the author inadvertently brings up: As Linux becomes more talerable to the masses, security is likely to suffer. Or, as security suffers, Linux will become more tolerable to the masses.
Most users will point to the new shiny things on their desktop and go 'Looky at what I can do!!'. Security takes a far second even if they are aware of the problem.
Making things hard to do is not the answer. Making things easy to accomplish while maintaining some semblance of security would seem the desirable path. I understand this can be a difficult proposition but trying to leverage the users ignorance to form some sort of security model is just plain counterproductive.
I think this article points out a shortcoming in the Ease Of Use dept. The rest wouldnt appear all that insightfull.
I think you underestimate just how much I just dont care.
No viruses have been written that work under Mac OS X yet. See: http://www.macobserver.com/editorial/2003/08/29.1. shtml
"Reality is just a convenient measure of complexity" -Alvy Ray Smith
i wonder what the commercial applications/implications of this are? any takers?
I suspect that the commercial implications are minimal at least for a year or three. For a start, a lot of IT decision makers, i.e. accountants and people who have been promoted from middle management with little technical ability will still swallow MS's bullshit. They will also buy Server 2003, optimistically believing that it will be cure all the problems of Server 2000 in the same way they believed 2000 would cure the problems of NT.
For an example cop this survey. It apparently shows that Europe's IT directors place consistency higher than security and reliability and the human tendency to submit to fear and one's own insecurity rather than to break ranks and try something new will lead a lot of people who have no real faith in their own abilites to stick with what they know, i.e. Windows, regardless of how shit it may be, how many viruses it catches, how many customer's credit card numbers get stolen etc.. They crave stability even if what they have is flawed, at least they know where the buttons are.
In all honesty, I don't see single OS networks as being a good idea regardless of what your using. There are millions of lines of code in a modern OS and it only takes one cock-up to open a crack through which it can be broken. A lesson in genetics suggests that diversity gives you the best hope of survival when under attack or it can at least slow the attacker as they, or their virus, try to find vulnerabilties in each system.The only way that will be achieved is by opening file formats so that all platforms can exchange data with 100% transparency. This will also create a truly free market causing companies to develop software based on quality, performance, security and reliabilty rather than how pretty the GUI is and how clever this years bunch of graduate marketing twats are. The obvious side effect is the breaking of MS's monopoly and the burgeoning of a new software market that will develop ports and alternatives to existing "industry standard" stuff like AutoCad. Proprietry software companies fear this the most as they will then have to wrestle with real competition.
I still think that Linux, BSD and Mac are inherently more secure and better coded than Windows though. I also suspect the rot is so deeply set into MS stuff (with a 20 year legacy of putty eye candy before security) that they will never sort it out without a ground up rewrite, somthing they will not do unless forced to.
Linux developers on the other hand have given a security a starring role since day one and even though there are bound to be flaws they're fixed in short time by developers who don't spend the first week denying a problem exists. It's free, it does what I need and it's users give a shit. What more can I ask for.
Hmmmmmm..... Deep fried and look like Squirrel.
The reason it asks for a password is that an OS X 'administrator' is not root. It's staff. There is no root account by default. You have to enable that purposely. The point is that if you double click something that looks like a picture file and it asks you for your admin password, you KNOW something is up. On Windows, double click and you're dead. If it doesn't ask and you're running as an Admin, it might wipe out /Applications and ~/, but it can't touch /System or any other user's files. If you run as a regular user, then only ~/ can be hosed.
Outlook Express is easily uninstalled in 2k. It's part of our regular install routine. Add-Remove Programs and pick the left most bottom icon. Simple as pie. Thanks DOJ!
You missed the point. While wiping /home would be 'unfortunate' for you, it reduces the virus' spread.
Since this article is about the spread of virii on popular systems, let's concider for the moment how most people use computers. Most people have one computer to themselves. They will set up an account for themselves, and probably their entire family uses that one account. They store a year's worth of data on it, and then a virus comes along. Now, you are saying, well, it's only limited to the one account. For most people, this is everything. The OS can be reinstalled. Everything is reproducable, *except* for the data in the user's home directory. And this is precisely the stuff the virii will delete.
Now, concider the action of spreading. What about being an unpriveleged user stops the spreading of the virii? Blocking of ports below 1024? Doesn't affect sending an email to everyone on the address book.
The guy also talks about how the lack of a dominant monoculture means virii will never spread under linux (despite the argument being that when Linux is dominant, virii still won't spread). Intel vs AMD vs alpha vs MIPS, whether the user uses mozilla or kmail. Well, condider that when Linux is popular, most people will settle on the program that gets set up by default on the default desktop, using the most popular distribution. We don't see a monoculture *today*, because most Linux users use what they prefer, not what comes by default. Oh, and of course, on an Intel box.
I'm not so sure. Lots of errors are introduced simply because programmers write too much new code. Programmering as it is done today is not a branch of engineering, its a craft. One way to industrialize programming would be to go the same way as say civil engineering.
A civil engineer doesn't design new building elements each time she designs a new structure. Buildings and bridges are constructed from standardized elements with known characteristics and which can be manufactured efficiantly and with high quality.
Doing the same in programming would perhaps be along the lines of using higher level languages for application development, using real, standardized component frameworks with immutable components and perhaps use a bit of computer science and make (mathematically) sure that what we do will work.
All this will limit the flexibility that e.g. coding everything from scratch in C will give, but it could also help reducing the number of defects in common software. Bottom line is: if we want to be an industry, we better start behaving like one!
We run both Windows 2000 and Linux here, but Linux is restricted to development of linux based embedded systems. The view of one IT porffessional I have spoken to is that linux is a vast security hole, his main reasoning being that as the source code of Windows is not publically available, and all the source for linux is easily found, Windows must be intrinsically secure!