Slashdot Mirror
A Secure OS For the Dalai Lama?
Jamyang (Greg Walton) writes "I am editor of the Infowar Monitor and co-author of the recent report, Tracking Ghostnet. I have been asked by the Office of His Holiness, the Dalai Lama (OHHDL) and the Tibetan Government in Exile (TGIE) to offer some policy recommendations in light of the ongoing targeted malware attacks directed at the Tibetan community worldwide. Some of the recommendations are relatively straightforward. For example, I will suggest that OHHDL convene an international Board of Advisers, bringing together some of the brightest minds in computer and international security to advise the Tibetans, and that the new Tibetan university stands up a Certified Ethical Hacking course. However, one of the more controversial moves being actively debated by Tibetans on the Dharamsala IT Group [DITG] list, is a mass migration of the exile community (including the government) to Linux, particularly since all of the samples of targeted malware collected exploit vulnerabilities in Windows. I would be very interested to hear Slashdot readers opinions on this debate here." (More below.)
Jamyang continues: "Allow me to play devil's advocate for a moment here: in the short term, moving to a platform that is perhaps less familiar to the attacker provides considerable relief, but it is essentially less difficult to write exploits for Mac OS/Linux than it is for Windows, given the many anti-exploitation mechanisms Microsoft has embedded in the last years, so in the long run, if the attackers want your data, the entire move is moot. People should choose a platform based on their productivity requirements instead of purely security. Furthermore, most of the web servers broken into during these attacks (to be used as command and control servers) were not Windows, but Linux. What do you think?
(While I have the floor I'd also like to take this opportunity to plug two initiatives where Slashdot readers can directly help the Tibetan tech community, either through sharing your expertise or your cash! Firstly, one of the obstacles to migrating to Linux for a Tibetan speaker is the lack of decent Tibetan font — can you help? Secondly, Avaaz is raising funds for projects that will help End The Blackout in Tibet, including a proposal to support the deployment of Psiphon's circumvention network. Thanks, or in Tibetan, thuk.je.che!"
(While I have the floor I'd also like to take this opportunity to plug two initiatives where Slashdot readers can directly help the Tibetan tech community, either through sharing your expertise or your cash! Firstly, one of the obstacles to migrating to Linux for a Tibetan speaker is the lack of decent Tibetan font — can you help? Secondly, Avaaz is raising funds for projects that will help End The Blackout in Tibet, including a proposal to support the deployment of Psiphon's circumvention network. Thanks, or in Tibetan, thuk.je.che!"
Looks like MS shills/apologists/marketers have mod points to burn. 3 ... 2 ... 1 ... mod me down, Windows-lovers.
If you want your life to be different, live it differently.
And open source has not been proven incompetent ? It's worse : open source contributors have been proven malevolent. Not that that's so problematic, after all, Microsoft has had at least 2 employees that got caught doing the same. Several malicious code submissions were approved and "downstreamed" into distributions before being discovered (versus microsoft caught both attempts).
In several instances the individuals involved not only were not prosecuted (obviously microsoft did prosecute them), but weren't even kicked from the project they backdoored, and none were kicked from other projects.
Do you seriously think they only introduced one problematic piece of code ?
http://www.freedom-to-tinker.com/blog/felten/linux-backdoor-attempt-thwarted
What we don't know is how often this sort of thing happens in proprietary software development. There must be some attempts to insert malicious code, given the amount of money at stake and the sheer number of people who have the opportunity to try inserting a backdoor. But we don't know how many people try, or how quickly they are caught.
[Technogeek readers: The offending code is below. Can you spot the problem?
if ((options == (__WCLONE|__WALL)) && (current->uid = 0))
retval = -EINVAL;
]
The problem is we don't know IF they are caught, and common sense would tell anyone that they're simply ... not caught at all.
The problem with this news (and all security related news) is that it's merely news of incompetents failing. News of successful incursions will, for obvious reasons, not be released until untold damage is done (and that's if you're lucky and the incursion was by some government that's concerned with historical record. Russian criminals don't, neither does, it seems, anyone outside what is generally called "the west". Otherwise, a denial is the very best you could hope for).