Malware Found Hidden In Screensaver On Gnome-Look

AndGodSed writes "OMG! UBUNTU! Reports the following: 'Malware has been found hidden inside an innocuous 'waterfall' screensaver .deb file made available on popular artwork sharing site Gnome-Look.org. The .deb file installs a script with elevated privileges designed to perform a DDoS attack as well as keep itself updated via downloads. The dodgy screensaver in question has since been removed from gnome-look, and this incident was a very basic, if potentially successful, attempt.'" A similar report at Digitizor.com says that similar malware was also found in a theme called Ninja Black. For those affected, both sites also provide instruction on cleansing your system.

Comments

Not more safe

[sopssa]

It's been told to all the linux zealots so many times that Linux itself isn't really more secure against malware than Windows. It's only so because it's marketshare is like 0.5%, if even that, and it makes much more sense to make malware where the (non-geeky) users are.

This just shows that if ever linux did gain marketshare with casual people enough, the malware problem will be there too. Repositories won't help with that, because people want 3rd party programs and games.

The funny thing about this is the same that as with Mac OS X users. All of the zealots yelling that Linux/Mac OSX are secure about malware, which results in normal people thinking they can run whatever downloaded "because my OS is secure!".

And before everyone jumps on the "but you can't get infected by just browsing on porn sites on linux!", why not? What was the last time you got infected by Windows vulnerability? Those attacks are usually against 3rd party programs like PDF or Flash. And guess what, those apps are on Linux too and are just as well exploitable.

The only reason malware problems are smaller on Linux than Windows is because of the almost-non-existing desktop marketshare and that those who use it on desktop are usually more tech savvy.

This just shows that if Linux had 95% marketshare on desktop, and Windows 0.5%, it would be the same thing but just turned around.

Re:Not more safe

[nschubach]

The idea behind it is so that someone will put out a patch for said vulnerability without having to wait for parent company to do so...

It's not more secure because of it's market share, it's more secure because anyone can fix it.

Re:Not more safe

[nhytefall]

Agreed.

The easiest, and most effective, way to avoid issues with malware/spyware/etc is to not be an idiot.

Code is code... regardless of the platform it was developed on/for... code still runs if written correctly.

Re:Not more safe

[phantomcircuit]

This just shows that if ever linux did gain marketshare with casual people enough, the malware problem will be there too. Repositories won't help with that, because people want 3rd party programs and games.

Well that's why the goal is to get as much of the third party software into the repository as possible.

Re:Not more safe

[Anonymous Coward]

All it shows is that Linux is vulnerable to trojan horses. ALL operating systems are vulnerable to trojan horses. When you show me a Linux or OS X computer that's vulnerable to something like the slammer worm, get back to me.

Re:Not more safe

[Suiggy]

I agree. The best software in the world can't protect itself from clueless ignorant users who don't know any better. The more clueless, ignorant users using the software, the higher the rate of occurrence of exploitation. If Linux were to become as popular as Windows, I guarantee it would have just as many problems as Windows users currently suffer from.

Re:Not more safe

[sopssa]

But that still requires distros to inspect and validate the patches before they go live to repositories. The big part isn't really fixing the code, it's to test that it surely works and doesn't cause problems for users.

And even so, if the vulnerability is in lets say flash, just anyone or distros can't fix that closed source application.

Re:Not more safe

[Anonymous Coward]

The diference is that on windows, malware can install it self just by looking at it.
To get this linux malware you need to sudo and install a package.

If i tell you to type "sudo rm -rf /" and enter your password when asked, will we see
article like "OMG! UBUNTU GOT MALWARE" the next day too?

The point is, if you do no whant malware, do no install it.

Re:Not more safe

[_merlin]

It looks like it's following the same pattern as Windows malware, too: make a cool screensaver, post it to sharing sites, hope people tell their friends about it. That was a common malware vector for Windows in the early part of this decade. Next there'll be dodgy "codecs" on pr0n sites, and once people start using malware scanners for Linux, they'll make dodgy fake antivirus software to con gullible users. Netbooks may be great for attracting attention to Linux, but we have to remember that this will include the kind of attention that no-one wants.

Re:Not more safe

[sbeckstead]

Wrong, anyone can not fix it. Any one MAY fix it.

Only the tech savvy programmer types that care enough to fix can fix it.

Re:Not more safe

[JoshuaZ]

Not really. Linux does a better job in many ways of dealing with serious security holes. While you are correct that if marketshare was reversed there would be a corresponding flip in total malware, I suspect that the amount of malware targeting Linux in our alternate universe would be less than the amount of malware targeting Windows in the real universe. Likely the same order of magnitude, but still different. (I'm ignoring for now the issue of how one would reasonably measure or even define how much malware is out there targeting a given system).

The real lesson here is that at the end of the day it still comes down to who the users are. Users who are paranoid are less likely to get problems. Most people don't have the resources or will to be paranoid.

Re:Not more safe

[Anonymous Coward]

You kind of have a point, but the fact is, you need root privileges to install a .deb, and I have quite successfully installed gtk/gtk2 themes/icons/etc without admin privileges. If I downloaded a .deb from a random site and then installed it, it would be just like running a .exe on windows, but for most things I need to do on linux, I don't actually have to take that risk, while on Windows it seems everything is a .exe. Not sure about screensavers, but it seems this was, like 90% of viruses for any platform, a hack relying on stupid users elevating the virus to root authority themselves.

Repositories are getting a lot better too, I don't use ubuntu any more but when I left the PPA was in ascendancy, which seemed to allow a much better enforcement of security while still letting 3rd party stuff in.

Re:Not more safe

[_merlin]

Malware doesn't need to exploit vulnerabilities in the software: it only needs vulnerable users. There is no way to patch that.

Re:Not more safe

[danomac]

There would definitely be more, but I seriously doubt as much as Windows. Most of the drive-by exploits require root privileges to do anything serious to the machine. Almost everything is used without root privileges and so those types of attacks plain don't work. (I'm referring to Windows computers being infected just by being plugged into the internet.) I can't remember the last time I heard of something like this happening with linux.

Voluntarily installed malware by using social tactics and the like will still affect linux, but the amount of damage it can do to the local machine is still far less than the damage that can happen to Windows.

Re:Not more safe

[sopssa]

Any (good) linux sysadmin knows that there has been many Linux worms in the history. Yes, history. You're also referencing to a 2003 Windows worm here.

Conficker aside, such worms are pretty much in history. Most malware now a days comes via trojans, and any OS can't protect against that unless it's totally locked down (like iPhone)

Re:Not more safe

[Suiggy]

Yes, but clueless users aren't going to be knowledgeable enough to download and install the patch. Hell, they probably won't even notice they're infected until months later.

Re:Not more safe

[amasiancrasian]

I've been telling many the same thing, but with one exception; Mac and *nix have started out with a better permissions system and therefore users who have downloaded an app from the Internet have been trained to be doubly sure about whatever it is that requires sudo power (e.g, the Mac sudo GUI prompt). Microsoft UAC, on the other hand, has had to deal with transitioning software developers to not write in "Program Files" and other public areas and to save data to personal home folders.

While I'll agree with you that Mac/*nix are not any more secure than Windows, the Mac/*nix users have been taught to take a sudo prompt seriously, while in the early stages and growing pains of UAC, Windows users were easily annoyed by UAC prompts and therefore took the UAC prompts less seriously, because UAC prompted were being triggered by transitioning software developers that did not save data in the user's home folder.

In the end, the security of any system relies on the ability for the user to authenticate and verify software downloaded. But making it more difficult, such as requiring an administrator password to be entered for elevated privileges, makes users more cautious of software requiring a sudo prompt. And while that's not inherently any more secure, at least users think twice before entering their password.

Re:Not more safe

[nschubach]

The Flash player isn't open source. The Compiler is, the player is not. As I said, the idea behind open source being more secure is that you could have potentially thousands of different solutions to prevent this thing in the future. The best one is chosen and patched into the main tree. If you have the source, you can do this in a few minutes (or put in your own temporary patch) with the proper skill and be back up and more secure than someone waiting for "Patch Tuesday." Even if a patch comes in that resolves that problem, it could have been the first solution to said problem and might have problems itself that will need to be fixed later.

It's really the potential quantity of solutions to the problem.

I could argue with you that this vulnerability might have been fixed sooner with more market share.

Re:Not more safe

[amasiancrasian]

I would like to clarify that when I mean "not any more secure," I mean the current version of Windows 7 that implements a good permissions framework along with UAC. Mac OS X/*nix have a leg up with a strong permissions-based system from the very get-go.

Re:Not more safe

[kai_hiwatari]

This particular malware is not because of a security problem with the OS. It is more of a social engineering thing - trying to trick unsuspecting users to install a malicious script by hiding it as a theme or screensaver.

Re:Not more safe

[sopssa]

But the thing is, most malware doesn't even need root access to do it's job. Stealing users data and sending spam works just as well from user base.

Requiring root access is mostly for those who want control over that exact machine, like hackers.

Re:Not more safe

[nschubach]

One major difference is that malware on Windows can screw up the entire system where Linux will most likely only screw up one profile.

Re:Not more safe

[sopssa]

But this is not really about vulnerabilities. This is a screensaver that user downloads from a website. Open source or not, you can't fix that unless the whole system is totally locked down like iPhone. And that doesn't really sound good.

Re:Not more safe

[Anonymous Coward]

You're a sodding fscktard. Distros do not pick up public binaries and bundle them unless they're from $BIG_COMPANY like Nvidia. All distros use the projects' source and have dedicated maintainers for each package. You have no idea what you are talking about.

So going by your 11 year old logic, the Internal cannot function. After all, it's 90+% held together with unix and linux systems, mostly open source applications too. So why oh why are they not an anarchy of spam and DoS bots, and 99+% of the crap coming from the tiny windows servers that do little more than handle parked pages for the old backhander form MS sales execs?

When you reach puberty, have real contact with the opposite sex (assuming you're not a gay apple fangay), you'll understand elementary system architecture.

Re:Not more safe

[nschubach]

But there is a way to minimize the impact, correct? Take this vulnerability for example. It might have had an effect on just the one user, but it wasn't going to be able to infect the system folder...

Windows is getting better with this, but a Windows user still has more potential system destructive powers than an equivalent Linux user.

Re:Not more safe

[eln]

So how often do you download a package from somewhere, unpack it, and go line by line through the source to make sure it's safe before installing it on your box? Probably not very often, because that would be a huge pain and even most Linux users won't be able to understand the code well enough to make a good judgment. On a server box, you'll likely stick to production repositories direct from your vendor, so the risk of malware is low, but I'm sure most people have downloaded packages from third parties for their desktop systems and run them without being absolutely sure they were safe. With Linux, you can get away with this because none of the malware writers care enough about Linux to port their software to it, but they certainly would if it gained significant market share.

Re:Not more safe

[davek]

This just shows that if Linux had 95% marketshare on desktop, and Windows 0.5%, it would be the same thing but just turned around.

Absolutely FALSE! The numbers would be closer, but not equal. By definition, you cannot know all the vulnerabilities in "secret source" software, because they are simply not disclosed. This number is surely more than zero. Therefore, all other things being equal. open source will always prevail because the "secret" vulnerabilities will be fixed on OSS, while they still exist in secret source software.

Re:Not more safe

[ChienAndalu]

The difference is that there isn't a common software repository for windows like there is for Linux. If you want a screensaver for Linux, you can get tons with xscreensaver. For windows, the software ecosystem is much more confusing.

Google's netbook won't even have the capability to install software.

Re:Not more safe

[jedidiah]

> And before everyone jumps on the "but you can't get infected by just browsing on porn sites on linux!", why not?

Linux doesn't go out of it's way to do stupid things for a dubious gain in "convenience".

Linux never bought into this idea of blurring the line between data and programs. Linux never encouraged executing random executables from unknown and untrusted sources.

Neither did MacOS, or FreeBSD, or any of the commercial Unixen.

In that regard, merely avoiding Microsoft apps while running their OS can avoid most of the potential trouble.

Re:Not more safe

[nschubach]

Yeah, but now that the malware was created, it shouldn't be long before for someone prevents another screensaver from doing this again... that's what I was getting at.

Even if it isn't patched immediately, a Linux screensaver has lower potential of screwing up the entire system folder with it's payload.

Re:Not more safe

[royallthefourth]

But there is a way to minimize the impact, correct? Take this vulnerability for example. It might have had an effect on just the one user, but it wasn't going to be able to infect the system folder...

Not true. It affects the system as a whole because packages need root privileges to install.

Re:Not more safe

[maxume]

You should talk about secure defaults, the only real change in Vista and Windows 7 was that accounts are not generally created as Administrators (I guess UAC adds a little more than just the UI, but not a great deal), both NT and XP share much of the underlying permissions framework...

Re:Not more safe

[sopssa]

But so what if it only gets access to one user? Malware doesn't really need root access. Stealing user data and sending spam is just as possible from user base. In history malware tried to just fuck over the computer which would had required root access, but now its just about sending spam or stealing data.

Re:Not more safe

[Kjella]

Linux can't cure idiocy. But the repositories are a pretty solid base of tools before they start wanting to shoot themselves in the foot. How many people are infected by the time they're done warezing up their computer with "basic" tools like Windows itself, MS Office etc? Quite many. How many people block or are blocked from patches because they're not a "genuine" install? It would help.

P.S. PDF is quite safe, Adobe PDF Reader on the other hand is not but luckily us Linux users in general don't use it. Same goes for flash, hopefully HTML5 will make it much less common because it's the flash player that is crappy, the standard is quite fine.

Re:Not more safe

[NoobixCube]

Mod parent up. I know he's AC, but the point he makes is still good: There is no amount of security that can protect your machine from a clueless user.

When you install a theme the normal way, you just drag the archive file - that is to say, no executeable parts, or any way to make the parts executeable - into the theme manager, and presto, it's installed and it asks if you want to apply it. This doesn't require root privilages because it installs to the user's personal themes folder within their home folder. When they do this, there's no way to sneak in a cron job (that's a scheduled task) or any other nasty automatically executing files. Installing from a .deb is usually unneccessary, and as this story proves, exposes your install to risk if you don't pay attention to what you're installing. In my opinion, Ubuntu, being the most newbie-visible Linux distro at the moment, has a responsibility to educate users on things like this. A PDF in their home folder, or a slide show that takes like ten minutes to go through, telling new users how Linux is different to Windows would work wonders, and take up virtually no space on the install disc. There's no excuse for there not being one.

Re:Not more safe

[gandhi_2]

Which is a great argument against monoculture, something the "linux zealots" have been warning us about for years.

Re:Not more safe

[Suiggy]

It doesn't help when you have a clueless ignorant user involved. Teach such a person how to use sudo and inevitably they're going to elevate privileges requested by malware. I mean, by golly, if they want to install that screen saver with cute kittens, then they're going to install it, sudo be damned. Most people aren't as paranoid as you or I may be when it comes to trusting the content and software we download, and they may not be able to draw the association with it possibly having a trojan/virus payload. Afterall, all they see are the cute kittens.

Re:Not more safe

[at_slashdot]

You have a poor understanding of what "malware" is or what Linux/Mac zealots claim.

Malware is piece of code, all OSes run code, therefore all OSes are vulnerable to malware. What Mac and Linux "zealots" claim is that it's not likely to get malware in Linux/Mac just by browsing a site, opening an e-mail, or just by keeping the computer on and connected to the network -- that hasn't changed.

"Repositories won't help with that, because people want 3rd party programs and games."

I am happy with 25,000+ programs available in Debian repository, I never install random package from the Internet. At least the basic packages should be available from the repos so the risk is at least reduced if not eliminated (depending on the behavior of the user)

In my experience people who use the word "zealot" lack arguments.

Re:Not more safe

[sopssa]

The software ecosystem is "much more confusing" because it's an OS with 95% marketshare and theres millions of 3rd party programs and games for users. And they really want and need those.

Actually it would really suck if Windows had just one Microsoft verified "app store" where everything is controlled like with iPhone.

Re:Not more safe

[Goaway]

And how many desktop Linux machines even have more than one user?

Re:Not more safe

[nurb432]

Except one would hope that you could trust what you get from a site like this. Not everyone can scour the source/binary of every app they get from a 'trusted' site.

And if you cant trust the 'trusted' sites for the free stuff, then the entire FreeOS movement is dead in its tracks.

Re:Not more safe

[nschubach]

You are arguing about ignorance of users, not the security of the OS...

Re:Not more safe

[DragonWriter]

Most malware now a days comes via trojans, and any OS can't protect against that unless it's totally locked down (like iPhone)

There's a middle ground that can maximize protection against trojans (of course, nothing can protect against completely unwary users), and that's using something a model where untrusted apps are (whether by running through app-specific accounts or otherwise) required to be given fairly finely grained permissions on installation before accessing resources.

While Linux distros provided somewhat more protection against users being unknowingly tricked into performing dangerous tasks by providing elegant, non-intrusive ways to provide the control users need without always running as a superuser before Windows did much in that regard, it shares with Windows a fairly all or nothing security model in many regards that is particularly susceptible to trojans.

Re:Not more safe

[Jetboy01]

And the hardest part of all is making sure that the end-user actually bothers performing the updates!

Re:Not more safe

[Goaway]

And thus you raise the threshold for entry for new third-party software.

Re:Not more safe

[Anonymous Coward]

It's been told to all the linux zealots so many times that Linux itself isn't really more secure against malware than Windows.

Linux IS more secure against malware than Windows. It certainly isn't completely safe, but it's leaps and bounds ahead of Windows in that regard, marketshare aside.

Re:Not more safe

[SnarfQuest]

In my experience, >90% of Windows systems that I am asked to look at are packed full of virus, adware, and other malware. I've only seen one Linux system infected with anything, and that was a long time ago.

The "inexistant desktop" meme doesn't matter to me. Besides being nonsense, the fact that Linux machines don't melt into a malware pile of crap 30 seconds after connecting to the internet, is what makes me prefer them. I don't think Windows machines could be more malware acceptable if Microsoft actually tried to design it to be so.

Re:Not more safe

[nschubach]

... which has nothing to do with how secure the operating system is, but the profile itself.

Re:Not more safe

[phantomcircuit]

That's kind of the point...

Re:Not more safe

[couchslug]

"trying to trick unsuspecting users to install a malicious script by hiding it as a theme or screensaver."

Screensavers are an easy threat to negate. I don't run them, on any OS.
It's natural to bait people who prefer fluff over control with fluff.

Re:Not more safe

[Suiggy]

[quote] If i tell you to type "sudo rm -rf /" and enter your password when asked, will we see article like "OMG! UBUNTU GOT MALWARE" the next day too? [/quote] You would be surprised. If Linux were popular, and were used by many people who were novice users, such as is the case with Windows, then yes, they would be doing exactly that. It's a common joke on certain tech forums and image boards to trick users into entering "runas /profile /user:administrator del c:\windows\system32" and many unsuspecting people fall for it.

Re:Not more safe

[nschubach]

Technically, all of them. They have a root user and the regular user at least. If they only have a root user, they are asking for trouble, imposed by themselves. In most cases, there are users created for some applications (for instance FTP) that have even stricter access than someone with local login permissions.

Re:Not more safe

[kenshin33]

an most linux systems are kinda locked down. privilege separation. Every day's simple tasks don't need root privileges. Though, distros like Ubuntu are killing that a bit with the "sudo" philosophy (implicite priviledge gain, like the annoying thing in VISTA). Where as the old "su" aproach (explicitly requesting root priviledge in a terminal) is less vulnerable to this kind of tricks. Worst case user's files get erased (backup backup and backup). but the whole system integrity is untouched.

Re:Not more safe

[nschubach]

Truthfully, I'm not sure if screen savers require root access to install, but it wouldn't be that difficult to change that. Each user picks their own screensaver so it goes to say that it could be stored and run from their own binary folder.

That's also why I don't give my parents the sudo password.

Re:Not more safe

[TheDarkener]

Every LTSP installation ever?

Re:Not more safe

[sexconker]

Absolutely FALSE! The numbers would be closer, but not equal. By definition, you cannot know all the vulnerabilities in "secret source" software, because they are simply not disclosed. This number is surely more than zero. Therefore, all other things being equal. open source will always prevail because the "secret" vulnerabilities will be fixed on OSS, while they still exist in secret source software.

Absolute HOKUM! The numbers would be nearly identical. The protection of software being open source requires that you:

Trust the creator
Trust the host (to make sure it is unaltered)

Closed source software requires that you:
Trust the creator
Trust the host (often the creator)

The fact that you CAN read every line of code does not make the software safer. The fact that SOMEONE MAY does not make the software safer. The fact that someone DID does not make the software safer unless you trust that person for some reason.

The ONLY thing that makes the software safer is YOU reading and understanding every single line of code.

Closed source software is usually PAID for, with specific stipulations on what it can and can't do (feature-wise and security-wise). Money talks louder than "freedom", and unfortunately it always will.

Now, begin the closed source vs open source stability/support/security/update process data point cherry picking!

Here's my data point: Everything sucks and I'm disgusted that people put up with it - paid or not. (No, I'm not gonna do anything to fix it - I can idly bitch all I want!)

Re:Not more safe

[Suiggy]

Normally, screen savers do not require admin privileges to run, you just run them out of your user directory. But in this case, the screensaver was packaged in a .deb which does require administrator privileges. sudo dpkg -i cute_kittens_screen_saver.deb

Re:Not more safe

[soundguy]

Wrong. They may have multiple user ACCOUNTS but most of them are only going to have one actual meat sack (i.e. USER) at the keyboard.

Re:Not more safe

[vadim_t]

Sorry, this line of argument is stupid.

You're basically arguing that you can't be more secure than Windows -- Windows' security is as good as things will ever get, and everything else only gets less viruses because it has less marketshare.

But if so, why all the security advancements in the latests Windows versions? Why isn't it still using Win95 era security? Why did MS bother coding support for NX, UAC and so on? Well, because turns out, it's possible to do better. Current Windows versions are vastly more locked down than Win95, because some design choices turned out to be stupid and vulnerable.

Linux doesn't follow some common Windows security pitfalls, like having ActiveX and having the browser execute binaries from the net. It also doesn't have autorun. Just that closes several ways of compromising the system, therefore at least in that respect it's more secure. Of course it's not 100% impenetrable, but evidently there exist features and implementation details which make it easier or harder to compromise the system, so not all OSes are equally [in]secure, it depends on how they're implemented.

Re:Not more safe

[SanityInAnarchy]

Repositories won't help with that, because people want 3rd party programs and games.

As phantomcircuit says, that's a reason to put more software in repositories, or provide sane sandboxing for it. Speaking of which, when have you bought a game at the store, and found it pre-infected with malware?

However, at least the option exists. Show me where I can have an even halfway decent experience on Windows while sticking to trusted sources. Seriously, try to live with only what's available on Microsoft Update. Contrast this with the tens, even hundreds of thousands of packages for your typical Linux distribution.

All of the zealots yelling that Linux/Mac OSX are secure about malware, which results in normal people thinking they can run whatever downloaded "because my OS is secure!".

That's true, and I agree with you that this could be a problem. The solution to security is not merely to put people on another OS, it's to actually educate them about security.

That's also why you want to look at what tech-savvy people do for security, and how easy it is for them. If tech-savvy people on Linux get most of their software from repositories, and Windows and OS X don't have package management, that should tell you something.

However, I don't think it's harmful or incorrect to say that Linux is more secure than Windows, and that antivirus doesn't do much on either, other than protect you from yourself.

And before everyone jumps on the "but you can't get infected by just browsing on porn sites on linux!", why not? What was the last time you got infected by Windows vulnerability?

On Windows, there are still significant browser vulnerabilities which would be problematic. Additionally, they've only even tried to start reducing user privileges with Vista -- before that, surfing porn sites would likely get your machine completely rooted, as opposed to just having access as an ordinary user.

Now consider browsers like Chrome, which actually sandbox the browser process, chroot it, and run it as a separate user.

That brings up another point: IE has historically been swiss cheese, as far as security is concerned, yet it is still the default browser on Windows. The default browser on most Linux distributions is Firefox.

Those attacks are usually against 3rd party programs like PDF or Flash. And guess what, those apps are on Linux too and are just as well exploitable.

Flash? Maybe. All the more reason to get rid of it, and promote standards for which there are actually alternate implementations, like html5. Or just use Gnash -- though admittedly, this significantly limits what will work for you, so far.

PDF? PDF is a file format, not a program. I don't view them with Adobe Reader -- on KDE, I use a program called Okular, and it's something else on GNOME. Good luck finding something that exploits all of these at once. And hey, if you do find an exploit in Okular, go ahead and fix it -- can't do that with Acrobat.

This just shows that if Linux had 95% marketshare on desktop, and Windows 0.5%, it would be the same thing but just turned around.

I don't think we can actually make that call.

First of all, Linux is not "one thing", even less so than Windows is. If Linux had 95% of the desktop marketshare, that would be Linux, and probably not even strictly Linux, but free Unix. You'd still have some people running FreeBSD, some people running OpenSolaris, some people running Ubuntu, some people running a custom-complied Gentoo, and so on. The same things which make people imagine that porting proprietary software on Linux is hard (it really isn't), would make it much more difficult for an exploit to work.

Granted, most versions would probably have the vulnerability, but each version would have to be exploited slightly differently, since exploiting a buffer overflow (for example) requires intimate knowledg

Re:Not more safe

[Anonymous Coward]

This particular malware is not because of a security problem with the OS.

Except that if this was a Windows screensaver you can bet it would be blamed on the OS and not on the fact that it was a social engineering attack.

Re:Not more safe

[TrancePhreak]

Several priveledge escalation holes have been found in Linux over the years. They could have gotten root if they wanted.

Re:Not more safe

[Anonymous Coward]

1. Something like a screensaver does not need root privileges to install, it can be unpacked to the user directory with just user rights.
2. Even if installed centrally, the applications inside are still run with user privileges.
3. If some application in the package requires setuid rights, it will be detected by the package manager.

Re:Not more safe

[Rockoon]

They may have multiple user ACCOUNTS but most of them are only going to have one actual meat sack (i.e. USER) at the keyboard.

I'm a bag of mostly water you insensitive clod!

Re:Not more safe

[miknix]

One major difference is that malware on Windows can screw up the entire system where Linux will most likely only screw up one profile.

I don't know why you were modded TROLL. In any decent GNU/Linux distro, elevated privileges are separated from the common user account. So yeah, unless you always run as root or use su/sudo blindly, I don't see how you can get your local system easily compromised without some serious exploitation. Even by exploiting a non-public attack vector it is fairly difficult to target a lot of Linux desktop machines due to the diversity of platforms and architectures out there.

Should we all be scared because of this? Is the world going to end? NO, but if you executed everything people throw at you, you should really start thinking in doing it wisely.

Re:Not more safe

[digitalunity]

Here's an idea. Feel free to agree, disagree, tear it apart, whatever...

Why not have a kernel network access logging module with a userland process that periodically reports to users which programs are accessing the TCP/IP network? Say once a week or once a month or something. The number of programs that do this for many users is quite low. Probably Firefox, Thunderbird, Opera, uTorrent, a short list of other programs. Users then have an opportunity to ignore those programs on future reports. Users now have a good idea if there are changes to their system that might affect security.

There would still be opportunity for malware to access the internet, but users would either 1) notice it or 2) it would make the malware work in very complicated, noticeable ways(like uploading data to a website using a URL).

Re:Not more safe

[LOLLinux]

One major difference is that malware on Windows can screw up the entire system where Linux will most likely only screw up one profile.

If that is the case they are running their system incorrectly. Windows has supported limited-priviledged accounts since Win2k. It's not Microsoft's fault if no one uses this properly. On my Win7 box it wouldn't be able to screw up the entire system since I have proper priviledges set for the account I use.

Re:Not more safe

[Locke2005]

I would argue that being able to review the source code and then recompile everything from scratch means that it IS more safe -- somebody somewhere will eventually look at the code close enough to discover malfeasance and alert everyone else, just like in this case. I'll grant you that if you are running precompiled executables from untrusted sources, you are not safe regardless of what operating system you are running.

Re:Not more safe

[mR.bRiGhTsId3]

I'm sorry, you have no idea what you are talking about. Sudo is not an implicit privilege gain. You have to manually request elevation. The reason it looks implicit is because all of the applications that ever need elevated privileges come with launchers that do the work for you. Sudo can also be configured to function the same as su (OpenSUSE) ships it that way I believe. The same is true of the new policykit. Similarly, Vista is not an implicit elevation either. The continue prompt only occurs for administrator accounts because they are flagged with a token on login that mark them as administrators. They are required to manually take action. Furthermore, this function can be disable in group policy in order to force a password entry in the same way that non-admin users have to authenticate to perform system changes. The only reason it occurs automatically is through application manifests and heuristics. Both of these cases are explicit elevations at the behest of the application author that the user can approve or cancel.

Re:Not more safe

[isorox]

Actually it would really suck if Windows had just one Microsoft verified "app store" where everything is controlled like with iPhone.

Yes it would, and in this would I would add the google repository, and perhaps the apple repository. Anyone could set up a repository (same as you can with debian), and sign their packages, but if they got compromised, or let crap in, then I'd be wary of using them in the future.

The problem with the iphone appstore is there's only one. You cant add a competitors.

Re:Not more safe

[BikeHelmet]

This particular malware is not because of a security problem with the OS. It is more of a social engineering thing - trying to trick unsuspecting users to install a malicious script by hiding it as a theme or screensaver.

Welcome to Windows, mate. I've got this cute little dancing beetle that'll keep you up to date on the local weather... ;)

Re:Not more safe

[Ethanol-fueled]

It's about sloth rather than safety. If they can figure out how to run linux, then they can figure out how to run it as unsafely as they ran Windows. Why type sudo a million times when you could just sudo -i or worse, login as root (though Ubuntu makes enabling login as root a hassle)?

Years of Windows use has got many switchers acclimated to careless, instant gratification before they just reinstall the O.S. instead of fixing it when it slows to a crawl.

Re:Not more safe

[Nefarious Wheel]

The software ecosystem is "much more confusing" because

...because you can't see what it does. You're not allowed to scan the comments or see what instructions are being used for what. You can't read the scripts, parse the language, inform yourself as to what the heck they intend to do with your very own, privately-acquired silicon real estate.

Which they treat like an unfenced lawn on a house between the football stadium and the train home. that's why it's more confusing. You aren't allowed to run with the facts.

Re:Not more safe

[Anonymous Coward]

The reason most Windows-based PCs are infected is also due to the ignorance of users. I haven't had a virus or malware attack in years because I keep my antivirus program up to date, I don't visit sites that are prone to malware, and I use safe searching habits. The people who are constantly asking me to fix their computers are the ones who don't follow these strategies.

Re:Not more safe

[shadowbearer]

  Screensavers shouldn't need direct file access to anything more than their binary files and libraries (read only!), their data files in /home/user, and the X window screensaver system via system calls. I'm not a heavy duty programmer, but I fail to see why screensavers can't be effectively sandboxed, at least in linux.

  Anyone care to enlighten me?

SB

 

Re:Not more safe

[Voulnet]

If you have the source, you can do this in a few minutes (or put in your own temporary patch) with the proper skill and be back up and more secure than someone waiting for "Patch Tuesday."

If you want Linux to grow and reach more people, as opposed to being a geek niche, then you should forget about requiring people to have the skills necessary to patch the source. Emergence of malware means only one thing: Linux is growing in popularity. Now, if we wish for its popularity to prosper then we should use the normal user's perspective a little bit; you know, people who can't patch the source and compile it by themselves.

Re:Not more safe

[Anonymous Coward]

When you show me a Linux or OS X computer that's vulnerable to something like the slammer worm, get back to me.

Haha. You seem to have a false sense of "superiority" of Linux here. You are the perfect kind of Linux fanboy. You take pride in an OS somebody else has written and you being just a user. Your faith tells you that Linux is sprinkled with anti-exploit fairy dust. But you're faith is mis-placed here. You only have to hang around full-disclosure and milw0rm to know that there are THOUSANDS of exploits for Linux (OS + s/w). Any half-decent programmer can write a Linux worm in a day. Just give them a bunch of unpatched Linux desktops with whatever desktop distros were popular in 2003.

Almost all of the windows worms spread wildly because of unpatched installations. Given that 90+% of the world runs windows on their desktop, there are bound to be a quite a few unpatched ones. Heck the patch for conficker was out months before the worm hit. These are verifiable facts. Although I can't claim to have verified each and every single worm that has ever existed and confirmed that it spread after a patch was out, I can say with a high degree of probability that almost all of the recent worms are authored after reverse-engineering specific security patches.

Now as far as OS X goes, there was a worm that spread via a bluetooth vulnerability. I think some security company created it to prove how easy it was to create worms for OSX (and to make money :P). Not to mention that Macs are first to get owned at PWN2OWN competition.

Re:Not more safe

[Anonymous Coward]

"Let's continue to pretend Windows is XP Pre-SP2 where the computer gets infected within 30 seconds of being connected to the internet. Let's pretend that service pack 2, which shipped in 2004, doesn't exist. SP2 which by default had the firewall blocking internet access to potentially vulnerable Microsoft services. Let's pretend that the two new versions of Microsoft client OS are likewise not protected, or don't exist. Yet when we look at our updated-every-6-month Linux OS, we will ONLY consider the latest version!"

Re:Not more safe

[Rockoon]

Which is it?

Is the goal to "get as much of the 3rd party software as possible into the repository" or is it to "raise the threshold of entry"

You began by claiming the 1st, but when problems with that were noted, you reverted to the 2nd.

Pick one please.

Re:Not more safe

[shadowbearer]

  Isn't it a lot easier to detect and remove userspace malware than rootkit style malware?

SB

Re:Not more safe

[LinuxIsGarbage]

I always tell users to only download software from sites like Softpedia or Download.com. Plus you get the "choice" of what site you want. And we all know that choice is a good thing!

Re:Not more safe

[ProzacPatient]

I tell people to be careful against what packages they might be installing.
I don't know about RPMs, but DEBs in particular don't just copy files and often run scripts as apart of their installation, and these scripts run with administrator privileges.

Linux is rapidly gaining popularity, especially in the netbook sector, so expect to see increasing amount of malware like we've seen with Apple's OS X which is also rapidly gaining popularity among desktop users.

Re:Not more safe

[Anonymous Coward]

Seriously, try to live with only what's available on Microsoft Update. Contrast this with the tens, even hundreds of thousands of packages for your typical Linux distribution.

Why limit yourself to MS update? There are other safe places to get win32 software... for example, Sourceforge has a great deal of what's available in your distro's repositories.

Re:Not more safe

[DogDude]

Are you thinking of Windows Firewall, maybe?

Re:Not more safe

[Barsteward]

"your an idiot." no, you're an idiot.....

Re:Not more safe

[reub2000]

Plasmoids are neat, eh?

Re:Not more safe

[ratboy666]

Which is why the model "identify malware" doesn't work.

The cute kittens on the screen-saver is NOT malware. Even if it "phones home" it's not malware. It's only malware if it does something that the user doesn't want. So... it's not even malware if it opens a mail relay and spams... if that's what the user wants.

The only way to prevent malware is to allow the definition of what malware is. Resources used by programs can be checked against those definitions. This is the thrust of efforts like kernel capabilities and MAC (mandatory access controls).

It took YEARS to fit this into Linux, and provide workable base definitions. Arguably, 6 versions of Fedora were needed to successfully migrate to SELinux.

Now, repository owners need to do due diligence as well, but with a capability/resource controlling system in place, it becomes very difficult to even define what malware is: if a program uses resources beyond what it is allowed, it is simply stopped. This may be a permanent thing (opening a mail relay) or a temporary thing (not having permission to remove a file). The program is simply whatever it is -- one persons malware may well be anothers application.

Of course, there is a firm definition of malware still available - software which subverts the resource control. AFAIK, there aren't any such attacks on SELinux.

Unfortunately, Ubuntu doesn't install a MAC (mandatory access control). Which is REALLY annoying, because without this, welcome to the "Windows Malware Experience".

Microsoft will have to move to a MAC system as well. But, it will time. First, privilege escalation prompts. Then, manual program classification; system programs first, and then others. Then, the utilities needed to allow the definition of security profiles, and then the user debugging of those profiles. Stay the course, Microsoft -- you should be there in 2014 or so.

There are two MAC systems in common use: SELinux and AppAmour. Since I am more familiar with SELinux (they are both based on the same kernel base). Try "sudo apt-get install selinux". Better - switch to Fedora.

Anyway the whole "Linux is obscure, and that's why its secure" argument is easily refuted. Good Linux distributions are much more secure than Windows (pre Vista, anyway).

Vista and beyond implement MAC as well -- via "Mandatory Integrity Control". Four different security layers are defined; low, medium, high and system. But, it isn't clear that general resource use can be tied to these. Files and file system objects can be protected, and processes isolated. But, it still seems coarse... But I am not an expert in MIC, so I may well be wrong.

Anyway, with a MAC system, and the principle that Visa uses putting "internet software" into the Low MIC category, we may well see the end of the "Virus and Malware Protection Racket".

Sorry for the ramble, it's late.
 

Re:Not more safe

[santiagodraco]

Ergo anyone who gets malware/spyware/etc on their machine is an idiot? Or those that don't use Linux?

I'd think that IGNORANCE and a lack of technical sophistication by the vast majority of users is a more likely cause for issues. That and the knowledgeable IDIOTS who write this crap in the first place.

Re:Not more safe

[nschubach]

The argument is still the same. I'd rather be able to tell someone who can that they may than tell them they may not.

Anyone can try to fix it. Some may be better than others, but that's doesn't preclude someone from trying. Whereas, on competing systems you may not.

Re:Not more safe

[mysidia]

You're making a leap in logic here. The existence of a malicious Linux program does not indicate that the Linux platform is less secure than Windows against malware threats.

On the contrary, there is strong evidence otherwise, given:

(A) Windows users commonly run with 'Administrator' rights, because many software programs require it. The Administrator user has rights that are useful to malware, such as the ability to change system configurations, including the DNS resolver config: the ability to modify/add system files, including the "hosts" file.

(B) In the Linux world, it is common that users run as "non-root"; this non-administrative user cannot change global system configurations. Among things non-root cannot do:

• Cannot access arbitrary process memory and manipulate/read things out of browser processes. Common default security configs prohibit even attaching a debugger.
• Cannot: discover the user's login password as they login. (Since non-root-installed malware cannot be running while the system is at login prompt)
• Cannot Modify global system files (such as /etc/hosts)
• Cannot Delete or modify system utilities and software used to detect/kill unwanted programs such as "/bin/ps", "/bin/kill"
• Cannot capture passwords being transmitted across the network, spoof IP addresses, arp spoof other hosts on LAN, etc (only root can try that junk)
• Cannot modify the web browser (such as Epiphany or Konqueror), to intercept web traffic or credentials, since the system files are not writable to non-root user.
• Cannot create additional users, to allow an attacker access.
• Cannot change firewall rules to allow attacker traffic, or to allow outbound traffic in violation of configured egress policy.
• Since standard firewall settings for most distros block inbound connections; cannot run a web server ti serve a phishing site.
• Since common Linux firewall settings block most outbound ports, including port 25 (except to ISP mailserver and hosts on the LAN), malware cannot send spam.
• Ability to "log" keystrokes is very limited, due to the X security model. Malware cannot log keystrokes for other users' X sessions. Secure X applications can also "lock" the keyboard into secure mode, assuring that no other applications running as even the same user can log anything.
• Cannot destroy or manipulate other users' files.

Whereas on Windows cannot is not true. Because malware running on Windows can accomplish all those things.

Some of them require Administrator, but most users run Administrator. For the few that don't... Windows has more unpatched, "secret" Administrator privilege escalation security bugs, than common Linux distros' bugs of all types, over their entire lifetime.

Re:Not more safe

[ToasterMonkey]

Linux doesn't go out of it's way to do stupid things for a dubious gain in "convenience".

Yes it does.

Linux never bought into this idea of blurring the line between data and programs. Linux never encouraged executing random executables from unknown and untrusted sources.

Even Apache and Tomcat keep user data local to their install locations. Almost all third party unix software also do this. Software that stick to the /opt /etc/opt /var/opt conventions are far and few between. Also, I'm sorry, but compiling and executing random software from unknown and untrusted sources is no safer than tossing around executables. Tell me how the encouraged "./configure; make; sudo make install" makes Linux any better.

Neither did MacOS, or FreeBSD, or any of the commercial Unixen.

They are all in the same boat. There are no magical requirements that separate data from application installations, because there was never a strong need to make said data easily portable between systems. Maybe it was desired, but not enforced on any OS I have found.

In that regard, merely avoiding Microsoft apps while running their OS can avoid most of the potential trouble.

Their own apps usually jive the best with their own OS's. I mean Windows isn't anywhere near perfect at encouraging good application design, but MS's own apps are not bad at all..

Linux is neat and all man, but you can't give it credit for blindly following decades old UNIX design, or for not having large numbers of commercial ISV's. A commercial OS vendor has to listen and cooperate with ISV's as well as users, and can easily wind up with the least technically impressive solution to a problem because of that. Linux distros can choose to ignore whatever they want or fork it, users and developers be damned.

Re:Not more safe

[nschubach]

I have a Windows machine which has been running just fine for years, but that doesn't mean that it's just as secure. If I do get a virus on that machine, there's a greater chance I will be rebuilding it opposed to my Linux machine.

Re:Not more safe

[Anonymous Coward]

the "secret" vulnerabilities will be fixed on OSS, while they still exist in secret source software.

Huh? In either case, they only get fixed if someone finds them and reports them as bugs. Users are not expected to be OS and Kernel developers/experts. But even then, You have to deal with users who don't patch their systems.

Conficker worm:

Vulnerability patched: - October 23, 2008 ( http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx )

Worm seen in wild: - November 2008 and still spreading to this day

I wonder if the press gave MS a pass on this, since it they had already patched it prior to the first report of the worm was logged. If the tables were reversed I'll bet 100% of Slashdot and the other online Linux cheerleaders would claim it wasn't the fault of any distro. You'd see snide posts like
"Unpatched computers get infected. News at 11" , "Idiots who don't patch their system get infected" , etc. No, its not a strawman, its an informed opinion ;)

Re:Not more safe

[db32]

What nonsense, just apply the .45 patch to their head and they will never have a problem again!

Re:Not more safe

[tftp]

Why not have a kernel network access logging module with a userland process that periodically reports to users which programs are accessing the TCP/IP network?

That's basically lsof.

The number of programs that do this for many users is quite low.

I would say every program will be there that checks for updates. Also malicious code in network software will be not detected. Many modern apps use Internet one way or another - IM, streaming, P2P, IP telephony, etc. You'd really need to go back to basics to find an app that doesn't open a connection somewhere.

Re:Not more safe

[nschubach]

Now we are arguing semantics... ;)

Re:Not more safe

[Anonymous Coward]

All it shows is that Linux is vulnerable to trojan horses. ALL operating systems are vulnerable to trojan horses. When you show me a Linux or OS X computer that's vulnerable to something like the slammer worm, get back to me.

Slammer worm? Are you serious? In a little over a month it will be 7 years old and infected versions of Windows which are now at least two generations old. Surely you can come up with something more recent that affects the current version of Windows (or Vista since Windows 7 is so young)?

Re:Not more safe

[dosius]

Didn't the first Internet worm specifically affect the free and open-source operating system BSD?

-uso.

Re:Not more safe

[techno-vampire]

it wasn't going to be able to infect the system folder...

What "system folder?" This is Linux we're talking about not Windows. Are you talking about /bin, /sbin, /etc, /var or some other directory? Unlike Windows, Linux spreads things out across the file system so that it doesn't have all of its essential files in one place.

Re:Not more safe

[node 3]

Before I even begin, I'm going to point out that your use of the term "zealot" is childish and detracts from your argument before any actual facts and logic enter the equation. This is called "ad hominem" and is both a logical fallacy, and a dishonest argument tactic which adds *nothing* to the validity of your claim. I could just as easily say something like "Windows idiots think that...", which would be just as detrimental to may case.

It's been told to all the linux zealots so many times that Linux itself isn't really more secure against malware than Windows.

Correct that it's been told many times, but the thing being told is wrong. Linux itself *is* more secure against malware than Windows.

It's only so because it's marketshare is like 0.5%, if even that, and it makes much more sense to make malware where the (non-geeky) users are.

Wrong. If you s/only/partly/, then correct.

This just shows that if ever linux did gain marketshare with casual people enough, the malware problem will be there too. Repositories won't help with that, because people want 3rd party programs and games.

Yes, repositories will help. The reason is that repositories *overwhelmingly* provide the software that users will want. There will still be a demand for third-party software, just as there is now, but the demand will be *significantly* less than is currently the case for Windows.

In other words, Linux users have less desire to install software from outside of their distro's repository, and thus even if malware in third party software were to reach parity with the ratio in Windows software, Linux users will *still* be less likely to download and install spyware.

The funny thing about this is the same that as with Mac OS X users. All of the zealots yelling that Linux/Mac OSX are secure about malware, which results in normal people thinking they can run whatever downloaded "because my OS is secure!".

But their OS *IS* secure.

Experiment:

Subject A is a Linux User.
Subject B is a Mac User.
Subject C is a Windows User.

Give all three subjects a new PC with their respective OS. Send them out on the internet with the mandate to freely download and install any software they wish. At the end of the experiment, which user do you think will have more malware?

So yes, Mac and Linux are more secure. And yes, they *can* download whatever they want. The Linux and Mac users' risks are not *ZERO*, but they are practically zero. While the Windows user's risk is *significantly* higher than zero.

Well, now you almost certainly point back to your original statement that this isn't due to any sort of inherent security, but merely due to market share. While I've refuted this already, in this particular instance it doesn't even matter. Linux and Mac OS X can actually be *less* inherently secure, but still be more secure, especially in the manner you've stated, in being able to "run whatever they download".

And before everyone jumps on the "but you can't get infected by just browsing on porn sites on linux!", why not? What was the last time you got infected by Windows vulnerability? Those attacks are usually against 3rd party programs like PDF or Flash. And guess what, those apps are on Linux too and are just as well exploitable.

No, they are not.

First off, many Windows exploits require no privilege escalation. Second, Windows is more homogenous, making it easier to write an exploit that will work across more installations. Linux varies quite a bit.

Third, and most importantly when it comes to malware, is the double-whammy of the Windows registry and insane systems and settings folder structures. Malware can actually *hide* in Windows quite easily. On Linux (and OS X), the system/settings folders are quite transparent and readily accessible. For a somewhat oversimplified comparison, if add/remove programs worked

Re:Not more safe

[Rockoon]

Bull.

Less than 0.01% of all computer users would EVER do any of the crap you claim. Your argument is a non-starter because this branch in the comments is a theoretical on Linux actually having 95% market share. If it had 95% market share, then there would be no repository on the planet that could handle the volume of software being produced while also requiring that humans actually scan the source code in the manner you suggest.

It is precisely because there would be such an overwhelming shortfall in repository resources that it would quickly become the norm to not use a repository at all, and soon enough people would demand for and then switch to a distro that didnt even require typing 'sudo' .. that some form of click-yes UAC would be the norm.

In the early days of the Internet, even prior to there being a "web", there WERE mainstay repositories for DOS and Windows software that were widely used. Some of them are still around (such as TuCows), but they are not used substantially by the vast majority of people anymore, because they simply cannot keep up with the volume.

Re:Not more safe

[sqlrob]

Right, that fix that Debian did to OpenSSL for uninitialized memory use worked out real well.

Re:Not more safe

[westlake]

Wrong, anyone can not fix it. Any one MAY fix it.

Only the tech savvy programmer types that care enough to fix can fix it.

But who do you trust?

The programmer has the option of releasing a more adept and more malicious version of the program into the wild.

Re:Not more safe

[bcmm]

In history malware tried to just fuck over the computer which would had required root access

(If I didn't have backups) I would rather you ran rm -r /etc/ than rm -r ~/ on my box.

Re:Not more safe

[Risen888]

That already happened, dude. Like six years ago. Get with the program here.

Re:Not more safe

[Anonymous Coward]

Have you tried ufw?

http://manpages.ubuntu.com/manpages/karmic/en/man8/ufw.8.html#toptoc7

Re:Not more safe

[sqlrob]

Yes, but you have to actually be looking for it to find it.

Re:Not more safe

[Anonymous Coward]

Yeah, and that's multiplied a lot because there are lots of people who can pay one of those to fix it.

Re:Not more safe

[phantomfive]

Not by anyone intelligent. The difference between Windows and Linux is how easy it is to remove stuff like this on Linux. It's easy on Linux. Sometimes practically impossible on windows.

Re:Not more safe

[kenshin33]

well, I'm not questioning sudo per say (it's useful) and yes you can manage it's use. What I call implicit (less explicit would more curate)is the way Ubuntu (may be other distros I don;t know, I'm a gentoo user)) uses it, yes you have to enter a password, But opening a terminal and typing "su" (or sudo for that matter) is more explicite. Meaning you won't do it just for pleasure, and therefore most likely you know what you're about to do. Any app that wants root priviledges can popup a window (gksu, gksudo). While it's convenient, it's more dangerous. most people don;t actually read carefully before clicking.

Re:Not more safe

[thejynxed]

In this day and age, if your machine gets compromised by a virus, trojan, or rootkit, the only sensible thing to do is wipe and reinstall from a known clean backup. It doesn't matter what OS it is. There's no telling what other little friends they brought along that your chosen methods of detection didn't find. It's not really an option anymore to keep on going with a system that was compromised.

There's also been some evidence of malware that triggers AV software on purpose, and acts as a distraction while the real dirty payload gets delivered silently elsewhere in your system. You are now fooled into thinking your system is clean because your AV caught the distraction virus, completely missing the real one that was also installed.

Re:Not more safe

[matt_hs]

Truthfully, I'm not sure if screen savers require root access to install, but it wouldn't be that difficult to change that.

Required or not, the barrier that needs to be breached is the social engineering one. If I tell people I've created a screen saver that will give the user a direct, live feed from the Hubble Telescope, and it says that administrative privilege is required to install it, those who are interested in my "screen saver" will grant those privileges and at that point the system is hacked. Doesn't matter if I have an in with NASA to get direct images from Hubble or not.

Re:Not more safe

[Dog-Cow]

WIndows NT 3.5 existed at the same time as Windows 3.1 and had most of the same security features as Windows 7. The NX bit had not been implemented by Intel, so it couldn't support that, and the UAC stuff is not really needed for security. It's just a shortcut for getting admin privs without logging in as admin.

Really the recent changes in Windows security has been in guiding the user to more secure practices, such as not logging in as admin.

Re:Not more safe

[mysidia]

Both. You are imagining a false dichotomy where there is none.

Getting as much of the 3rd party software as possible into the repository does not preclude raising the threshold of entry.

Some software you want to fall below the threshold is no-name drive-by malware.

Re:Not more safe

[vosester]

This might be what you are looking for

http://en.wikipedia.org/wiki/Ntop

Re:Not more safe

[melikamp]

I agree with your prediction, and I have a good reason to believe that GNU/Linux would have been much more resilient with respect to malware. It has to do with the software sources and trust.

Since we have the freedom to read the source of everything we use, we can build trusted software repositories with a security policy that is based on facts. Nice, verifiable facts. The authors are known, some (and way too few!) by name, and the code is under a lot of scrutiny. In the world of binary blobs, on the other hand, the security is all hearsay. Acceptable policies sound like "dude, everyone uses this" and "torrent sites have a lot of infected programs". There is not and never will be a reliable authority on what is safe in the non-free world. They could try reviewing everything, like they do for the iPhone today, but they will never be able to afford it for a fully-featured commodity OS. The community-supported free software is crushing them here as we speak.

Re:Not more safe

[OneSeven]

Ok, and what if you see perl, mail, telnet, ssh, netcat, ftp, wget, etc in your list? A wanna-be cluey user will google and see they're not malware, but all of these things can be used by malware to do nasty stuff. Disabling any of those from hitting the network will likely affect other tools that do use them legitimately. If the malware isn't directly opening network ports itself, this approach is useless, and in many cases the malware would be better served to use existing tools such as these anyway.

Re:Not more safe

[jpmorgan]

Hi! Welcome to slashdot. Always nice to see a new commenter.

Re:Not more safe

[Arker]

The screensaver interface in Windows is 'integrated' in the OS and therefore a vulnerability there is a vulnerability in the OS. On the other hand Linux is a little smarter and doesnt dictate high-level abstractions, the vulnerability in question is one in GNOME not Linux, and has no effect at all on the many Linux users who do not choose to ruin a perfectly good system by installing GNOME on it.

Re:Not more safe

[Jon.Laslow]

"...or a slide show that takes like ten minutes to go through..."

Did you just seriously suggest that Ubuntu include a ten minute presentation for users to watch? As in, no sarcasm there? Do you honestly expect anyone to actually sit through that? Most people don't have the attention span to sit through the multilingual Welcome video OS X shows on first-boot without trying to skip it, let alone something that talks about security for ten minutes. Remember, if you can't make the user care enough to look in the address bar to see if the 'PayPal' link sent to them in an email is actually legit, you aren't going to make them care enough to sit through ten minutes of tedium after their install is done.

Re:Not more safe

[jpmorgan]

Bit of a straw man. Nobody's claiming that Linux is no more secure than Windows 95. But if you compare Linux to Windows 7, there's not much difference. They both share the same flawed user-id security model, which is what modern malware exploits.

Re:Not more safe

[mysidia]

Conficker is proof that such worms are not pretty much history.

Stating your own counterexample doesn't invalidate it.

Windows 2003's successors such as Windows 2008 are all very young, and not (yet) widely deployed. They have not been "proven" secure; therefore, they should be assumed to be insecure like Windows 2003, until proven otherwise.

Your remark's like saying this type of malware is history in 2 weeks, because there's going to be a new point release of Ubuntu! So the new version of Ubuntu is automatically invincible to all malware until proven otherwise!!!

Also, most malware nowadays does not come as trojans that the user downloads and runs from disk.

Most malware infections nowadays (on Workstations) are caused by "drive-by downloaders" that exploit bugs in Internet Explorer.

It's fascinating this is still true, given the very high market penetration of Firefox... one would expect there to be more malware infections due to drive-by-downloaders targetting Firefox.

I wonder why that might be...

Firefox is a great example proving that Open source development results in more secure software.

So, there are at least two pieces of evidence against anyone who wants to claim Open source software isn't any more secure than Windows against malware.

Re:Not more safe

[vadim_t]

WIndows NT 3.5 existed at the same time as Windows 3.1 and had most of the same security features as Windows 7.

Well, I imagine Microsoft decided to bring the NT security system into their mainstream line of OSes for a reason.

The NX bit had not been implemented by Intel, so it couldn't support that

Linux had the functionality before NX support in CPUs. It can be emulated in software, in exchange for a performance impact and restricted address space. But it was just an example.

and the UAC stuff is not really needed for security. It's just a shortcut for getting admin privs without logging in as admin.

UAC is needed to convince people not to run as an admin all the time, because using earlier Windows versions as a restricted user was very difficult without being a sysadmin with extensive knowledge of Windows administration.

Really the recent changes in Windows security has been in guiding the user to more secure practices, such as not logging in as admin.

Well, precisely, the security of different OSes varies. An OS can become less prone to malware by encouraging secure practices. Therefore there is such a thing as a more secure OS.

Re:Not more safe

[element-o.p.]

Speaking of which, when have you bought a game at the store, and found it pre-infected with malware?

Okay, technically, it's not a game, but how about this? Otherwise, I pretty much agree with you.

Re:Not more safe

[Anonymous Coward]

This particular malware is not because of a security problem with the OS.

Yes, it is. A program that identifies itself as a screensaver should be sandboxed, and unable to run as anything but a screensaver.

This depends on something that is very difficult (sandboxing every application to a limited set of functions), and something almost impossible (interpreting the natural language describing the program to decide that it must be a screensaver), but it's what OS security should be aiming for.

Re:Not more safe

[trparky]

Just goes to show you, no amount of programming code can prevent someone from doing something stupid. Stupid is as stupid does.

Re:Not more safe

[mysidia]

On a Linux system it's almost unheard of for individual programs to check for updates.. that's extremely wasteful, and you probably don't want it. Programs are to be updated by the system package manager, which handles all that.

You presumably know what your IM, streaming, P2P, and IP apps are, and what ports they should be using.

Or perhaps your distribution vendor could publish a ruleset for you, based on each app, and the connections it's "expected" to make.

You best hope the malware doesn't gain root though: the very first thing it would do is "hack" the reporting app's ruleset to ignore itself.

Re:Not more safe

[Anonymous Coward]

So what? On my system any script or program can not be executed without my knowledge. Programs can not access outside of specific directories. They are totally ironed and sealed from each other.

Example, I can not even open a picture from any other directory than ~/Pictures directory. And only application to do that is the Gwenview.
Only place to run any script (or binary executable) is from ~/bin but it first need to be profiled to do so. So I can copy what ever binaries to that directory and they can not be executed if I do not give permission first from admin profile.

Re:Not more safe

[mr exploiter]

The argument is still the same. I'd rather be able to tell someone who can that they may than tell them they may not.

Anyone can try to fix it. Some may be better than others, but that's doesn't preclude someone from trying. Whereas, on competing systems you may not.

This argument is starting to look stupid specially in a story like this.

Any software that I use has to be made by someone I trust, there is no escape from that, no "but the source is available". I have to trust the maker.

And giving excuses instead of assuming responsibility is not going to gain my trust. There have to be concrete steps to assure this not happens again. No excuses.

Re:Not more safe

[vadim_t]

Ok, Linux has SELinux then, just install Red Hat.

And IMO, much malware can be stopped before it gets to interact with your security model. Take Win95, make the browser completely refuse to load ActiveX, refuse to directly run .exe files downloaded from the net, and remove autorun, and you've already made it a lot less likely to get infected, without even using the NT security model.

Linux, IMO, gains a lot of safety from the repository model. Sure, people still download stuff from random places sometimes. But distributions cover most of an user's need, and that at the very least means that people are very unlikely to get infected while looking for a way to uncompress .zip files, as they'll get a safe version from their distro, instead of googling and hoping that whatever site they come up with has the legitimate version.

It's not so much about perfect security as about which is more likely to get compromised when the user attempts to perform a quite mundane task like uncompressing a .zip.

Re:Not more safe

[zig007]

I would disagree, there is no contradiction.
For Windows applications, Microsoft has a "Certified for Windows"-program that all *serious* applications follow, it is pretty basic stuff like not doing really silly stuff on the system.

The repositories is kind of the same thing.
The ones that sucks so bad that they can't live up to even the most basic demands on the platform, they don't really belong there.
So I would actually say that this is exactly the way to go about things:
1. Raise the threshold of entry. Demand good application behaviour. Don't let the distros catch the Windows crap.
2. Get as much of the 3rd party software as possible into the repository. By helping developers out a bit more.

1 makes 2 harder, yes, by they are not mutually exclusive.

Re:Not more safe

[AmberBlackCat]

Half of the social engineering is to convince users to install the screensaver. The other half is to convince them their operating system can't possibly get a virus.

Re:Not more safe

[Rockoon]

No I am not. You have assumed there is a false dichotomy because you imagine repository resources to be infinite.

The argument is that people want 3rd party software, ergo if the repository does not have it then people will go somewhere else for it.

The response to this point is that repositories strive to have as much 3rd party software as possible on them. This would be fine and dandy if there is no raised entry bar, because there could theoretically be enough resources to host every 3rd party program that exists (for instance, Google could.)

But you have imagined a world where there is also enough human resources in order to maintain that raised entry bar (humans looking over source code, accepting and rejecting programs based on what they are programmed to do) while also overcoming the need to download 3rd party programs from someplace else

If Linux had 95% market share, no software repository on the planet could keep up with the *submissions* to it while also maintaining that raised bar of yours, because they simply cannot allocate enough humans to the task.

Re:Not more safe

[AmberBlackCat]

If the screensaver can connect to the internet and update itself, there's no guarantee the removal instructions will work.

Re:Not more safe

[phantomfive]

? what? I've been around a while.

Re:Not more safe

[AmberBlackCat]

Wasn't this screensaver in a repository?

Re:Not more safe

[dbIII]

Well, I'm not sure how it happened but two days ago I was reinstalling someone's new XP-SP2 machine that ended up with a pile of crap including a keylogger before it could even download its updates.
In other words very recent experience shows that the problem still exists.

Re:Not more safe

[ClosedSource]

"Linux never bought into this idea of blurring the line between data and programs."

Actually any OS that allows you to run code out of RAM is doing exactly that, Linux included.

Re:Not more safe

[Sylver Dragon]

Sounds great on paper, but given the way most users react to interruptions caused by security in systems, I'd give it about two iterations before most users would be googling how to turn it off. And even for those first two reports, I would expect the standard "blah blah, technical stuff...ignore it all, why is this bothering me?" response.

For a comparison, look at the response to Windows Vista's UAC. It's really a good idea on paper. Before anything gets Admin level rights, the user has to OK it. And, while it is technically possible to circumvent, there really is no need. Most users will simply click OK to everything; especially if it needed to open those naked pics of Anna Kornikova. Better yet, eventually, people will get so annoyed with those prompts that they will find a way to turn the security feature off.

Re:Not more safe

[mr exploiter]

I hate to reply to myself but reading again I see that the malware was not on any distro's repository so this doesn't affect my trust on them. Still I would prefer that there would be an easy way of installing packages without root access.

Re:Not more safe

[LordLimecat]

If gnome-look is hosting .debs and not reviewing them, it seems to me like theyre inviting disaster.

Re:Not more safe

[zig007]

To be honest, it's just not that. Lack of technical sophistication has nothing to do with gullibility. Ignorance is a choice one makes.
In these times, when all reporting keeps trumpeting about what not to do on the internet, to think "think sounds too good to be true, I'll run it anyway"...I mean, this kind of user will get p0wn3d whatever security measures are in place.

I blame TV. :-)

Come to think of it, In a sense, I actually do.

Re:Not more safe

[adelgado]

Not if you're using Fedora 12, that is :P

Re:Not more safe

[LordLimecat]

This particular malware is not because of a security problem with the OS. It is more of a social engineering thing - trying to trick unsuspecting users to install a malicious script by hiding it as a theme or screensaver.

You mean like almost every piece of malware made for windows in the last several years?

Re:Not more safe

[lgw]

Ha! "Educate the users" got an insightful mod - what is Slashdot coming to? Any security based on educating the users will fail for a significant percentage, perhaps the majority, of users. About the best you can hope for is to get people to realize that there are "safe" and "unsafe" places to get software from in the first place, which wouldn't have helped here.

Re:Not more safe

[Goaway]

We are not. The whole point is that there is one actual human user, and thus there is zero difference if the malware can spread to other users or not, since it has already infected 100% of the available users.

Re:Not more safe

[Anonymous Coward]

Actually, most (about 80%) has at least root and normal account. But about 20% has only one, root (sudo actually) what has same password as the user has. So system is easier to crack when the user has only one weak password! Ubuntu is just a distribution what makes it users stupid.

Re:Not more safe

[Goaway]

And that means your third-party ecosystem will stagnate.

Re:Not more safe

[Anonymous Coward]

A PDF in their home folder, or a slide show that takes like ten minutes to go through...

This would be treated exactly like an EULA.

Re:Not more safe

[phantomcircuit]

They are not mutually exclusive.

The goal is to get as much 3rd party software as possible into the repository, that is above the threshold for entry.

Why is this so hard to understand?

Re:Not more safe

[NoobixCube]

When it comes to things like this, educating the user is the only thing left to do. I don't think it's at all elitist to say that if people can't be bothered learning how to use their computers, they deserve what they get. Granted, with Linux, documentation in a newbie friendly format (i.e., not man pages) is lacking. What else is there to do though? The system itself is secure when it's used correctly, are we supposed to change the correct behavior to cater to the idiots who can't be bothered learning? Or should we tell them what they're doing wrong?

Re:Not more safe

[Anonymous Coward]

How often you have protectionless sex with 5$ hooker?
You do not download and install random package from the net. How hard is that?

Runing/installing every piece of code found is the microsoft way of "displaying" code as it was data.
This has been proven bad.

Re:Not more safe

[oatworm]

Except if the screensaver happens to have some other program attached to the installation package, it'll be installed with root privileges without you knowing about it. Once that happens, you're done - it can rename system files, replace existing system files with its own 'dirty' files, or do anything else that root can do (i.e. practically anything), including preventing you from ever uninstalling it. They don't call it a "rootkit" because it first came out on Windows.

Re:Not more safe

[visualight]

No.

Re:Not more safe

[NoobixCube]

If people start to charge in and use Linux without bothering to learn a few of the key fundamental differences between Linux and Windows, then there are two people who are to blame: the user who never bothered to learn, and the idiot who just threw an install disc at them and ran away. I honestly don't think a ten minute slideshow would be too much of a bother, and I wouldn't even have it run automatically. Just have it there in the home folder, and make sure people know about it. Even if only 5% of people look at it, that's 5% who might think twice before using their root password.

Re:Not more safe

[grumbel]

This particular malware is not because of a security problem with the OS

Wrong. The problem with the OS is that security is more an afterthought and not a core part of the design. There is absolutely no reason why a screensaver should have rights to meddle around with the whole system or even the whole user account, a screensaver should have the right to display pictures on the screen and nothing else, but you don't really get that level of control in an average Linux installation, let alone the frameworks to handle such security issues in a userfriendly matter.

A hell of a lot security issues would just disappear when third party applications would by default be isolated to ~/.appname/, their own application data and a few system libraries. You could even handle loading and saving in a safe manner when the load/save dialogs would be part of the OS and not part of the application, as that would allow to limit an applications access to the outside world to just those files the user explicitly selected, instead of leaving the choice to the application.

Re:Not more safe

[Anonymous Coward]

Right, like all the money users paid out to the programmers to develop the OS. Oh, wait, this is Linux, they didn't! That's the great thing about write once, copy many. If one person makes a patch and publishes it, EVERYONE gets it. For free.

Next FUD argument, please.

Re:Not more safe

[mlts]

Maybe a compromise would be to have multiple repositories in tiers:

A tier 1 repository would be packages that come with the OS, of known good quality stuff. gcc, the kernel, GNOME/KDE libraries, Open Office, etc. In RedHat, this would be stuff signed with the distribution key.

A tier 2 repository would be packages that have been vetted by an independant person, where the package had the source code examined and was built from source by a third party. Problem is that this takes time and lots of eyeballs, and time is money. Volunteers might help, but it might take an actual revenue stream to make this doable, most likely by donations and ad revenue. These packages would be signed by the independant distributor.

A tier 3 repository would be a free for all, have a disclaimer that you have zero clue what you are getting, so examine the source code. Signing would either be missing altogether, or done by the author.

The problem is that Linux historically has had clean repositories since its inception. It is very rare for someone to drop malware into the "food supply" of distros. People write a utility, post it on freshmeat, people toy with it, and if the program is good, the author may get some help, or it may become a distinct project in its own right. Its just not heard of for someone to write a Trojan in this fashion, even though its something that isn't a complete surprise.

Of course, we can go to a third party dedicated to vetting software, but then it becomes an arms race of who can write the most obfuscated code to get tricks and traps past the people viewing who might not be dedicated security experts and who might miss a pointer arithmetic error that later on down the line might give an intruder a backdoor.

Re:Not more safe

[Thinboy00]

My mother managed to get some nearly-impossible-to-remove scareware on her (Windows) netbook. She swears up and down that she never visited any sketchy sites, had AV (but no anti-malware), etc. She was basically using it for several things:
1) Visiting various newspapers' websites
2) Webmail (a dedicated server for her business)
3) Word processing (OpenOffice.org)
4) Spider Solitaire
5) A few online games (jigsaw puzzles, sudoku, presumably flash-based) she found on Google. I think this is the most likely vector, but she uses the same websites all the time.
6) Visiting certain reputable, ad-free (AFAIK) sites.
She is smart enough to never download/run/open suspicious programs/files/etc and she was using Firefox 3.5. This thing was able to prevent itself from being uninstalled easily. On Linux, she could have simply killed any offending processes (O.K. that's nontrivial, but no root permissions needed in theory) and check the (graphical, so-easy-to-use-a-caveman^H^Hgrandma-could-do-it) Gnome startup programs tool for suspicious entries. On Windows, we eventually had to use "System restore" (an OS feature) -- which the program could potentially have disabled had the malware author thought to do so (it was totally rooted -- the malware was preventing the installation of some anti-malware programs) and then download the anti-malware program that had previously failed to install. Windows Vista/7 are probably more secure than XP which she has, but I'm still reluctant to blame all Windows security issues on user stupidity. Now I have her running Firefox+NoScript so that it (hopefully) won't happen again, but that's mostly because she refuses to switch to Linux. Most users would be running IE7 or so... not Firefox+NoScript. This is clearly not just "user stupidity" -- it's a windows genuine advantage^H^Hbug.

Re:Not more safe

[visualight]

You're describing a non-problem.

User wants to install software that is not available in his or her distributions repository.
User files a bug report.
Other users file bug reports for other applications.
Users spent allocated votes on their favorite bugs.
Repository admins use bugs and votes to assist in prioritizing their work.

That's -one- obvious solution. Problems like this are childs play and are therefore non-problems.

Re:Not more safe

[Thinboy00]

There's also been some evidence of malware that triggers AV software on purpose, and acts as a distraction while the real dirty payload gets delivered silently elsewhere in your system. You are now fooled into thinking your system is clean because your AV caught the distraction virus, completely missing the real one that was also installed.

AVs don't get "distracted" -- either the real payload is detectable by the AV, in which case the distraction won't be successful since both will be found and removed, or else the real payload is undetectable, in which case you don't need the distraction at all, and as a matter of fact it hurts you by making user more security-conscious.

Re:Not more safe

[mysidia]

The worm's main code wasn't BSD-specific. It could infect 4BSD systems on DEC VAX machines, and Sun 3 systems. These systems bear no similarity to todays OSes

The worm's infection vector was a portable C stub though "11.c", and was OS-agnostic. It could "hurt" systems running other OSes, even though the main code would not run.

It exploited vulnerabilities in rsh, fingerd, sendmail, and attempted to crack weak passwords. Facilitated by the fact that "encrypted" passwords were publicly visible in /etc/passwd and valid usernames on one machine are likely valid usernames on other machines.

It was not a trojan.

Link: Although sendmail was the Worm's least favored attack method (it was only tried after all other attempts had failed), it too was a powerful method of intrusion. At one site in Utah, nearly 150 sendmail attacks were logged on November 2 alone.

The Worm takes advantage of a flaw in the TCP networks for Berkeley UNIX systems (used in sending e-mail). When the program was being designed, a DEBUG flag was included with it in order to facilitate testing of the program. One of the capabilities of this flag was that it allowed someone to send mail to a process, rather than a user account. Unfortunately, when the program was finished and compiled for distribution, this feature was never removed. ...

Re:Not more safe

[Anonymous Coward]

Except when it is on your phone, where you in reality give applications direct access to you wallet, then I would prefer one store with certified applications. And a system that makes sure that they are up to date.

Some people might prefer to be able to tinker with their phone, install whatever program they wish, double checking the program they are about to install is safe, making sure the 30 application they installed are updated. etc. But personally I don't want to spend my time on that.

Re:Not more safe

[Thinboy00]

I hate to reply to myself but reading again I see that the malware was not on any distro's repository so this doesn't affect my trust on them. Still I would prefer that there would be an easy way of installing packages without root access.

Probably a kernel module...

So, do you have a patch for that? No? Then stop whining that it doesn't exist. </sarcasm>

Go file a bug somewhere if you actually care.

Re:Not more safe

[oatworm]

What I call implicit (less explicit would more curate)is the way Ubuntu (may be other distros I don;t know, I'm a gentoo user)) uses it, yes you have to enter a password, But opening a terminal and typing "su" (or sudo for that matter) is more explicite. Meaning you won't do it just for pleasure, and therefore most likely you know what you're about to do.

True - opening a terminal is more explicit. It's also a good way to get inexperienced users to do things like sudo ./runnastyscript.sh because the installer documentation for their screensaver says to. Ultimately, you're just relying on security through obscurity; namely, the obscurity of the terminal to most non-tech savvy computer users. Besides, if you're double-clicking on an installation package, it should be rather explicit and obvious that you're trying to install something. Most users will do whatever it takes to install that software if they think they want it, whether it's typing in a password in a gksudo prompt or running a malicious install script from the command line.

Re:Not more safe

[Silent Node]

Malware doesn't need to exploit vulnerabilities in the software: it only needs vulnerable users. There is no way to patch that.

Correct, I believe we have a case of PIBCAK!

(Problem Is Between Chair And Keyboard)

Re:Not more safe

[visualight]

but I'm sure most people have downloaded packages from third parties for their desktop systems and run them without being absolutely sure they were safe.

No one I know does this, ever. You have to read forums on the internet to hear stories of people installing software from outside of their distributions repository or from large vendors (i.e. HP,Myricom,Mellanox, etc.)

Re:Not more safe

[digitalunity]

1. Anna Kornikova naked? Links plz.

2. Vista's UAC was a good idea, but they botched it badly. I can say this with some authority since I have been a long time Vista user.

My list of gripes with UAC is long, but here's the short list:

• Explorer notifies you that some actions require administrative rights BEFORE UAC pops up. This causes the user to be prompted multiple times for the same operation.
• UAC windows are pretty useless. It doesn't give you much information about what the application is trying to do - only that it needs admin rights.

That's my condensed short list, but it hits the high notes. I really wish Vista Home Premium came with the Local Security Policy snap-in so I could alter some things in there. I bet that would make UAC less annoying.

I like how Ubuntu manages admin rights with respect to making configuration changes and installing software. Its dead simple to configure too.

Re:Not more safe

[Anonymous Coward]

What might be a better idea is have a manifest of what TCP/IP access a program needs to have before it gets installed. For example, a Web browser would need access to ports 80 and 443 at the minimum, access to most TCP ports as the usual (since there are often sites that use 8000 or 8080), and at the maximum, other than the FTP data port, a Web browser never needs for a program to connect inwards to it (unless it has a built in P2P client.)

Make a standard manifest for installation, combine that with SELinux type of enforcement, and this would go a long way. If a word processor decided to connect to a remote site, unless it was explicitly given that permission on initial install or on an upgrade, it gets automatically denied, and the user doesn't get prompted. This prevents repeated dialogs asking for permission like older Windows "firewall" software or UAC. If the manifest doesn't say a a program gets access, it doesn't get access, no ifs, ands, or buts.

Of course, if a program gets updates (say the Web browser gets a P2P client) a new manifest can be shipped with it, so the user can confirm or deny that new form of access.

Re:Not more safe

[Anonymous Coward]

There's a program for OS X that does this already, called Little Snitch. Amazingly useful little piece of software.

Re:Not more safe

[oatworm]

The bigger issue here is that it doesn't matter if it can only hit the user profile. The user profile has access to their browser keychain, all of their documents, and anything else the user might use on a regular basis. If that disappears or is compromised, it's just as bad for the user as if all of the executables in /bin and /sbin were replaced with nasty rootkit doppelgangers. Unfortunately, there's not a whole heck of a lot you can do about that, save for initiatives like SELinux or effectively tying users' hands in their own profiles, neither of which they're terribly gung-ho about. Heck, users didn't like it when Vista asked if a user wanted to do something potentially dangerous - how do you think they'd feel if UbuntuHatooWare Linux said they couldn't do something in their own Documents folder?

Re:Not more safe

[Thinboy00]

sudo is a command. Not an account. Besides, if the user account has a poor password, then chances are that one of these is true:
a) The user and root accounts have the same password.
b) The root account has a different but similarly insecure password.
c) The user made a file with the root password:
    i) The file has mode 660, so all you need is the user's password
    ii) The file has mode 666, so all you need is nobody access.
d) The user somehow managed to get /bin/bash (or something similar) setuid (mode 4755).

Re:Not more safe

[santiagodraco]

Lack of technical sophistication absolutely does have plenty to do with vulnerability. To think that there aren't lot's of people out there who still don't understand when an email that looks to be exactly from your bank isn't safe, or how to even install protective software, or how to implement a good firewall, is irresponsible imo.

But my point is not to say that they shouldn't learn, absolutely everyone should try to learn how to practice safe computing :) No, my point is that the attitude that these people are "idiots" is itself idiotic.

Re:Not more safe

[Anonymous Coward]

On Linux, she could have simply killed any offending processes (O.K. that's nontrivial, but no root permissions needed in theory) and check the (graphical, so-easy-to-use-a-caveman^H^Hgrandma-could-do-it) Gnome startup programs tool for suspicious entries. On Windows, we eventually had to use "System restore" (an OS feature) -- which the program could potentially have disabled had the malware author thought to do so (it was totally rooted -- the malware was preventing the installation of some anti-malware programs) and then download the anti-malware program that had previously failed to install. Windows Vista/7 are probably more secure than XP which she has, but I'm still reluctant to blame all Windows security issues on user stupidity. Now I have her running Firefox+NoScript so that it (hopefully) won't happen again, but that's mostly because she refuses to switch to Linux. Most users would be running IE7 or so... not Firefox+NoScript. This is clearly not just "user stupidity" -- it's a windows genuine advantage^H^Hbug.

None of the supposed benefit of Linux you suggested is true if the compromised Linux machine is hosting a rootkit.

Re:Not more safe

[Thinboy00]

Probably / itself. Or else /etc and/or /boot .

Re:Not more safe

[Anonymous Coward]

Because any half decent malware will be able to circumvent that.

Re:Not more safe

[Thinboy00]

Linux sounds too good to be true. So does Firefox.

Re:Not more safe

[Thinboy00]

She never entered her password, how exactly would the program go about going from user to root privileges?

Re:Not more safe

[Anonymous Coward]

I'm pretty sure the term "rootkit" didn't come from Microsoft-land. Stealthy and nigh-impossible to remove malware can exist on Linux, just the same as it can on Windows. There just isn't much financial incentive to write such software yet, as there aren't as many unknowing or gullible Linux users as there are on Windows.

Re:Not more safe

[geminidomino]

Interesting. Is that a custom-rolled solution?

Re:Not more safe

[Anonymous Coward]

Did a quick google for "OS X Malware" and number 3 on the list was this. Please go do some reading little fanboy and leave us adults in peace.

Re:Not more safe

[Evil Shabazz]

Sadly, as right as you are, this is /. and you'll be lucky if your post ends up with a positive score. You echo my sentiments exactly on the security issue. The reason most malware is written for Windows is simple ROI math. Linux has almost no desktop home-user market share compared to that of Windows or even OS X. Additionally, those who ARE using linux at home are generally far and away more computer-savvy than the average Windows users. These two factors alone, code in the OS aside, would make linux significantly more secure. Your OS is only as secure as the person using it.

Re:Not more safe

[VoltageX]

The main problem is the sudo anything culture that has been created with Ubuntu.

Re:Not more safe

[pyrbrand]

Um, any remote code execution vulnerability allows a worm to propagate. There have been tons of those in nearly any OS. The question is whether anyone writes a worm to take advantage of it and what they did with machines they compromised. Client Linux is less of a target due to its low marketshare, but it's by no means immune: http://en.wikipedia.org/wiki/Ramen_worm http://en.wikipedia.org/wiki/Devnull http://en.wikipedia.org/wiki/L10n_worm

Server software tends to be a better target as there are a larger number of more powerful always connected machines to hit and provide the opportunity to induce secondary infections on clients accessing the server. Of course because of the high value of the target, it's not necessary to attack with a worm, simply hacking a single server can be worth it: http://it.slashdot.org/article.pl?sid=08/01/24/1930207 http://www.symantec.com/security_response/writeup.jsp?docid=2002-091311-5851-99

Re:Not more safe

[SanityInAnarchy]

The funny part is that I have heard of this happening with hardware -- wasn't there something about iPods having Windows viruses?

But I've still never seen it done in software.

Re:Not more safe

[Anonymous Coward]

Really? Seems like preventing the installation of software not in the Ubuntu Software Center would resolve this kind of thing quite nicely..

Re:Not more safe

[Evil Shabazz]

Faulty logic. If "anyone" can fix it, so too can "anyone" get in there and break it. It's much harder for me to go in and make my Windows computer less secure that it would be for me to get in and do the same to my linux box.

Re:Not more safe

[SanityInAnarchy]

There are other safe places to get win32 software... for example, Sourceforge has a great deal of what's available in your distro's repositories.

And how does SourceForge sign the Windows binaries? If nothing else, packages from a repository are all signed and approved by the people running the repository.

For that matter, does SourceForge actually police its hosted files with anywhere near the rigor with which a public repository is managed? What's stopping someone from putting up a Linux version of BonziBuddy on SourceForge? It could even be open source!

Re:Not more safe

[Runaway1956]

You're tossing around all the wrong numbers. The important numbers are, 85% of all Windows users are ignorant lamers, while less than 10% of all Linux users are ignorant lamers. The obvious conclusions is that Windows has the market share on idiots, malware writers, clueless wonders, backdoors, and more.

Think about it. The totally clueless non-tech can't even INSTALL a .deb. The guy with only a clue or two, but no real ideas can only install a .deb if Gdebi has been installed.

There was mention of a screensaver, right? We should take a poll. How many people bother to install a SCREENSAVER? If someone wants me to install their rootkit, they had better be offering something more serious than pretty colors on my screen. All of my machines have a black screen for a screensaver. Why waste Boinc cycles on something that I'm not even going to use or look at?

Re:Not more safe

[inode_buddha]

There is. You can simply install it into $HOME/username/bin. That way, the worst that could happen is it trashes your home dir.

Re:Not more safe

[Rockoon]

Users filing bug reports? Then users vote? Are you serious?

You are seriously underestimating the scale of the windows ecosystem. You currently have thousands of application in your primary ecosystem. Imagine hundreds of millions of them. Thats right. Hundreds of millions.

Re:Not more safe

[i.of.the.storm]

I don't think the problem is that the screensaver had malware, but rather the .deb did. If you give root access to a .deb installer, it can do anything. People just expect to need to give root access when installing stuff, even if it's not necessary. But I might be wrong about this, and I'm not a "heavy duty programmer" either.

Re:Not more safe

[BitwiseX]

All it shows is that Linux is vulnerable to trojan horses. ALL operating systems are vulnerable to trojan horses. When you show me a Linux or OS X computer that's vulnerable to something like the slammer worm, get back to me.

EXACTLY! I think it's safe to say that every person that is replying to this thread would have fallen for this. Admit it. I would have if for some reason I wanted to download a new screensaver.

Kinda scary..

Re:Not more safe

[visualight]

I don't believe you. Even if reality is within an order of magnitude of 'hundreds of millions' I feel comfortable asserting that 99.99% percent of that is crapware that no one would ever need on Linux. You can test this assertion by going to where you go to find hundreds of millions of applications and finding that the functionality found in them already exists in repositories and/or are already included in a standard installation.

Re:Not more safe

[jpmorgan]

My mom almost got infected last week. She went to one of the news websites (major TV network), who had a malicious ad banner. The banner redirected to a scam website which did the whole 'pretending to be an antivirus' shtick, and tricked her into downloading a trojan. The only thing that prevented her from actually infecting her own machine was the antivirus software. I don't blame her, those scam sites can be pretty scary for the casual computer user, who has been fed a lot of fear about computer viruses over the past 5 years.

So yeah, just because a user 'never visits any sketchy sites,' doesn't mean they aren't going to get directed onto a scam site and infect themselves.

Also, your logic, 'I can't think of any other explanation than X, so it must be X,' sucks. Proof by lack of imagination is terrible.

Re:Not more safe

[Anonymous Coward]

ALL operating systems are vulnerable to trojan horses.

Not all. It's possible to design a pretty well functioning operating system that even allows installing new software, but isn't vulnerable to trojans. The new software probably will be slightly limited in what they can do, but all normal types of programs should work fine. I think OLPC's Sugar at least attempted something similar to this.

Re:Not more safe

[Waffle Iron]

I was going to comment on your post, but I've set my system to allow the browser to send only 100 cha

Re:Not more safe

[Runaway1956]

I've installed a number of programs as "User", without root access. Download an alpha or beta of Firefox, extract it onto your desktop, and run it. It works fine. No system changes at all. You have a problem with the alpha? Just send the entire folder to the trashbin. No problemo.

Got a program that requires root access? DON'T INSTALL IT, unless it comes from a trusted source.

Now, we are at the point where we have to define "trusted source". Prior to reading this story, I would have thought that Gnome-look was a trusted source. After reading this story, and seeing how Gnome-look handled the problem, I guess they are still trusted. Seems they took all the right steps when they learned they were hosting malware. But, trust has been eroded some. I'll stick to my distro's repositories, thank you.

Re:Not more safe

[jpmorgan]

If you really believe people wouldn't blame it on Windows, you must be new here.

Re:Not more safe

[mr exploiter]

I hate to reply to myself but reading again I see that the malware was not on any distro's repository so this doesn't affect my trust on them. Still I would prefer that there would be an easy way of installing packages without root access.

Probably a kernel module...

So, do you have a patch for that? No? Then stop whining that it doesn't exist. </sarcasm>

Go file a bug somewhere if you actually care.

Very clever </ sarcasm>
I won't install any screen saver that needs a kernel module. Whay I'd want is an easy way to install ALL the packages that can be installed without root access to do so. As easy as apt-get install xxx but as a normal user.

Re:Not more safe

[FlyingBishop]

lsof only shows current access. What he's talking about is logging built into the network drivers that shows which processes access the network.

And it's a good idea.

Re:Not more safe

[kenshin33]

Again no. it's not security through obscurity. (obfuscate means of getting privileges so that users are confused and never use them). it's rather security through education. by appealing to the curious nature of people (make it not so obvious so that people will say how can I do it? and why is like this?) on top of other means of educating end users. Opening a terminal an typing commands is cumbersome. steering that way on the long run will push people to "try" know more .. thus reducing the risks. I for one learned that way (curiosity). And frankly, apart from the occasional system maintenance (system updates, new hardware ..etc) that comes from usually trusted sources, one doesn't require root privileges. new software, shiny fancy new screen saver? anything can go into you home directory and for that no need for sudo or su.

Re:Not more safe

[jpmorgan]

Relying on the repository model for security, is relying on independent package maintainers (assuming the maintainers ARE independent) to do code reviews to find malicious code that the author didn't want to be found.

Now in reality, when package maintainers are INTRODUCING massive security flaws into critical software (*cough*OpenSSH*cough*), I really don't think that repositories are a panacea.

Re:Not more safe

[Ian Alexander]

1. Something like a screensaver does not need root privileges to install, it can be unpacked to the user directory with just user rights.

FTFS:

'Malware has been found hidden inside an innocuous 'waterfall' screensaver .deb file

Idle question: how accurate is it to describe a screensaver as "innocuous" if it's been infected with malware?

Re:Not more safe

[kenshin33]

the above being said, the whole point of the post was in regard to this "and any OS can't protect against that unless it's totally locked down". Most Unix/linux (OS X included) system are kinda locked down by default. upon install there is the user "root" who has all possible privileges (over the system) and normal user who has none. which reduces the risks of nasty things happening to the system (requiring a re-install). In contrast, for windows, the default account upon install has admin privileges.

Re:Not more safe

[adonoman]

That way, the worst that could happen is it trashes your home dir.

Barring, of course, escalation of privilege vulnerabilities, or easier - just hanging around and running a user-land spam relay - how often do you check what's running?

Re:Not more safe

[yuhong]

Well, I imagine Microsoft decided to bring the NT security system into their mainstream line of OSes for a reason.

Actually they began to try and merge the 9x/NT lines with 2000, but then there was one last 9x release with new features called Me and so the work was not finished until XP, with XP they ended up spinning the server line off and after several enhancements to XP was added to the codebase, MS released it as Server 2003. Later they decided that Vista SP1/Server 2008 and later would be based on the same codebase.

UAC is needed to convince people not to run as an admin all the time, because using earlier Windows versions as a restricted user was very difficult without being a sysadmin with extensive knowledge of Windows administration.

Not really, adding a non-admin user was quite simple if you know how. But many were too lazy to even do this (including me). But compatiblity was an issue, and I'd add that NT 3.5 was released a full year before Win95, and MS made it mandatory that "Designed for Win95" apps also have NT 3.51 compatiblity with exceptions relating to things like DirectX. So I'd wonder why people did not test non-admin on NT 3.51. As I remember, even MS's own Office 95 screwed up here.

Re:Not more safe

[sqlrob]

Flamebait? Come on, it's the reality of the situation. Just because anyone can doesn't mean anyone *should*. Getting security right is hard, it's incredibly easy to make mistakes that don't look like they do anything horrible but destroy any semblance of security. Debian learned that the hard way. OpenSSL screwed up, they shouldn't have used uninitialized memory (furthermore, on a secure system, that hack makes things *less* secure), but the fix wasn't as easy as the one Debian did.

Re:Not more safe

[Runaway1956]

You are referring to "Security by obfuscation". How has that worked out for the world banking system? How many billions has it cost over the last decade?

Re:Not more safe

[Runaway1956]

Your village called. They want their grammar nazi back.

Re:Not more safe

[psithurism]

am happy with 25,000+ programs available in Debian repository, I never install random package from the Internet.

I'm a Linux zealot. And I am not happy with just the 25,000+ programs available in the Debian repository, so I do install random packages from the internet! And my girlfriend? A Linux convert, but unfamiliar with it and until recently unacquainted with apt-get and used to (try to) install two or three third party programs before I found and installed the repository mimic.

Just say'en: the straw Linux zealot he discusses exists.

Re:Not more safe

[Runaway1956]

The repositories are MOSTLY 3rd party applications. Really. Linux itself is just a kernel. It's actually 3rd party to Debian. Gnome is a 3rd party suite of applications. Open Office is 3rd party. etc ad nauseum. Debian is little more than a philosophy, a way of making all those 3rd party apps work together.

Raising the bar? At this point in time, unnecessary. No distro has been found to be harboring malware in their repositories. Want to write a Debian specific screensaver? Write it. Submit it. If people like it, they may well put it into the Debian repositories. If it's good enough, someone will port it to Suse, Redhat, and others. If it's REALLY good, someone may even port it to Windows and Mac. This is precisely the same bar that Firestarter had to clear - and Firefox, and NetworkManager, and - well, you get the point.

It's always been a good idea to avoid 3rd party software from OUTSIDE the repository. TFA helps to make that point.

Re:Not more safe

[Anonymous Coward]

You don't think a root-privileged piece of malware on *Nix couldn't have prevented itself from being terminated? You surely are naive. The only reason the malware was hard to remove on windows was because it was designed to be so. I am sure if someone went to the effort of crafting malware that could hide itself by say; modifying all the programs you have currently that list running processes perhaps.
I can terminate any app on a windows box I'd like right now (process explorer - free tool now owned and distributed by MS).
And all of these solutions I see being: "Linux can be patched by anyone" doesn't make it safer. If there was higher desktop market share, and 6000 "fixes to a malware problem", who is to say that a different malware author doesnt write his "fix" and submit it. It might not go to the great tree in the sky (nix equivalent of patch tuesday once it has been checked out) but all it'd take is one sloppy blogger not to check it; and say: "This is the solution that someone I dont know came up with INSTALL NOW" and then every reader of the blog to go: "Oh that will make me safer!" and now they have TWO problems.
Look; MS / windows has its problems. But assuming that being able to modify your own software immediately overcomes them is a complete failure of logic.
Remember, if a malware author can write malware, a malware author can write patches for vulnerability. As soon as that happens, you'll end up with the only solution that works. Microsofts Patch Tuesday, that accepts patches from "trusted" sources, and QA tests them all before releasing them.
*shakes head*

Re:Not more safe

[Runaway1956]

Debian's scheme doesn't precisely match your definition, but it's kinda close. As is Ubuntu. You have to take some definite steps to enable repositories outside of your distro's "supported" applications.

Re:Not more safe

[pizzap]

Traditionally linux also an multiuser system and imho has a more secure architecture. But yeah, desktop linux is executing way to much foreign, unsigned, unchecked code nowadays.

Re:Not more safe

[Runaway1956]

No. Gnome-look is not an approved repositiory for Debian, Ubuntu, or any other distro.

"Eye candy for your gnome desktop". Basically, it's a gnome fanbois site.

Re:Not more safe

[Fractal Dice]

That's not the lesson I see. To me it says that a user-based security model are insufficient - apps are too free to call/use each other - the threat has moved from "rooting a box" but rather to "rooting a user". OSes (and users) need to start looking at the user as a system administrator of many threads of personal data.

Web browsers have already discovered much of this - different tabs on your web browser are like different apps and just as a sysadmin cannot trust all the users to play nice with each others' data, users can't trust different apps with full access to all other apps.

Re:Not more safe

[tftp]

And it's a good idea.

That can be relatively easily built on top of netfilter libraries. But IMO the usefulness of this product would be fairly low, just as it is low for comparable products on Windows. For example, there are TCP connections made by the /tmp/dhcp-client process, what does it mean to a *normal* user? "All is well," that's what it means to them. What if you see a /usr/bin/wget opening an HTTP connection? Do you recall using wget a week ago, or perhaps it was some evil script? Mere logging of past events is tedious to review and ineffectual, just like installing an alarm at your barn to wake you up after the horse is out.

First of all, you want to prevent connections made by malware, not to register the fact hours or days later. It doesn't take long to archive and upload your personal documents (bookmarks, Firefox's saved passwords, ~/{.ssh,.pgp,.gnupg}, etc.) You want that prevented entirely.

Currently firewalls (like iptables) do not guard against rogue processes; the whole box is trusted. I don't recall any iptables rules where you could conditionalize it on a process. And how do you identify processes to begin with? The binaries are not signed; process IDs change; names are arbitrary. To do it right you need to design these features into the OS, so that each process can be identified whenever necessary. I believe SE Linux is all about it.

So if there is a way to bring some sort of a reliable process tag into iptables, that would be probably good enough. Next you only need to make sure that malware can't use your legitimate apps (like the browser) to proxy their evil requests; that requires killing whatever automation there is (command line URLs, for example, and no more wget.)

If that happens then there is a hope of having a system where only whitelisted apps have Internet access, and all other are either locked out of the network completely, or restricted to your LAN. Then in the worst case the malware can only delete your entire $HOME.

Re:Not more safe

[Runaway1956]

FFS - define "many". If "more than two" means "many" to you, then yes, there have been "many" worms written for Linux. Now - how many WORK?

Re:Not more safe

[inode_buddha]

Actually, I check things daily. It would be pretty hard to get root from my home dir anyway, given things like selinux and apparmor, and just plain good sense. There are other ways also to lock things down so that not even root can do much without physical access and a boot disk.

Re:Not more safe

[Anonymous Coward]

There is zero difference between open source and proprietary software to 99% of end users who don't even know what a compiler is. Those of us who do are not going to dive into a program of a few thousand lines that we are unfamiliar with to find some likely obscure bug that only occurs on the second Tuesday of the month in years divisible by three and the reason this occurs is because of a buffer overflow when the application receives information on an API that failed to remove a trailing space.

What nearly all of us will do is wait for the program (open or closed source) to be patched and posted in the repository or on a webpage then install the fix.

If bugs were so trivial to fix then why do they still exist?

Re:Not more safe

[sopssa]

http://en.wikipedia.org/wiki/Linux_malware#Threats

Re:Not more safe

[icebraining]

How to Set Up and Run Firefox 3.0b2 as a Different User in Ubuntu.

So spreading *can* matter.

Re:Not more safe

[GNUALMAFUERTE]

That is not true for a very simple reason:

GNU/Linux is used on over 60% of the worlds server. 90% of the worlds supercomputers run GNU/Linux. Off course, many of those servers have qualified sysadmins, but many doesn't Actually, MOST doesn't. Most are default installs running the Sendmails, Apaches, Asterisks and Sambas of countless organizations. And they don't get broken into everyday. They run flawlessly for years. If you check the logs of any GNU/Linux machine with a public IP, you'll see thousands of attempts every day, ranging from SSH bruteforce attacks, to carefully crafted screens trying to exploit Apache. But they hold up. GNU/Linux HAS an architecture. You might like it or hate it, but it has one very clearly defined architecture, and it works. Windows has NO architecture. Think about the UAC exploits for Windows Over 9000 that have been there since the first beta and never got fixed. Theres no public specifications, no design, just a pile of files mysteriously binded together. That'll never be secure.

GNU/Linux isn't perfect, and no system is absolutely secure, but it's reasonably secure, and, specially, it's well designed and well documented. When you sit into a GNU/Linux machine, you know what to expect from it. You know what it's doing, and you can clearly configure it's behavior.

Re:Not more safe

[SpaceCadets]

"They could have gotten root if they wanted." Sure, sure, that's what all the geeks say. :P

Re:Not more safe

[Anonymous Coward]

But, this was a screensaver. A screensaver by nature is an application, so unless you have forced sandboxing for them (I'm not aware of any such system) then a screensaver is always going to be able to install whatever junk it wants (as the nonprivileged user).

Re:Not more safe

[Arker]

And even so, if the vulnerability is in lets say flash, just anyone or distros can't fix that closed source application.

Which is why flash has no place in the GNU OS.

Re:Not more safe

[Intron]

The idea behind it is so that someone will put out a patch for said vulnerability without having to wait for parent company to do so....

It turns out that I have patched a serious vulnerability in Linux. Please download and install my patch as root on your system.

Sincerely,
Someone

Re:Not more safe

[Runaway1956]

11 is more than ten, so apparently, "more than ten" satisfies your definition of "many".

So - how do we define Windows threats, or more specifically Windows worms? I'm sure that even non-tech savvy people can name ten famous Windows worms. How many have there been? http://en.wikipedia.org/wiki/List_of_computer_worms

Perhaps the most important question is, "How successful have the worms been, and which have been most costly?"

How many billions of dollars have been spent on Windows security, only to fail repeatedly? I'm primarily looking at Corporate and Enterprise Windows users - but it affects private home users as well.

In my own experience, keeping 3 Windows machines running for family use was nearly impossible. 3 months use on any given machine guaranteed SOME KIND of real problem. Keeping 3 Ubuntu machines up and running is a piece of cake. I've just recently upgraded the wife's 32 bit machine to Karmic, after two years of continuous use. This past weekend, I upgraded the gateway machine, after ~30 months of continuous use. One more machine to go, with ~18 months continuous use.

What's more, I have given SUDO privileges to the wife, and all three sons on all the machines. They CAN destroy the OS any time they choose.

One laptop in the house has Windows on it. It gets reformatted pretty often. Even a moderately tech savvy kid can't keep it up as reliably as he can keep Linux running.

Re:Not more safe

[MobileTatsu-NJG]

Not by anyone intelligent.

There are a lot of people on this site you just smacked with this comment. Heh.

Re:Not more safe

[Blakey Rat]

FFS - define "many". If "more than two" means "many" to you, then yes, there have been "many" worms written for Linux. Now - how many WORK?

The same number of Windows worms that work in up-to-date copies of Windows.

Re:Not more safe

[Blakey Rat]

Two obvious problems:

1) Nobody will ever check the list. Hell, for all I know, it already exists exactly how you described it and I've just never checked it. :)

2) If the virus/worm manages to obtain decent access, it'll just delete itself from the logs anyway.

Oh and a third:

3) Like your web example, malware could easily just do its work using other applications on the computer. I mean, the basic GNU toolchain alone can do all kinds of dastardly acts and the malware's PID would never show up.

Re:Not more safe

[phantomfive]

If you want Linux to grow and reach more people, as opposed to being a geek niche,

I don't.

For me, Linux is the perfect operating system for a programmer. I'd like it to stay that way. If it becomes popular, that's fine; but if it becomes something other than a programmer's operating system, I will switch to BSD or something.

Re:Not more safe

[Artifakt]

Three pieces of evidence. So long as windows uses a consolidated registry, every security violation that relies on the registry's existence has no analog on other systems. Linux, Snow Leopard, Google OS or whatever could become dozens of times more common and windows share could shrink to where Microsoft is the small minority vendor, and the count of registry exploits will remain disparate.

Re:Not more safe

[RMS Eats Toejam]

And that's fine, you smug asshole, except you to make an effort to keep it that way. The next time another god damn Linux zealot starts foaming at the mouth about how AWESOME Linux is, then you need to get off your fat, lazy ass and tell him to shut the fuck up on behalf of the rest of us.

Re:Not more safe

[Hucko]

That is probably not a bad Idea. If apt is called without user rights automagically it is installed per user. Is there a reason this hasn't been done?

Re:Not more safe

[RMS Eats Toejam]

In my experience people who use the word "zealot" lack arguments.

You're lying. You just don't like being called out. A zealot is one who seemingly dedicates his or her life to spreading a belief or argument. Such a person is rarely objective and is incapable of dealing with rational arguments. Any criticism of their belief, no matter how valid or logical, is completely useless against a zealot. Linux has plenty of them. Ashamed of it? Then do something about it. Pretending they don't exist is a bullshit game that nobody is going to buy into.

Re:Not more safe

[Anonymous Coward]

"Registry exploits" appears to be something invented by your small defective brain.

(Only relevant hit on google is about the remote registry service, not something which is typically exploited.)

Re:Not more safe

[randallman]

I wish dpkg would allow local installation without root privs. It would be a better option for installing .debs from 3rd party sources and would prevent malware from modifying rc scripts and such. Malware could still run to some capacity, but it'd be a step in the right direction.

Re:Not more safe

[Stan92057]

There are no patches for social engineering

Re:Not more safe

[eggnoglatte]

You are kidding, right? That screensaver runs as root, and could have pulled who-knows-what from the web and installed it wherever it likes.

Re:Not more safe

[Anonymous Coward]

It can't send spam because port 25 requires root access.

Re:Not more safe

[cynyr]

I would like to think that anyone motivated enough can become a "tech savvy programmer type".

Re:Not more safe

[the_womble]

If you want Linux to grow and reach more people, as opposed to being a geek niche, then you should forget about requiring people to have the skills necessary to patch the source.

Not every user needs to do it, but that every skilled user can do it AND they can help everyone else by doing so: one person in a big organisation can create a patch that can then be applied to all their machines, a package maintainer can apply a patch and tens of millions of people using the same distro will get it automatically, etc.

Re:Not more safe

[jhol13]

Linux doesn't follow some common Windows security pitfalls

Eh? It took far too long for NX to be admitted into kernel, as if software has no bugs NX does not help.
Linux does have autorun, it just asks "are you sure". We all know how this is going to end up.

So not exactly same pitfalls as Windows, but very similar. IMHO too similar: just follow Debian security mailing list and you will notice soon that the number of security holes is not going down.

OK, now let me put some truth into the conversation.
1. Linux market share matters, a lot. But then again I have had over ten virus and antivirus free years and most likely will still have some.
2. Not all OS's are same. Capabilities, chroot, jail, zones, virtual machines, sandboxes and managed languages, NX, etc. should be used much more. IE8 is interesting, as are e.g. Chrome and Lobo browsers. This all was started by OpenSsh "privilege separation".
3. Linux is not ahead of virus writers. No OS is.
4. In last few years Windows have catched up and even surpassed Linux in some areas. Not all, and looks like it won't in the foreseeable future, but who knows.
5. You can protect your machine against stupid users (see second point). Quite well, actually, it is just matter of priorities. But in no OS is security #1.
6. Getting root is not necessary. Reinstalling Linux takes half an hour, reinstalling all my documents takes eternity (how do I know my backups are not infected).
7. As long as there is money to be made, viruses will be made. Or power (intelligency agencies).

Re:Not more safe

[angelwolf71885]

just like a computer is only as fast as its slowest component an OS is only as secure as its most stupid user and judging by the i love you virus we are all doomed

Re:Not more safe

[_Sprocket_]

This just shows that if Linux had 95% marketshare on desktop, and Windows 0.5%, it would be the same thing but just turned around.

You've managed to extrapolate all that from once single incident? You should get your resume in to Gartner fast. Although you might want to keep in mind that this isn't the first malware to target Linux. And we've already seen about a decade of doom-and-gloom analysis predicting a malware apocalypse for alternative platforms.

Sure - this should be (yet another - albiet likely the first for many who missed the earlier ones) wakeup call for those who fool themselves in to thinking that said alternative platforms are proof against malware. But let's not swing the other direction by waving off the issues as merely numbers. Market share certainly plays a roll but it is hardly the only factor that makes a target attractive.

Re:Not more safe

[Anonymous Coward]

How is it harder to remove a screensaver on Windows than on Debian?

Re:Not more safe

[_Sprocket_]

But how much Windows malware just hangs out in the confines of the user? There certainly seems to be a lot of value in elevated privilege otherwise successful malware examples wouldn't bother with it.

Re:Not more safe

[StuartHankins]

If you don't understand the distinction between the security models that Linux and Windows employ, you might want to do some more reading. I don't know who modded you insightful when it's pretty obvious you don't have any idea what you're talking about.

To break it down a little for you, when a user installs something manually and introduces a vulnerability, that's quite different than an open-by-default service and/or built-in web browser (IE) allowing something to be installed without user notification or warning.

I use Windows, OS X and Linux daily at work and based on your previous comments you should be calling no one a zealot except yourself.

Re:Not more safe

[mjwx]

Open source or not, you can't fix that unless the whole system is totally locked down like iPhone

No, even the iphone has vulnerabilities. Locking down a system does not fix vulnerabilities, it only hides them from public view. An open system is more secure as everyone know when a vulnerability is discovered and syadmin's can make work arounds (or even pull the system down) until a patch is developed. With a closed system there is less chance of an exploited vulnerability being discovered by the people who want to fix it or are affected by it.

Re:Not more safe

[Anonymous Coward]

Devils Advocate: it's far, far easier for me to fake a sudo prompt than a UAC prompt.

Re:Not more safe

[StuartHankins]

Personally I don't care if Linux is ever employed by the "average person". I'm not one of those people and the work I do requires people who know what's going on. Linux gives me the fine control to get in there and tweak things that Windows will probably never have.

You can make a machine smarter, but people keep getting dumber all the time. At some point you just have to say to those people forget it, you're not going to learn, you're not worth trying to explain it to. Here's your Etch-a-Sketch.

Re:Not more safe

[_Sprocket_]

Yeah, but now that the malware was created, it shouldn't be long before for someone prevents another screensaver from doing this again... that's what I was getting at.

Even if it isn't patched immediately, a Linux screensaver has lower potential of screwing up the entire system folder with it's payload.

It wasn't an issue with screensavers. It was part of the install scripts that are executed as root as part of the installation procedure for a Debian package - pretty common.

Re:Not more safe

[StuartHankins]

Or those of us who finance those programmer types. I may be a lot of things but I'm not an expert at tweaking kernels or rewriting MySQL. There are people who do that simply because we pay them.

That's a HUGE difference from a closed, proprietary system where no matter what unless you're the 800-pound gorilla and can strongarm yourself into a copy of the source you can't fix the problem even if you totally understand it.

Re:Not more safe

[StuartHankins]

Guess that depends on what the malware does.

Re:Not more safe

[StuartHankins]

Have you considered a nightly job to rar your home folder on each machine and rsync it somewhere else? That's what I do; you can delete my entire home folder anytime you like and while I may lose that day's work I have 3 weeks of nightly backups on tape, and last night's live copy on at least 2 other servers. But then again I'm a programmer and my code and documents are very important to me so I can justify the trouble of setting this up.

Re:Not more safe

[mjwx]

While I'll agree with you that Mac/*nix are not any more secure than Windows, the Mac/*nix users have been taught to take a sudo prompt seriously,

You have a point about Linux/Unix users but not Mac users. Mac users have been taught that their operating system is inherently superior and completely invulnerable. They will click through sudo prompts with the same glee and wanton disregard as the most clueless of windows users. This is why the first thing I did to the Mac users at my last job was take away their Sudo rights.

The vast majority of Mac users are technologically clueless, remember that the mac users on /. are not representative of the Mac community at large, most of them are graphic designers or related fields (journalism, Corporate Communications (fancy title for marketdroid)) and do not posses much knowledge on computers in general.

Re:Not more safe

[timeOday]

The registry alone makes Windows impossible to clean. Who knows what is in there? It's a bunch of gibberish. Please nobody claim it's the same as /etc, because it isn't. At best the registry is /etc's evil twin.

Re:Not more safe

[shentino]

I'd say in that case that MS needs to grow a pair and cert-flunk any application that needlessly requests admin privileges.

Re:Not more safe

[mysidia]

What part of "Windows default registry permissions are open widely enough for Power Users to elevate themselves to Administrators" don't you understand?

Also, don't you think Windows XP's Compatibility mode is inherently risky?

Programs will be run based on their name, in a mode where they can make low-level calls...

Re:Not more safe

[Anonymous Coward]

Not true - the scanning is halted when a virus is detected andt the user processes any prompts.
This allows a window of opportunity for a 2nd attack vector to do something useful.

Re:Not more safe

[Anonymous Coward]

This is reported to be a .deb file. The only way to install such things is with root level privileges. That means that this particular one will NOT only affect one user.

Re:Not more safe

[vadim_t]

I didn't say anything about a panacea. But, so far, given the choice of getting ssh from some random place on the net or the ubuntu repository, I'd say the ubuntu repository is more likely to contain a good version.

Ubuntu has considerable pressure on it to keep a good repository, while anybody can take putty, add a trojan into it, and try to get a good enough pagerank to trick some people into downloading it.

Re:Not more safe

[bendodge]

Disclaimer: I'm a tech at a work a computer repair shop.

Let me guess: she was running as root. This scareware deleted mbam.exe as soon as the installer unpacked it, and/or had a little icon by the clock that popped a notification balloon every time you started a process saying that it (even taskman) was infected with $SCARY_VIRUS_NAME and killed the process.

Since the middle of October, we've had a wave of clients with this stuff, many whom are running the best AV's (we sell NOD32) and have no idea how they got infected.

Different techs have different favorite ways of removing it, but my personal technique is to create another (limited) use account and start the MBAM installer from there with elevated permissions (using Run As). TADA!

I don't know why the scareware runs with your account permissions, but it sure makes it easy to defeat.

Re:Not more safe

[vadim_t]

Eh? It took far too long for NX to be admitted into kernel, as if software has no bugs NX does not help.

Similar functionality was available in grsecurity long before. Most distros don't ship the vanilla kernel anyway.

Linux does have autorun, it just asks "are you sure". We all know how this is going to end up.

No, it doesn't. Ubuntu will ask things like "Would you like to see the files on this CD, or download photos from it?", but that's not autorun. What I was referring to is running binaries from newly inserted media. AFAIK no Linux distro does that, even after asking.

1. Linux market share matters, a lot. But then again I have had over ten virus and antivirus free years and most likely will still have some.

IMO, antiviruses are a flawed security model and shouldn't be needed in a well secured system. Antiviruses only work against known threats, which means somebody must have got hit by them previously, and the antivirus vendor must have noticed.

It's much better when the system makes a virus' execution unlikely enough that it doesn't manage to spread.

2. Not all OS's are same. Capabilities, chroot, jail, zones, virtual machines, sandboxes and managed languages, NX, etc. should be used much more. IE8 is interesting, as are e.g. Chrome and Lobo browsers. This all was started by OpenSsh "privilege separation".
5. You can protect your machine against stupid users (see second point). Quite well, actually, it is just matter of priorities. But in no OS is security #1.

That doesn't add up. If there is such a thing as an OS that's better protected, some of them are better and some are worse protected, therefore one of those is #1, or at the very least there are security tiers, where some are definitely worse than others.

3. Linux is not ahead of virus writers. No OS is.
6. Getting root is not necessary. Reinstalling Linux takes half an hour, reinstalling all my documents takes eternity (how do I know my backups are not infected).
7. As long as there is money to be made, viruses will be made. Or power (intelligency agencies).

You seem to be intent on assuming I'm arguing there's such a thing as 100% effective security. But I'm not. I'm arguing that there's such a thing as better security. Linux can be more secure than Windows, while still being vulnerable to some things.

Also, IMO, that a virus can be technically written for Linux isn't very relevant. The important thing isn't whether it can be done, it's whether it will spread. If it won't spread it'll never be a credible threat, and will remain an academic exercise.

Re:Not more safe

[JDeane]

I check my Comodo firewall logs all the time for this information, although I am 100% sure that if some one wrote some good malware it could hide itself from my firewall... I just hope that my antivirus or antimalware is good enough to catch it if it does.

This is one area I see windows ahead of Linux, it sounds backwards since Linux at its base is more secure... but that just makes it easier to get caught with your pants down. If you think your safe thats the first step in getting owned. Be paranoid.

If you think Windows is secure then your gonna get a rude awakening one day. (any OS is only as secure as its user)

Running a newer version of Windows helps in the security department, ASLR on 7 is pretty solid and makes writing malware that much harder and in theory should make buffer over flow exploits a thing of the past.

Windows reminds me of that movie "War of the Worlds" "From the moment the invaders arrived, breathed our air, ate and drank, they were doomed. They were undone, destroyed, after all of man's weapons and devices had failed, by the tiniest creatures that God in his wisdom put upon this earth. By the toll of a billion deaths, man had earned his immunity, his right to survive among this planet's infinite organisms. And that right is ours against all challenges. For neither do men live nor die in vain."

Re:Not more safe

[Anonymous Coward]

AVs don't get "distracted" -- either the real payload is detectable by the AV, in which case the distraction won't be successful since both will be found and removed, or else the real payload is undetectable, in which case you don't need the distraction at all, and as a matter of fact it hurts you by making user more security-conscious.

Right, but people do get distracted.

"Oh good - my antivirus software caught the virus that came with the dodgy piece of software I just downloaded. Now that it's taken care of the problem, there's no reason for me to investigate more thoroughly."

Granted, the average user probably wouldn't have gone looking in the first place, but the point stands.

Re:Not more safe

[Casandro]

The point is, the malware has been found, it will be taken out of the repositories and there won't be any new infections.

Under Windows you have millions of malware sites, and even after they have been found, they won't get shut down.

What we have here is malware in some obscure repository most users wouldn't even be able to access.

Re:Not more safe

[waveclaw]

Not everyone can scour the source/binary of every app they get from a 'trusted' site.

At least someone inspected this package. The malware was found, after all. Besides, expecting everyone to scour everything is a Red Herring.

And if you cant trust the 'trusted' sites for the free stuff, then the entire FreeOS movement is dead in its tracks.

At some point you have to trust. Not 'click yes on pop-up warning number 300 for the day' trust but 'these packages are signed by so-and-so who I trust.' Or to put it in words that the corporate world uses: 'signed by so-and-so who I blame.'

A bigger white elephant in the room is Unix-style OSes that do a good job of securing the OS from damage by users, but still let the user completely wipe their own home directory out. I don't really care that this screensaver I download and put in ~/whereever can't mess with anything else in the system. All it has to do is ruin ~/. As they say, that's where I keep my stuff.

Re:Not more safe

[CAIMLAS]

You're being intellectually insincere here.

This was not an 'infection' unless the user typed in their sudoer password for the program to be installed. A system 'infection' requires that the system has a resident program running, from boot. A process running as a user would only be able to be launched once that user logs in.

Yes, it's true that Linux malware problems are marginal to non-existent compared to Windows, quite probably in large part due to market share. But that is not the primary reason, by any stretch of the imagination. When you consider how many servers run Linux, you'd think there'd be substantially more "linux" variant malware packages which would infect servers, so as to get to clients (Windows, Mac, or otherwise). While they exist, they are not common compared to the slew of Windows malware programs available in one click from any search engine.

Re:Not more safe

[Anonymous Coward]

Oh really? What about Apache vs. IIS? Apache has more market share, but which one got f*cked more?

Re:Not more safe

[CAIMLAS]

Yet, still, the software did not rely on any inherent software flaw (unless you consider lack of a virus scanner a flaw, in which case you might have an argument - but over a decade of IT consensus would probably disagree). It's relying on the same thing which has gotten people in trouble since the beginning of time: gullibility, stupidity, or similar.

Would you hold the lock responsible if someone forgot to lock their doors and got robbed? What if they let the thief in themselves? That's a human fault, and what we're talking about here. The usual Windows scenario is more akin to the lock not keeping the thief out.

Re:Not more safe

[CAIMLAS]

The fact that it was a screensaver instead of a text document or an actual program (screensavers are not executable in Linux, as they are in Windows) is a mere coincidence. The fact is it installed a program into the system, providing root privilege, which allows this to happen. PEBKAC, and to some degree, gnome-look.

Re:Not more safe

[JDeane]

Slightly less mean... lol Your favorite MMO or online game convince some one to press Alt F4... Oh the fun that used to cause lol

At least there was no permanent damage.

Convincing people to type in something is the same as convincing some one to install a screen saver or that purple gorilla thing (can't remember the name of it for the life of me... *checks google*)

Bonzi Buddy!!! lol not sure if it counts as malware though. I would for sure but I guess some people actually liked it.

http://en.wikipedia.org/wiki/BonziBUDDY

Getting a user to do something on the system that will compromise it is the first step to ownage.

Getting some one to type in a root password is trivial... Just ask the thousands of people who type in bank passwords from phishing emails every year. "omg my bank has to confirm my information.... well at least all I have to do is type in my account number and password here to fix it!!!" Tap tap tap... 24 hours later "Omg where is all my monies ???"

Security does not come pre installed on any OS... you have to install it on your users.

Re:Not more safe

[Anonymous Coward]

My mom almost got infected last week.

She's still turning tricks?

Re:Not more safe

[Anonymous Coward]

Except it's open source, so people reviewed the code and saw exactly what it does.

Re:Not more safe

[schotty]

Actually, don't forget that of the two most mainstream distros -- Fedora and Ubuntu, any sane user has ZERO need for a package or repository that:

A) Doesnt scrutinize the living snot out of each contributor.
B) Doesnt enforce digitally signing of the packages.

And yes I do mean ZERO. Flash, Java, all FLOSS supported, all FLOSS unsupported, etc can all be attained thru SAFE channels. I must say that Ubuntu's were more blatantly in the user's face, but the Red Hat variants certainly have them too.

Though, personally, after not using Ubuntu for a few releases now, I cannot say if they are setup by default to nag the snot out of an unsigned package or repository, but Fedora and RHEL do (and thus CentOS).

To me this should be a simple reinforcement of WHY the old bearded ones act the way they do. But this is hardly a slam on linux, but rather of gnome-look's pathetic acceptance policies, and the need to utilize proper repos and packages.

Had to say it.
Thanks much,
Andrew.

Re:Not more safe

[Frnknstn]

There's also been some evidence of malware that triggers

[citation needed]

Re:Not more safe

[cbhacking]

Um, why wasn't it? To quote the summary:

The .deb file installs a script with elevated privileges

Package managers run as root. Install scripts in packages run as root. An install script running as root can install or infect software, or modify settings, anywhere on the system. In fact, they can install malware and mark it setuid root so the software's author now has a root-level back door into your computer.

Nothing about this is any harder at all on Linux (or OS X, or OpenBSD for that matter) than on Windows.

Re:Not more safe

[cbhacking]

You're forgetting the very obvious third option:

The malware either edits the log or edits the reporting program. Sure, if your tool is obscure then malware authors won't target it, but just like the way that a lot of Windows malware now disables taskmgr.exe and taskkill.exe, if there is a known program that would make it easy to detect the malware, the malware will disable it.

The better malware just makes itself invisible to such software, though that requires reverse-engineering the programs on Windows. On Linux, with the source code easily available, it's much easier - replace the installed versions with a modified binary that hides the infection. This is rootkits 101, here.

Re:Not more safe

[eknagy]

apt-get install tiger

Re:Not more safe

[Anonymous Coward]

Duh. Any system that allows the user to install software is vulnerable to trojans if you don't scan with an anti virus. The only thing that might fix that would be some sort of sandboxing like SE Linux. On another note, you completely forgot the fact that this malicious screensaver is not in the repositories but only on a third party website. Security is a process. There is nothing wrong with educating the user in safe practices regardless of which OS they use. And when it does go wrong, it's good to know that the source is out in the open and will likely be fixed very soon in comparison with other proprietary software.

Re:Not more safe

[Anonymous Coward]

It's called the principle of least privilege. There's no reason a screensaver should have access to your disk or to the internet (unless its purpose is to show pictures or download them from the net). Therefore, it should not have those privileges. SELinux does something like this, but it's not exactly user friendly, so what's needed is to make it so.

Re:Not more safe

[Anonymous Coward]

No one I know does this, ever.

Its a well known human pathology. Using windows doesn't make you dumber and using Linux doesn't make you smarter. Which is why people say that if Linux got to 90% marketshare we'd start seeing these problems.

Re:Not more safe

[Jedi Alec]

I don't visit sites that are prone to malware, and I use safe searching habits.

Such as...say, using another browser besides the one that came with the operating system? An open source one, perhaps?

Re:Not more safe

[Anonymous Coward]

"leaps and bounds" ? Haha, please don't make us laugh. Linux doesn't have half of the security protections and features Windows has. But keep on trying penguins, maybe someday people might stop laughing at you and your ridiculous desktop aspirations.

Re:Not more safe

[Anonymous Coward]

And they really want and need those.

I really thought so too when I started on linux... and early on I guess I did. Nowadays, if it's not in Debian I don't bother -- it's just too much hassle.

The software ecosystem in Windows is _really_ confusing, there is no denying that. A good linux distro, even with a few 3rd party applications, is so much more simple that the 'extra' Windows apps just don't explain that difference.

Re:Not more safe

[zig007]

Linux sounds too good to be true. So does Firefox.

Oh my god! Silly me running both then! .. .. ...
$ apt-get remove linux firefox
Reading package lists... Done
Building dependency tree
Reading state information... DoneReading package lists... Done
Building dependency tree
Reading state information... Done
Package linux is not installed, so not removed
Package firefox is not installed, so not removed
0 upgraded, 0 newly installed, 0 to remove and 2 not upgraded.

Thank god, it seems that i am safe, after all. :-)

Re:Not more safe

[Anonymous Coward]

There are different types of malware.

This is called a trojan, and no one ever claimed Linux was safe from those. I'd say no one ever claimed any system was safe from those, but I have a feeling that someone would bring up a (Steve Jobs? That Oracle guy?) quote to prove me wrong.

Heck, you don't even need a computer to get hit by a trojan. A trojan gets its name from an old story where the Greek left a big horse made out of wood outside the city of Troja. Greek soldiers were hiding inside the horse.

Re:Not more safe

[rdebath]

GP is talking about SELinux. It's now part of the standard kernel, though a lot of work to setup.

Re:Not more safe

[Dal Platinum]

Shame there's not a patch for being an antisocial elitist.

Re:Not more safe

[Dal Platinum]

The problem is that 'bad users' may not know any of this, and when a window comes up that says 'enter root password to install software', they will happily type it in. If it says 'You need to enter the root password on initial execution', they will type it in there too, as long as the end result is pictures of Shakira, or whoever the fuck.

Re:Not more safe

[the_womble]

Why is Gnome Look a trusted site? It is a place people upload stuff of.

Anyone can register and start uploading (at least thats the impression their FAQs give). There is not personal contact, no verification, no bug tracking system, no signing, no real community etc.

I am not saying it would be impossible to get malware into a repo, but it would take either:

1) Compromising a mirror and being able to fake signatures, or,
2) Making actual contributions, or,
3) placing the malware in the upstream source.

Note that using two or three to put the malware in a widely installed package is going to take a lot of patience.

Re:Not more safe

[mu22le]

Actually you can design around vulnerable users. How? In this case you could just avoid allowing themes (yes, themes aka images) with executable content, why the hell would a theme need a suid script?

In general you can enforce sandboxing: let people install stuff in their own home (so that they can't compromise the system) and explicitly ask the user if the what an untrusted app is trying to do is allowed (read "not signed by distribution" for "untrusted") . If I download an app to get youtube videos (it's the last untrusted app I installed) and it tries to touch my cronjob, or access my pictures, or edit another app's configuration I want to be notified. Of course the first time I'll get a prompt that ask me if it can connect to the internet, I'll say yes to that and start getting worried if I get any other funny request.

Re:Not more safe

[Anonymous Coward]

Maybe on Ubuntu where you just retype your user password to give any program root like some slightly less retarded version of Vista.

Re:Not more safe

[Anonymous Coward]

I know he's AC, but the point he makes is still good:

What the fuck is wrong with people like you?

Personally speaking, I've been posting on Slashdot as AC since longer than your UID indicates you've been here. Does that give me the reason to hold it against you, that you're more of a n00b 'round these parts than I? Does that give me the right to consider all of your opinions weaker since your UID is so high?

Sorry, but, what the fuck, dude. This is a goddamn forum. It shouldn't matter whether someone posts as anonymous, or whose account is older than whose. If you think it makes any difference whatsoever, you're a fucking moron at life. All people have something to say. You should take their claims for what they're worth, rather than some bullshit based on what they call themselves when they say it, or how long they've been on the medium in which they express themselves. If you were an adult and not a fucking elitist dipshit maybe you'd have figured that out by now.

People with your attitude ought to be slapped repeatedly. That's OK, though, because something tells me that if you keep maintaining these attitudes and if you do so in your real life and not just on Slashdot, then yes, you will be.

Re:Not more safe

[BenoitRen]

You must never have worked in tech support and/or as an operator in a call center.

Re:Not more safe

[BenoitRen]

But if so, why all the security advancements in the latests Windows versions? Why isn't it still using Win95 era security?

Simple. They switched from the Win9x codebase to the Windows NT codebase, which was designed for corporations, who needed things like permissions on their machines and networks.

Re:Not more safe

[Anonymous Coward]

A Windows screen saver, it's configuration dialog and preview are all handled by the saver's executable which is run under the current user's account. The screensaver in TFA isn't bad, anyway; it's the distro package itself which contains a script of 'evil' which runs as root. The screensaver is bait; it could instead be a p2p or music program or anything else that will get unknowing people to click "yes/yes/yes/yes/yes" until they're compromised.

Re:Not more safe

[Zardus]

/etc might not be the same as the Windows registry (I agree with this statement, /etc is much more manageable), but the gconf registry is looking more and more like it every month. You can say gnome isn't an integral part of Linux, but it's installed on the majority of end-users systems nowadays so for these purposes, it pretty much is...

Re:Not more safe

[dkf]

As long as there is money to be made, viruses will be made. Or power (intelligency agencies).

Money and asshole-dom are the keys to why malware is created. Money is what allows the asses to keep on doing it rather than going off and doing something more worthwhile to earn a living. Only assholes make malware in the first place (yes, I've seen people claiming to be non-asses who are making "non-evil" malware, but I don't trust them and consider them to be part of the group of people I don't want on this system at all anyway).

For the most part, intelligence agencies prefer to watch who you're talking to what you're saying, since traffic analysis is easier than cracking. They don't trust that they'll be able to break into your machine undetected, so they don't rely on being able to do so (well, except in special cases which I'd bet you don't fall into, unless you're really a terrorist).

Re:Not more safe

[dbcad7]

Actually Sloth works to Linux's advantage.. as most people (especially newer) are lazy, and install everything from the distros repository (usually with something easy like Synaptic).. Someone who would have been targeted by this screen saver vulnerability has learned just enough to endanger themselves, and more than likely enough to deal with the consequences.. Unlike the situation in Windows where an uneducated Sloth is prime pickings.

Re:Not more safe

[Anonymous Coward]

What was the last time you got infected by Windows vulnerability?

Conficker. MS07-67 and autorun.inf idiocy introduced in WinXP SP2.

Re:Not more safe

[Anonymous Coward]

If you want a screensaver for Linux, you can get tons with xscreensaver.

Right, but if I want a cool screensaver, where do I go? And by cool, I mean something that looks like it was created after 1989.

Re:Not more safe

[RevRagnarok]

netstat -anp | sort | mail -s 'Network Report' user@example.com

You're welcome. ;)

(I'm at work, so don't have time to play games with cut and uniq, or other options to netstat, but it would probably not be that hard to get a better list.)

Re:Not more safe

[bcmm]

(If I didn't have backups) I would rather you ran rm -r /etc/ than rm -r ~/ on my box.

Re:Not more safe

[Zardus]

If you're running Ubuntu, once the malware can run code as the user, it could download a spare, compromised set of all the system tools that require a password (ie, setting your clock, configuring any sort of system settings, etc) and modify the System menu to use them instead. At that point, it can just wait patiently until you need the functionality, steal your password when you enter it, and sudo to root normally. Alternatively, it could sneakily break something (ie, have the hacked clock applet display the wrong time) and when you go to fix it, sniff your password then, though that risks tipping off the user.

If you have it properly configured, with the user you use every day not having such great sudo powers, then it's much safer. That's far from the default config, though. Likewise, noexec set on your /home would prevent such hacked applets from running unless they rewrite them in a scripting language, I guess. That's a lot of work, but far from impossible.

And anyways, that's all overkill. No one needs root access if the real treasure is what you type into the browser and store online and so forth. A piece of malware could just as easily install some Firefox plugin into the user's mozilla plugins folder, and that plugin could do anything they needed it to, including launching connections elsewhere and following orders. Good luck finding that via ps. You'd need to look at about:plugins and hope that you can figure it out from there. As a safeguard, the malware could infect your .bash_profile and .bash_logout to give itself some re-infecting insurance when you start up (or close down) a shell to fix the issue. And there's more than just Firefox that takes user-installed plugins -- any application that runs user-configurable code at any point can be used for this purpose. The gnome session startup config won't help you in any of these instances, and the average user's Linux-savvy friend probably wouldn't be enough to get out of this mess. It's like a rootkit without root -- a userkit if you will.

Re:Not more safe

[renoX]

False, it just means that Linux/Unix security isn't good enough: a screensaver should only be able to do very limited things:
-display images
-bring up a login prompt (but not access it)
-access only some specific directories

If the OS allow a screensaver to do anything else, then the OS security isn't good enough..

Re:Not more safe

[MadKeithV]

An open system is more secure as everyone know when a vulnerability is discovered and syadmin's can make work arounds (or even pull the system down) until a patch is developed.

I keep hearing this, but it's not true per sé.
One can find vulnerabilities in both open or closed software - more easily in open source because one can look at the code. If one finds a vulnerability, and doesnot report it, having open source makes no difference to the severity. If the person looking for vulnerabilities is malicious, open source would seem to be at a disadvantage compared to closed source.

Open source only starts having advantages when people are actively looking at the code for vulnerabilities without malicious intent, and reporting them. Fixing those issues once reported is theoretically easier and faster in open source, and not reliant on the original publisher of the software.

So in the end, open source is only secure as the number and quality of people actively looking for and reporting vulnerabilities, and the number and quality of people actively fixing these vulnerabilities. In open source, you potentially have more of these people if you can motivate them, and you have to hope these people are (collectively)as good as the malicious people.

Re:Not more safe

[Turiko]

You're forgetting one major thing. As a linux user, all you need to do to install software is open your OS' packet manager. You don't need to download anything on any site, wich completely wipes away the source of malware. Together with firefox and noscript, there isn't ANY malware that can get on your computer.

Sure, it relies on the user not downloading any programs from the internet. But since they can diwbload whatever program they want without searching for it, this will make them more likely to go there rather then some malicious site.

If windows has such a packet manager, it'd be about as safe as linux. Of cource, linux has other features that helps fend off malware, but if none can get on it doesn't matter.

Re:Not more safe

[Anonymous Coward]

man netstat

Re:Not more safe

[Anonymous Coward]

Slammer isn't an OS level worm is it? I thought it was SQL server based (exploitable application running as root)

Re:Not more safe

[Anonymous Coward]

If you want Linux to grow and reach more people, as opposed to being a geek niche,

I don't.

For me, Linux is the perfect operating system for a programmer. I'd like it to stay that way. If it becomes popular, that's fine; but if it becomes something other than a programmer's operating system, I will switch to BSD or something.

Never switch high horses midstream!

Re:Not more safe

[Mahenda]

There's such program for Mac called Little Snitch, it reports about every program trying to access internet and you have options to deny it or allow forever. And that's the most basic and important problem with today firewalls, they won't allow outside traffic hitting your computer, but they will allow anything from inside going out... -- Photoshop on Linux? Wine? No. http://www.kanzelsberger.com/

Re:Not more safe

[Anonymous Coward]

She never entered her password, how exactly would the program go about going from user to root privileges?

Ever heard of local privilege escalation?

Re:Not more safe

[Anonymous Coward]

Wow... you just re-invented ZoneAlarm.

Re:Not more safe

[Anonymous Coward]

On Linux, she could have simply killed any offending processes

On Windows, we eventually had to use "System restore" (an OS feature) -- which the program could potentially have disabled had the malware author thought to do so

On Linux we eventually had to find the offending processes using ps and kill them, OS features which could potentially have been disabled had the malware author thought to do so.

Re:Not more safe

[vintagepc]

RMS, is that you?

Re:Not more safe

[visualight]

No, it's not part of being human. Browsing websites and looking at software, it is the way you find and install software on Windows. It is not how you find software in Linux. It's not any kind of pathology it's a different environment.

Re:Not more safe

[jrbrewin]

and how easy would it be for a malware writer to fool such an application in to thinking its malware was one of these generic and popular net-based applications? The only way to prevent that is to create hashes of each application, which would need re-validating each time it is updated. other than that, a good idea.

Re:Not more safe

[Anonymous Coward]

To quote a certain bearded, limping doctor:

Everybody lies.

Re:Not more safe

[Anonymous Coward]

Bravo!

Exactly! The problem is that people want to use a PC as a device, like a washing machine, a microwave oven. You switch on, you use! End of story! The iPhone works 'cos the average user, with a standard non-jailbroke phone, get's a device not a pocket computer.

Lost count the number of times I have got free beer from from relatives for fixing one more PC, 'cos cousin Merv couldn't help but borrow that knocked off game from his mate at school or couldn't help but click that pop-up that declared "Your machine is infected. Click here to rescue it!", which point it's of to scam-land, just south of Malwareville!

If you want fool-proof, you need and O/S that cannot possibly, ever be allowed to run anything unauthorised and I can't see that happening in my lifetime!

Re:Not more safe

[Neoprofin]

Perhaps you should set up your own fork then, because the prevailing mindset of the distros and the community as a whole seems to point towards greater simplicity and market penetration, neither of which will happen if the solution to security threats is "fix it yourself".

I hate track pads, glossy screens, and burning my legs, but that's the future of laptops at the moment.

Re:Not more safe

[Anonymous Coward]

All of those directories are under the / directory which is obviously the "system folder" you stupid piece of shit

Re:Not more safe

[Xacid]

"...a hack relying on stupid users elevating the virus to root authority themselves"

Like all the new "just from windows" users that the linux crew is dying to win over? Things aren't nearly as common sense as nix users seem to think they are for nix noobs.

And while I agree with most of your post, calling that user base of linux "stupid" is a bit short sighted. Anyone willing to give linux is a go is worth SOME credibility. Part of the problem is this mentality that Linux is damned-near invulnerable through its own obscurity. Proper precautions such as antimalware NEED to become common place -a default installation- on the linux platform. Sure, there are "stupid" users, but proper security is supposed to be able to help...alleviate some of that. The philosophy to not getting malware shouldn't be "well, don't install it" (though that's perfectly sensible to the experienced nix user). /soapbox.

Re:Not more safe

[vegiVamp]

I'll just name my process f1refox, and Joe User will just think "hey, I already authorised that, didn't I ?'" and click again.

Re:Not more safe

[Goaway]

The usual Windows scenario is more akin to the lock not keeping the thief out.

No, the usual Windows scenario is exactly the same as this Linux scenario. The argument wasn't that Linux is particularly insecure, it was that Linux is just as vulnerable as Windows, which is largely true.

Re:Not more safe

[Anonymous Coward]

control panels are dll's on windows with another name (.dll).
screen savers are exe's with another name (.scr).

they're all code.

Re:Not more safe

[Goaway]

This particular attack cuts right through that, as it relies on somebody downloading and installing a package, which will not run as the Firefox user.

Re:Not more safe

[TheTurtlesMoves]

I have always wondered about that. Why do i need Linux to grow and reach more people? What do i benefit from that. Linux does what i need now and there is an ample community to help and extend various programs and tools to keep it that way. I don't need it to be "popular".

Re:Not more safe

[csartanis]

There's a difference between exploit safety and phishing safety. If the user gets tricked into running malicious software, it doesn't matter what OS they run.

What we really need to fix this problem is much more fine grained control of security. Do I want every app I run on my windows or linux boxes to have read/write access to my home directory, or the network? No fricken way. I want control over everything an application does on my system.

Re:Not more safe

[Seth Kriticos]

There is some degree of truth in what you say: the monoculture that Microsoft represents is indeed a big problem in respect to attack surface. This is not even a software specific problem, same with crops for example. If you only plant one sort, then the mayhem of a parasite is pretty much absolute. For that reason it is logically very foolish to use such a system. Using a variety of crops/OS's is much saner.

On the other part, you are just plain wrong: the Linux and open source development model is more secure than the binary blob one because a lot more people see the code. Though it is hard to make comparisons with desktop systems, this is evident from comparisons in the server area. For instance, Linux/Apache has a somewhat bigger market-share than Windows/IIS, still, Apache is generally less vulnerable and the havoc is much less severe in case of bugs (compared to some IIS bugs that did a lot of damage).

Also third party blobs pose a big problem, because they basically represent the same monoculture that Microsoft does *cough*adobe flash*cough*. Common protocols and individual, competing implementations make much more technical sense. Sadly, reality is little about logical or technical sense, which is why we are in our current mess.

Re:Not more safe

[giuda]

WHOOSH!!!!!!

Re:Not more safe

[Cro Magnon]

I agree with that. It's very hard for me to make Windows less secure than it already is.

Re:Not more safe

[Hatta]

If you get a virus on Linux, you need to rebuild it too. Unless you're running something like AIDE, you have no way to know what that virus replaced. It could be hiding anywhere.

Re:Not more safe

[mysidia]

You're suggesting there are enough human resources to develop a $2 Billion dollar operating system (the Linux kernel)...

But not enough resources to take submissions, and include all the reputable software people actually want in the repository?

Re:Not more safe

[Anonymous Coward]

It's been told to all the linux zealots

Fuck you too.

The only reason malware problems are smaller on Linux than Windows is because of the almost-non-existing desktop marketshare and that those who use it on desktop are usually more tech savvy.

Those are two reasons. Not one. Two. It's not that hard to count to two.

This just shows that if Linux had 95% marketshare on desktop, and Windows 0.5%, it would be the same thing but just turned around.

As a matter of fact your impressive waving of hands doesn't show anything in particular, except for demonstrating your ability to insult and your in-ability to count to two. The lack of actual facts in your post, which would supposedly support your argument, is overwhelmingly obvious.

You really, really need to try harder next time.

Re:Not more safe

[Runaway1956]

By "up to date", I'll presume that you mean Windows 7, with all updates and patches that have been pushed. And, you aren't willing to accept Windows XP, SP2 or SP3 unless SP3 has ALL current updates and patches?

Even then, I don't think you're on target. See, there's quite a difference in the way Windows and Linux handle an executable. On my machine, they don't run unless and until I execute them. I mean, intentionally execute them. Not so with the worms I've dealt with on Windows.

I'll accept the obvious argument that the clueless twit who authorizes just any script to run on his Linux box will have the similar problems as the clueless twit who downloads and installs anything offered to him on Windows. We simply cannot protect a fool from himself.

BUT - I've seen worms on Windows machines that belonged to some pretty tech-savvy individuals. Someone on their mailing list got the worm, the worm sent them a mail, they trusted the source, and ZAP!! They did NOT specifically authorize that executable to run - the system ran it.

I've recently read of one - let me stress, ONE - working botnet on Linux machines. One single botnet. How many are there on Windows machines? About one shitload of them, I believe. Working examples of Linux worms, trojans, and viruses that survive in the wild are really damned close to zip, zilch, nada. The expense of cleaning up a Linux infection? Unless your valuable data is actually compromised, it's far, far less than any Windows machine. I've spent exactly zero dollars on insecurity software since I've switched to Linux. How much have you spent (on top of the cost of your Windows installation) since you've owned a computer?

Re:Not more safe

[Hatta]

I am happy with 25,000+ programs available in Debian repository

Good for you. Even with tens of thousands of programs available, there are times when the one you want is not. I was snowed in yesterday, so I thought I'd pass the time with some SNES emulation. Problem is, ZSNES is not available in the AMD64 repository (a bug has been filed, and has been outstanding for 3 years). Snes9x is, but it won't run full-screen. So if I want to play SNES on my computer, I have to find some 3rd party packages.

That's not all I need 3rd party packages for. I keep up to date with Wine through their Debian repository. I use the Rarewares repository to get etree-scripts for handling live recordings. Even if a package is in the repository, it may be compiled without the options you want. Mplayer is one of those, so I have the Debian-multimedia repository as well.

So no, restricting oneself to the packages available through the main repository is not really workable. Or at least, you give up a lot of functionality without it.

Re:Not more safe

[2obvious4u]

Running an OS from a ROM prevents all virus attacks (except having the ROM corrupted when created). When you flash the system it returns to its original state. The system is only corruptible when the original ROM is created and during the current session. When you close the current session whatever malware, viruses, etc were installed during the session are gone for good.

Re:Not more safe

[Anonymous Coward]

You are either shit at your job, or good at making up random nonsense. You should apply to be manager of something.

Re:Not more safe

[ZarathustraDK]

Yes, we need a new kind of package that only gives root-priveleges to packages that do Good Stuff(TM) ^^

Re:Not more safe

[nortcele]

It turns out that I have patched a serious vulnerability in Linux. Please download and install my patch as root on your system.

Sincerely,
Someone

Link?

:)

Re:Not more safe

[ZarathustraDK]

If you really believe people wouldn't blame it on Windows, you must be new here.

You say that like it's a bad thing.

What's with all the cloak-and-dagger trolling going on lately? Why can't people just proclaim "U SUCK, I (HEART) WINDOWZZ" like the old days. No, instead people mask their futile dissatisfaction with Slashdot-memes to blend in.

You can point fingers at Linux in a number of areas, but security is not one of them.

Re:Not more safe

[ZarathustraDK]

You are kidding, right? That screensaver runs as root, and could have pulled who-knows-what from the web and installed it wherever it likes.

Well excuuuuuse me, it seems Linux hasn't got that "only install Good Things with admin-priveleges"-functionality that Windows has /sarcasm

Re:Not more safe

[ZarathustraDK]

You are seriously underestimating the scale of the windows ecosystem. You currently have thousands of application in your primary ecosystem. Imagine hundreds of millions of them. Thats right. Hundreds of millions.

Vira doesn't count.

Re:Not more safe

[Voulnet]

More Linux penetration in the regular user space means less spam and malware spreading machines. It's a better internet atmosphere overall.

Re:Not more safe

[Blakey Rat]

By "up to date", I'll presume that you mean Windows 7, with all updates and patches that have been pushed.

Or any Microsoft OS still under support, with all updates and patches.

And, you aren't willing to accept Windows XP, SP2 or SP3 unless SP3 has ALL current updates and patches?

No, of course not. Those versions are all still under support. It's not a hard concept. Do try to keep up.

Even then, I don't think you're on target.

Ok. Do you have any actual facts or evidence to back that bullshit up? The rest of your post is nothing but whining about Windows' security model, and anecdotes from the dawn of time.

On my machine, they don't run unless and until I execute them. I mean, intentionally execute them. Not so with the worms I've dealt with on Windows.

Duh? That's what makes it a worm. If it took user interaction, it would be a trojan instead. What was this supposed to communicate to me, exactly?

BUT - I've seen worms on Windows machines that belonged to some pretty tech-savvy individuals. Someone on their mailing list got the worm, the worm sent them a mail, they trusted the source, and ZAP!! They did NOT specifically authorize that executable to run - the system ran it.

What year did you witness this? Nobody's denying that Windows has had piss-poor security in the past. It doesn't now, though-- if you could pull off this particular task using Windows tools right now, you could be Internet-famous for it.

(Note: I say Windows tools, because it's always possible there's still some really shitty third-party email app out there that auto-runs attachments. It would be unfair to judge Microsoft based on third-party code beyond their control.)

I've recently read of one - let me stress, ONE - working botnet blah blah blah bullshit that has nothing to do with worms at all blah blah blah since you've owned a computer?

You do realize that botnets and (and almost always are) spread via trojan horse attacks which you already admitted Microsoft can't do much about, right? Why do you even bother typing long paragraphs that not only have nothing to do with my point (that patched Windows installs are immune to worms), but actually contradict your own previous points?

L2Debate

Re:Not more safe

[jhol13]

So you agree "vanilla" kernel sucks as no one uses it?

Does "This medium contains software intended to be automatically started. Would you like to run it?" ring any bells? Or "A volume with software packages has been detected. Would you like to open it with the package manager?" (OpenSolaris does the former too, not sure about the latter)

Antiviruses don't work. I think sometimes they are worse than the disease.

I tried to say that no OS has security as top priority. All of them have "usability" etc. as higher priority than security. Even OpenBSD.

I am not certain Linux can be made more secure than Windows today. This was trivially true some years ago, but with Windows 7 and IE8 I am no longer so sure. BTW, I follow Debian security mailing list: the sheer volume of that list is quite telling.

"Custom made" viruses/trojans are on the rise, so viruses do not need to spread anymore (although it does help).

Re:Not more safe

[Anonymous Coward]

So, multiple years ago. Got it.

Re:Not more safe

[jhol13]

Terrorist? LOL!

CIA's #1 priority before 9/11 was industrial espionage to help american companies (this was admitted by either white house or CIA themselves). What do you think, is now #1 or #2?

Re:Not more safe

[Runaway1956]

http://www.sevenforums.com/system-security/39314-cant-remove-autorun-worm.html

http://www.sevenforums.com/system-security/6529-problem-avast-conficker-some-other-worm.html

http://www.sevenforums.com/system-security/4072-project-snowblind-worm.html

http://www.sevenforums.com/system-security/8763-downadup-removal-tool-conficker-worm.html

I can't vouch for the technical savvy of the members at sevenforums, but they probably share a few clues among themselves. Machines up to date? Hell, I don't know. But, if they are getting this stuff on Windows 7 machines, they can't be very far OUT of date, can they?

Nice try at coming across like a pompous ass - it just didn't quite work. You missed the pomposity, anyway.

Re:Not more safe

[hduff]

2) Webmail (a dedicated server for her business)

Should never have been running anything else on this machine. Get her a second machine for all the personal stuff.

Re:Not more safe

[columbus]

The people who are saying that this is just the same as Windows are wrong. There is a world of difference between this and a drive-by infection. The user has to explicitly elevate their privileges to those of root before they are allowed to blast their foot off.

That said, the people that are saying that Linux is invincible are wrong too. Every system of sufficient complexity has vulnerabilities and Linux is no exception.

But thinking about this incident makes me think that maybe the Linux permissions model could use some improvement here. The attack vector is a plausible one: a screensaver in .deb file that you need to use sudo to install. But it's just a screensaver! You shouldn't have to become root to install a screensaver.

What if we had a tiered model of privilege escalation? Maybe Root - User Install - User run.
If the user elevated their access level to User Install, they could install smaller less demanding programs without going through sudo - a screensaver would be a good candidate for this kind of a lightweight program. I'm guessing that this access level would not be allowed to touch /bin /sbin or /etc, but maybe they could install in /usr/bin/local or the user's home directory.

Essentially, you would be giving the user a program sandbox to play around with. Yes, you would get mailicious programs installed & running in the sandbox. But it would be a lot easier to sterilize the sandbox & start fresh if you knew that the base system was still secure.

Re:Not more safe

[Thundersnatch]

An exploit in any executable you run on Linux, say Firefox, can do whatever the user acount under which Firefox is running can do. Same as Windows. This includes accessing or writing to various parts of the filesystem, creating outbound network connections, or, as is common in Windows, installing some form of rootkit using local priviliege escalation and persistent infection. Local privilege escalation is often not needed on Windows, since most non-corporate users run with local admin privileges, but that is about the only major difference.

A JPEG parsing bug in one of the libraries used by Gwenview would result in the attacker having the same privileges as the account from which you run Gwenview, and could do whatever it wanted to your home dir (steal cookies?), and read from most places on the system looking for sensitive information.

Yes, you can have certain programs that drop privileges on Linux. You can do that on Windows, too (IE8 does this by default on Vista-x64 and later). But most end-user programs do not do that, as it limits functionality.

Re:Not more safe

[vadim_t]

So you agree "vanilla" kernel sucks as no one uses it?

Not really, they do use it, they just patch it, often added experimental patches like grsecurity and new drivers.

Lots of software in pretty much any linux distro isn't the pristine upstream source.

Also, having a patch get into several distributions is something that's said to considerably help inclusion into the official kernel. The developers are careful with new features and significant changes, so real world testing is very desirable.

Does "This medium contains software intended to be automatically started. Would you like to run it?" ring any bells? Or "A volume with software packages has been detected. Would you like to open it with the package manager?" (OpenSolaris does the former too, not sure about the latter)

Not really, no. But that's probably signed packages. If not, then it's retarded and should be removed.

I am not certain Linux can be made more secure than Windows today. This was trivially true some years ago, but with Windows 7 and IE8 I am no longer so sure. BTW, I follow Debian security mailing list: the sheer volume of that list is quite telling.

The debian security list, AFAIK applies to all of Debian, a good deal of which applies to Windows as well. For instance, if you're going to count an OpenOffice exploit as a Linux security problem, you should count is as a Windows security problem too.

Also you never know how many things in Windows don't go reported, and get quietly patched as a part of some other update.

There's also the question of which kind of security issues you're talking about. Local root exploits aren't all that relevant for malware, since like everybody says, users care about user data. You don't need to be root to insert a malicious plugin into a browser that collects credit card numbers.

Re:Not more safe

[wbo]

Without knowing exactly what malware was installed it is hard to tell what the infection vector was. However, I suspect she was infected through a vunerability in a browswer plugin, perhaps Adobe Reader or Flash. I have seen websites serving ads that contain an infected PDF objects on more than one occasion.

That is one reason why I always remove the Adobe Reader browser plugin. That way when I click on a link that leads to a PDF or a page has a PDF embedded in it I am prompted to download the file. That way I only download and open PDFs that I am actively seeking and am much less likely to open one that may be a vector for malware.

Re:Not more safe

[phantomfive]

At some point, if I have the need and time, I may do so. Fortunately, for the moment Slackware fills all my needs.

Re:Not more safe

[Espinas217]

And that's exactly what we need now. We have a mature ecosystem with well established species. We don't need thousands of similar species being created and left behind in a few months. What we need from now on is slow evolution. There already are software to do _most_ of the things a user want to do with a PC, let that software evolve in a stable ecosystem instead of leaving the gate open and keep starting over every time, trying to make a better wheel every time.

Re:Not more safe

[jhol13]

Note: I am not claiming Windows, or any other OS is "good" or even "better". Quite contrary, I have claimed last upteen years that they all suck. I am not trying to raise an OS war.

One of the biggest problems of Linux is incompatibility (which, actually, increase security as viruses are harder to make spread), that is why I do not much like those "experimental" features. They also increase instability.

I do think "usability" should be above "security", secure unusable OS is hardly, er ... usable :-)

I get annoyed by people who constantly point out "vanilla (or distro X) does not have that problem". Double standards. Some compare to Windows ("it is worse") as if I did care about Windows at all.

Same with Debian, or actually pretty much any distro, people say "it has huge number of programs" as a good thing. Well, deal with it! Windows does not. Don't whine!

I am really sick'n'tired of cherry picking the view - either Linux is a single kernel or it is a huge number of incompatible distros, please do not try to have it both ways picking the definition which suits the argument best, changing it between the problems I lay out.

I am not trying to "win" a conversation or argument, I'm far too old for that. Remember, I do think "Microsoft security" is an oxymoron.

I am just pointing out that even Microsoft has done some nice ideas and that Linux is lacking sorely in some areas. I do not know Vista or W7 much, I got fed up at W2000. It was just a pile of shit in every meaning of the word. XP is better but only marginally.

Now I am slowly getting fed up on Linux - unfortunately there is nothing better out there *now* (for me). You see, I use Linux and that is why I am keen on pointing its problems, perhaps it gets fixed?

The worst in Linux is lack of testing, this is emphasised by the ever changing kernel (and to a degree other stuff too), it would require more testing than more "conservative" kernels. But I think gets less.

Re:Not more safe

[Anonymous Coward]

If you think the registry's a jungle, take a look in C:\Windows\winsxs.

Oh. My. Days.

Re:Not more safe

[vadim_t]

I get annoyed by people who constantly point out "vanilla (or distro X) does not have that problem". Double standards. Some compare to Windows ("it is worse") as if I did care about Windows at all.

I think, where Linux is concerned, you always have to talk about a distribution, because that's what people actually use.

The vanilla kernel isn't really seen much in the wild. Talking about it is like talking about the latest internal Windows kernel build -- it exists, a few developers may actually run it, and it may have a set of characteristics that are good or bad, but all that is largely irrelevant because it's not what people actually use.

Also, distributions show considerable changes. There exist for instance enormous differences between:

• Gentoo, with a hardened kernel with address space randomization, gcc with stack protection, NX emulation and SELinux enabled.
• The at one point existing Lindows, which ran everything as root.
• A minimalist Linux distro made to run in 4MB RAM, using kernel 2.4, busybox, and a very minimal amount of functionality that doesn't include a GUI.

They certainly have lots of things in common, but when discussing specifics like security you can't really just say "Linux", as there's a lot of variation there. Currently, for the purpose of discussing the usual situation, I'd refer to Ubuntu when talking about desktops, and Red Hat/SuSE when discussing corporate servers. I think it's pretty fair to ignore the oddball configurations -- I'm pretty sure that no modern distributions have the user login as root, for instance.

Same with Debian, or actually pretty much any distro, people say "it has huge number of programs" as a good thing. Well, deal with it! Windows does not. Don't whine!

But Windows has lots of the same programs. If you count a firefox vulnerability as a Linux security issue, you must count it as a Windows vulnerability too. The repository's existence is largely irrelevant for this purpose, as that it's in it doesn't mean it's going to be installed or used, and it's trivial to obtain on Windows.

I think the most useful comparison you could make is: given a newly installed box, with all defaults, if you let a normal person use it, which is more likely to get rooted? Because that's what people usually refer to when discussing security.

I am really sick'n'tired of cherry picking the view - either Linux is a single kernel or it is a huge number of incompatible distros, please do not try to have it both ways picking the definition which suits the argument best, changing it between the problems I lay out.

You're cherry picking yourself though. If you're going to claim that every single security bug reported on the Debian security list counts because it could possibly be installed, even if it's an obscure bioinformatics package 99% of the population doesn't know even what it does, then you must do the equivalent for Windows, and count the security issues of everything you could possibly install on a Windows box. That will include a good part of what's available on a Linux distro, plus a huge amount of dodgy programs like Bonzi Buddy, and shoddily developed vertical applications most people never see.

Re:Not more safe

[Hurricane78]

Wrong. It depends on who has control of the locks.

That’s why TCPA/TPM is really great, when you’re in control, but horrible as planned (with others in control).

Re:Not more safe

[Hurricane78]

Why are you so needy an to need the average user to love you(r os)? Stop being needy!

It’s simple: We build an OS like we do, because that is how we like it. Because we build it for us.
After all it is free.
If anyone else wants to use it, that’s fine. But we don’t want something from them. They want something from us. Which does not mean they are going to get it.

There is no point in changing Linux to satisfy the average user, unless you somehow for a weird reason think you need their approval to be accepted. (You don’t!)

Protip: It’s the same thing that separates men who have success with women and are leaders from those who are not.

Re:Not more safe

[Hurricane78]

Wrong too! Anyone can fix it! But is a function of time. Some people take longer because they have to learn more in advance.
Although in reality, there is a timeout when it’s too late to fix it (which most likely was what you wanted to say), this was not the point discussed here.

Re:Not more safe

[jgrahn]

Personally I don't care if Linux is ever employed by the "average person". I'm not one of those people and the work I do requires people who know what's going on.

I *do* care. But the average person will have to learn what's going on. The other way lies Windows clones, Gnome, and insanity; they might as well stick with Windows.

Gnome: I despise it. I've watched it "work" on big multi-user servers (with dozens of users with Gnome sessions via VNC). It throws up dozens of random processes per user, all undocumented, which (according to Google searches, since there is no documentation) do things like serve sounds which do not exist, poll for updates which never come, run 100% CPU screensavers which noone watches, crash randomly, lock up at 100% CPU, and leak memory. Every time I run top(1) the gnome-terminal processes are, well, at the top.

Re:Not more safe

[Rockoon]

Yes. Because that 2 billion figure is a bullshit metric.

Re:Not more safe

[Tacvek]

with SELinux like the parent was describing, you can restrict rights to only what is needed by the program. You can do this for any application if you know what rights the application needs.

So if gwenview does not need acess to cookies and you've set things up right, than no exploit in it can give access to cookies, since gwenview lacks to permission to access cookies.

Re:Not more safe

[lgw]

You shoudl, in fact, the correct behavior to cater to the idiots who can't be bothered learning if your primary goal is security. To me this simply illusitrates why comparing OSs on the basis of such security isn't useful. An OS that actually provides good security would have to be pretty geek-unfriendly. At least, until the concept pioneered by SELinux matures - I think there's really something good there, but not in it's present form.

IMO, a great example of a platform with good security is Microsoft's XBox (unmodded) - an appliance that does what it's sold for, securely. But even then, as soon as people start modding it, or distributing amature games written with the dev kit, the security model starts to break. Of course, you could also look at the XBox as 100% full of malware (DRM), so there's just no room for any more.

Re:Not more safe

[StuartHankins]

I don't have that many GUI users on Linux, they all connect using terminal emulation via ssh/telnet etc so I can't help much.

Assuming the parent processes aren't easily understood / identified, a tool such as SystemTap may provide more information to enable you to debug the issue. It's not terribly complicated to setup and in many cases provides extra detail you can't get easily or at all, even using tools such as oProfile.

Re:Not more safe

[bvankuik]

My mother managed to get some nearly-impossible-to-remove scareware on her (Windows) netbook. She swears up and down that she never visited any sketchy sites

I know it's your mother and all that but it was probably some porn site she visited.

  Because you're her son, she'd probably never say that but trust me, men aren't the only who visit porn sites. The human race was built with lust inside, and your mom by definition wasn't exempt.

Moderators, I am not trying to be funny or snarky, just pointing out the obvious (for me at least).

Re:Not more safe

[Anonymous Coward]

You really don't know how software works, do you? You're clearly just blowing this out of your ass.

Re:Not more safe

[mysidia]

It's not. It is based on two real studies, based on: number of man hours.

Two studies came up with the same result, so it's not BS at all.

And includes only the time it took to develop the Linux kernel itself, not all the OSS development efforts by third parties such as GNU, of critical components, and of documentation.

Software development requires expertise, and still all those hundreds of thousands of man-years worth of work have been done.

Imagine how much work the community can do, inclusive of people not having specialized software development skills?

Billions of people who couldn't/wouldn't want to do kernel hacking are readily available for assisting with the reviewing / packaging / adding software to the repository.

Doing basic checks/testing on software to make sure it's proper and get it into a repository is much easier, quicker, less expensive work than actually writing it or even than writing its documentation.

Re:Not more safe

[dbIII]

The "reinstalling someone's new XP-SP2 machine" should have been the clue to aid you in reading comprehension and show it has nothing to do with whether I'm good at anything or not. They bought it, installed XP, and had a virus within minutes so brought it in to work to see if I could sort it out (wipe and reinstall, only way to be sure). For some reason malware got on there before the antivirus could deal with it.
No need to go in for personal attacks just because someone has a very recent example which shows your point is incorrect.

Re:Not more safe

[Thundersnatch]

You missed my point... end-user-oriented applications are not set up to use SELinux by default. And given the reduced functionality, they likely never will be.

Re:Not more safe

[InfiniteLoopCounter]

Whilst I wholeheartedly agree with the first paragraph, I take issue with the second:

You can make a machine smarter, but people keep getting dumber all the time. At some point you just have to say to those people forget it, you're not going to learn, you're not worth trying to explain it to. Here's your Etch-a-Sketch.

From the context of an article on malware, are the users really getting dumber with time? Who really wants to learn about antivirus/security practises? This is the job of the techies, not something to foist on unsuspecting users. You cock this up it's your problem.

I hope you are not one of those people in tech-support who says to me to click on something I've already clicked on several times, then continues with the line that they would have to be sitting in front of the machine because it is "too hard" for me to understand, and who is a general waste of time to call with a computer problem.

The good ones almost always will solve a problem over the phone efficiently, be a pleasure to converse with, and not overtly insult their clients intelligence. They may even teach the average user something in the process (the user is unlikely to learn through doing if all they get is looked down on). You should ask yourself how would you like to be treated if you asked what's happening on the screen, and someone's running a quantum physics simulation.

Re:Not more safe

[phantomfive]

Oh? You got modded troll and it upset you so much you decided to make me your foe? That's very open minded of you.

Re:Not more safe

[Anonymous Coward]

Except that if Linux had enough market share, it would be equally hard to remove-- perhaps harder, since Ubuntu doesn't come with anything like System Restore by default. *Maybe* the user-root barrier would keep the entire system from being compromised, but good luck eradicating every "alias sudo=~/password_stealer" hidden in some configuration file.

Re:Not more safe

[Anonymous Coward]

You say people aren't worth explaining to, that they're getting dumber all the time. To some extent, I agree, however, there are a lot of people who have to work long hours, schooling, spend time with family, and you know.... live outside the digital box. So in between, they just want to be able to use the computer when they can and many don't have time to putz around trying to figure out Linux and need something that is going to JUST WORK. So the work you do requires people who know what's going on, as in?? What, Linux based I assume? That's wonderful so when I work with graphics artists who use, Blender, Gimp, Inkscape, etc... as I do, they are people who know what's going on and you then are stupid for not? Or can we safely assume you are in the know, for WHAT you know? Yes, Linux has things Windows may never have, again, I agree, although the same could be said the other way around. So the same old argument bashing an OS or the people who use them, when really, you should appreciate that you have the Linux option instead of spouting off about dumb people. There are those who would run circles around your open source behind and likely, they feel the same about you.

Re:Not more safe

[Rockoon]

Two studies came up with the same result, so it's not BS at all.

Nobody said that the number was bullshit.

Its the metric (the way you want to use it) thats bullshit.

Re:Not more safe

[mysidia]

The number is very illustrative of what a very tiny portion of the Linux community can accomplish cooperatively, through Bazaar style work.

On the other hand, you have supplied absolutely no evidence or reason to believe the metric or this use is "bullshit"

Instead, you are irrationally arguing a point that you apparently cannot logically support, by calling it names, or attempting to attach deceptive labels such as "bullshit".

Re:Not more safe

[Sylver Dragon]

1. Anna Kornikova naked? Links plz.

Sure, just make sure to run this as an administrator...link

2. Vista's UAC was a good idea, but they botched it badly. I can say this with some authority since I have been a long time Vista user.

Ya, I won't argue that it was way too needy. And I am glad that Windows 7 toned it down quite a bit. Still, it was a starting point and a good example of how people react to this sort of thing.

Re:Not more safe

[Anonymous Coward]

Malware, given access to a user's account on Ubuntu (using Gnome, etc) can replace a user's menu entries and install fake versions of system utilities in the user's path.

So when your mother goes into the menus to open up the graphical utilities, she ends up running the malware's version. The malware might even gain root access by using a fake (wrapper to the actual) sudo program.

This can also apply to .profile files.

An attacker can even leave a fake login program (running after the affected user "logs out"), pending they can open a session on the new account (su).

Re:Not more safe

[NoobixCube]

I meant merely that people see little point modding an AC up because the points just go nowhere. I wanted the AC post modded up so people who have their mod thresholds set high would see the post, no need to fly off the handle about it.

Re:Not more safe

[Anonymous Coward]

/agree ActiveX and Flash are the Devil.

Re:Not more safe

[thejynxed]

See: Zeus or any of the myriad Zolob variants, for a start.

Re:Not more safe

[CrazedSanity]

One of the biggest drawbacks of the Windows Registry is that it truly is a single point of failure. If something corrupts the registry, the computer won't boot anymore and oftentimes there is no way of fixing the problem. Since the registry holds configurations for pretty much every program installed, the user must not only reinstall Windows, but also all the programs.

In this way, Linux is truly more powerful than Windows. Should something happen that is similar to the afore-mentioned registry corruption issue on a Linux box, the user might still not be able to boot: in this case, however, the user can generally boot into single-user mode (or off a boot CD) to fix or remove the problem. Since the problem would be with a configuration file, the worst that would happen is that the file would have to be removed.

But let us not bash Windows just for the sake of bashing it: I think a fair comparison is in line.

All that being said, I don't really think that Linux is 100% secure by design. It has tons of advantages compared to Windows. For the most part, a Linux user has permission to edit things only in their home directory, so installed software generally can't take the whole system down: in Windows, a user can potentially access most of the system, especially since many Windows installs give the user administrative rights (or they login as Administrator) by default. A user on a Linux box can FUBAR their system just as effectively (or more so) than a Windows user if they have the root password or have unlimited sudo access, it is usually just a bit more difficult than on Windows.

As Linux begins to make larger strides into the desktop market, I think some very important issues regarding "viruses" will emerge. For instance, I would bet money that I could write "a virus" that would immediately break any modern Linux box in a heartbeat and it would never be detected by antivirus software. A script that asks for root permission to recursively delete "/" (kdesudo rm -rf /) probably wouldn't get picked up by antivirus. A script that opens a port on startup which executes commands as root would be almost trivial to create, and the user would never know.

The issue of detective viruses is tricky. What is a virus? A/V companies (as far as I can tell) seem to believe that searching for "signatures" is the way to find them. The fundamental issue, here, is that the viruses have to first be *discovered* (not to mention being classified): at least one person has to be infected by it before others can be protected... meaning that a given virus, assuming it actually runs, has virtually 100% chance of getting at least once system infected. Virus scanners have to become more proactive to be useful in Linux: besides finding these signatures, they must also interpret a processes' activities and be able to pre-emtively stop it from doing something bad.

The bottom line? If there were one Linux desktop out there for every one Windows desktop (or laptop, or netbook, or whatever), we would find that Linux simply has a different set of vulnerabilities. And the biggest vulnerability is the user.

Re:Not more safe

[mctrash0]

I think a lot of these scumware downloads pop up a legitimate looking warning that you need to download the latest version of Adobe flash or some other legit app. If you click on the download link, you get the scumware not Adobe flash.

Unfortunately, Windows XP is essentially unusable if you aren't an admin user. Vista's somewhat better if you don't turn off UAC

Re:Not more safe

[Goaway]

So basically, you're saying Linux isn't for developers?

Re:Not more safe

[sbeckstead]

whooooosh!

Re:Not more safe

[Anonymous Coward]

No, what I said is that developers should concentrate on improving the successfull projects instead of starting new ones.

Re:Not more safe

[erikina]

Ha. I got this (annoying) piece of crap on a reasonably fresh install of Windows (XP). The install was up to date, and barely used other than a few games (I use Fedora primarily). The thing I attributed it to was the fact the Windows install I got was from thepiratebay. After reinstalling with an MSDN install I haven't had the issue again (Which raises the question of why I didn't just download the msdn copy originally)

Re:Not more safe

[dave87656]

As I was reading the summary above my first thought was that the Windows appologists are going to jump all over this.

I run Windows Vista and Ubuntu Linux at home. At work we have 60 Linux boxes and about 10 Windows boxes. The Windows boxes have current AV software and the firewall turned on. My Vista laptop got infected with a keyboard logger and the only additional software I installed on it was Skype and Adobe Reader.

The Windows boxes at work get viruses all the time without anyone entering in a admin password. They just get infected. To infect a Linux box, you will have to enter a password at some point and install some software. The Windows boxes get infected just being connected to the Web.

Re:Not more safe

[dave87656]

The reason most Windows-based PCs are infected is also due to the ignorance of users.

I have Ubuntu Linux and Vista. Most of my surfing and work is done on Ubuntu. Still, my vista box got infected with a Key logger even though I rarely use it, I've been a software engineer for 27 years so I don't think I fall into the category of ignorant on this front. I use a separate non-admin account on Vista, as well, and still it got infected just because it's connected to the web.

Re:Not more safe

[Goaway]

Ok, so Linux isn't for developers who want to do their own thing?

Re:Not more safe

[jandersen]

The only reason malware problems are smaller on Linux than Windows is because of the almost-non-existing desktop marketshare and that those who use it on desktop are usually more tech savvy.

So, there are actually two reasons, then?

Anyway, I don't agree. The big, fundamental difference between *nix and Windows is in the underlying architectural philosophy, if one desires to use some big words. UNIX was from the start designed to serve several, concurrent user sessions, whereas Windows was a GUI layer running on top of DOS - most of the design ideas were imported from X, as far as I can see, but the networking side of it were left out. IOW, it was never intended to be an OS, let alone a networked multiuser system; the design decisions that were made back then have haunted Windows ever since.

Windows has always tried to be a sort of easy to use, non-technical appliance OS, and Microsoft have been quite reluctant to improve on the flaws in the design; and when they finally tried their hands on it, they chose to go for the VMS model rather than the UNIX one, which was perhaps not such a good idea, since the event-driven design was not implemented with sufficient forethought - which is a least a contributing factor to why Windows keeps inviting malware attacks.

Where Windows was designed to please the unskilled user, UNIX has always been made for the higly skilled, like engineers; the design is simple, yet allows the full range of potential uses that one may contemplate, and it has always been open to inspection and criticism - in my view the most fundamentally important feature of UNIX. A lot of potential security flaws have been weeded out in UNIX because of that.

However, in recent years there has been an increasing trend towards making the X environment more and more Windows like, with too much focus on being "smart", whatever that means, and too little focus on the things that made UNIX good: simplicity and openness. This is why we now see exploits for Linux - the design decisions made to please the crowd simply invite that kind of things in.

Another important difference, I think, is the security models employed: the UNIX one is almost embarrassingly simple, yet reasonably effective, whereas the Windows one is bewilderingly complex. This seems to have the effect that UNIX users learn to live with the security system fairly quickly, while in Windows people too often give up and turn it down to the bare minimum.

Re:Not more safe

[snadrus]

"it hurts you by making you more security-conscious" So, kinda like the world outside computers?

Re:Not more safe

[snadrus]

So be Microsoft, b/c they define normal?

Or: Make "patch the source & compile it" something every user (or auto-updater) could do. We already have updaters patching binaries automatically.

Lets make the most secure way feasible for the average user. An "Anti-virus" repo could put out urgent patches (and is checked frequently, or even may offer push technology) that could guard open source software.

And if said "average user" will always call for IT help, lets ease their getting to root cause & reporting just what happened.

Re:Not more safe

[snadrus]

As Ubuntu outgrows the needs for each high-risk vector, they've simply been removing them.

Root is no longer a user for all practical purposes that could be running in a general case as it was replaced by 1 user with Sudo rights.
Sudo is now being replaced with PolicyKit which gives selective permissions to programs that need it. We may see Sudo retired one day, or at-least outside common use & disabled.

Making software (theming especially) installable in a user-specific way that excludes executables is another great step in that direction. These great ideas can be made as the whole system can be examined by security-minded individuals (and not just a small security team in the case of closed-source). It's exciting to see the actual security progress being made in the desktop.

Re:Not more safe

[snadrus]

You have an underlying assumption of "any correctly-compiled software will just run on any OS". PolicyKit is actively working to make Linux more secure by limiting what the app can do. I could easily see a permission system in place for

"Your screensaver wanted Internet access to known malware site www......com and has been disabled" [Accept] [Change]

Re:Not more safe

[snadrus]

The FOSS OS movement doesn't require 100% trust. Closed source requires 100% trust. If someone (or wealthy organization) has very little trust, open source is their best bet for computing. Open Source at worst case could include auto-problem-detection at the source level or trust evaluation ratings (Even BitTorrent does that).

Re:Not more safe

[NoobixCube]

For as long as I've been using Linux (admittedly not long compared to some, since 2004), theming has been possible under regular user privilages. Installing software without root access, to me, is a definite no-no though. It would be fine if you could install a program in an isolated sandbox though. I don't just mean cutting a program off from editing vital system stuff, but also cutting it off from interacting with other programs in any way; otherwise all the security in the OS won't help one bit if, for example, something infecting your media player could just lift your personal information straight out of Firefox.

Re:Not more safe

[SEMW]

On Linux, she could have simply killed any offending processes (O.K. that's nontrivial, but no root permissions needed in theory) and check the (graphical, so-easy-to-use-a-caveman^H^Hgrandma-could-do-it) Gnome startup programs tool for suspicious entries

The malware in TFA on gnome-look was packaged as a deb file, and so (on the vast majority of systems) would need elevated privileges to install, and so have its installation script run as root.

Which means it's not just gnome startup programs you'd have to check, its every complicated, optimised-for-fast-startup-to-the-point-of-obfuscation (remember, Grandma's going to be running Ubuntu, not Slackware) startup script on the system. And you'd have to know it when you see it, which is not necessarily trivial if the malware author was clever. Maybe you could manage it; I certainly couldn't, I'd be installing from scratch.

Re:Not more safe

[SEMW]

The difference between Windows and Linux is how easy it is to remove stuff like this on Linux.

It was a deb. Which means the installation script, on the vast majority of users systems, is going to run as root. Which means the ease of removal can, depending on how clever the malware author is, be anything up to and including "practically impossible unless you have a lot of experience removing clever rootkits from a livecd".

Re:Not more safe

[Rockoon]

Yeah, if you say so.

You have decided that $COST to develop linux relates to $COST to audit literally millions of 3rd party programs source code.

I dont need to support my claim that its bullshit to think that they relate. You need to support YOUR claim that they relate in any way at all, because they arent equivalent things. They are different things. Different things often don't relate in any meaningful way. Back up your claim.

Amazed I am

[sbeckstead]

Hey malware creators just got wise to the fact that Geeks make more money than the average Joe?

Re:Amazed I am

[sexconker]

Hey malware creators just got wise to the fact that Geeks make more money than the average Joe?

Lies.

The proverbial Linux box is a P4 2.8 GHz with 512 MB of RAM that you're gonna upgrade to 1 GB soon.

The up-and-comer is a Core 2 Duo 2 GHz with 2 GB of RAM.

Surely Joe Tux Hack can afford better hardware!

Re:Amazed I am

[cenc]

Frigen rich snobs that hang out on /. showing off again.

My PIII with 512 mb of pc-100 ram is totally running bleeding edge open source software.

Re:Amazed I am

[bcmm]

Geeks don't use Ubuntu.

Re:Amazed I am

[element-o.p.]

My PIII with 512 mb of pc-100 ram...

Rich snob. My DNS server is a 486/66.

Re:Amazed I am

[armanox]

I'll take that and raise you a Dual Pentium MMX 200 w/ 512MB PC-33. POST takes forever.

Re:Amazed I am

[mjwx]

Hey malware creators just got wise to the fact that Geeks make more money than the average Joe?

No, geeks have more money then the average joe. This does not mean they make more money it simply means they are better able to track and utilise that money.

Most geeks live within their means, will seek out the best deal on debts and big ticket items and avoid obvious scams/bad investments. I know plenty of people who earn more money then me but piss it away on gambling, bad loans for expensive cars or simply get in more debt then they can afford. I know this one guy in marketing, bought an MR2 spider 4 months ago that he couldn't afford. Now he's sold the spider and still owe's A$22K to the bank.

YES! Finally!

[binarylarry]

It's the YEAR OF THE LINUX desktop! It's official! /Happy Ubuntu User

Re:YES! Finally!

[Anonymous Coward]

It's the YEAR OF THE LINUX desktop! It's official! /Happy Ubuntu User

time to teach the users a few things

Removal instructions from the site

[Xerp]

"sudo rm -f /usr/bin/Auto.bash /usr/bin/run.bash /etc/profile.d/gnome.sh index.php run.bash && sudo dpkg -r app5552" Man. I'm going to have to get me some anti-malware software...

Re:Removal instructions from the site

[wizardforce]

This makes me wonder how long it will be before some warning about a fake virus/trojan/worm succeeds in convincing a few Linux newbies to run some command to get rid of the fake malware which inevitably causes damage or actually downloads actual malware. Something along the lines of: "if you've been infected with virus.deb just run the following command: sudo rm -rf / usr/bin/virus" The only cure is education.

Re:Removal instructions from the site

[wizardforce]

That malware was such a simple script... It could have done boat loads more damage than it did. Lock out the user from sudo by changing the sudoers file, replacing the password hash for root, IN that case just about the only thing that you can do is grab a live cd and fix the problem...

Re:Removal instructions from the site

[Anonymous Coward]

That's missing the point though. They don't WANT people to realise the machine is compromised. Kinda like Ebola....it's so hostile to the host it tends to largely self-contain.

Re:Removal instructions from the site

[selven]

A confusing command line instruction which most people would Ctrl-C and Ctrl-Shift-V into their terminal is actually a pretty good way to get a virus onto a Linux newbie's computer.

Re:Removal instructions from the site

[wizardforce]

It looks like it didn't matter how simple the script was. Someone found it within 24 hours any way. If the malware has only 24 hours to work, then it makes sense to do a bit more than what this script did. The script would probably need to be so innocuous to remain undetected for any significant amount of time as to be fairly worthless to the malware writer.

Re:Removal instructions from the site

[kai_hiwatari]

yes users need to know the dangers that can result from rm -r

Re:Removal instructions from the site

[Anonymous Coward]

Find sudo and wget in one line of code--and you can be almost sure that somebody wants to screw you.

Re:Removal instructions from the site

[Anonymous Coward]

education? ubuntu user? really?

Re:Removal instructions from the site

[PNutts]

just run the following command: sudo rm -rf / usr/bin/virus"

Thanks. I'm running that n

Re:Removal instructions from the site

[MaximKat]

or perl, don't forget about perl

Re:Removal instructions from the site

[jonaskoelker]

Ctrl-C and Ctrl-Shift-V into their terminal

Surely you mean highlight and middle-click, yes? ;-)

Re:Removal instructions from the site

[drsmithy]

The only cure is education.

Wait, what ? Slashdot keeps telling me the user is not a factor in malware infections, how will "education" help ?

Re:Removal instructions from the site

[visualight]

Oh, dude. When I'm forced to use a Windows machine my #2 pet peeve is the paste buffer. You don't realize how much middle clicking you do until you don't have it anymore.

Re:Removal instructions from the site

[cbhacking]

The funny thing is, there's absolutely no reason why the malware author couldn't have simply installed a modified version of /bin/rm that *can't* delete the infection. For that matter, there's also no reason why the name has to be the same on every infection, or why the files need to be visible at all; the .deb installs as root, so you have full authority to do everything up to and including modifying the relevant system calls such that *no* program can see or delete the offending files without editing at the block device level.

If anything, writing rootkits is a lot easier on Linux - the source for every piece of the system, from /bin/rm to the kernel itself, are available. Beats reverse-engineering the system to try and figure out how to hide your malware without alerting the user by breaking something else.

For those thinking about the size of the .deb, that's not an issue either. Just have it install a script (with setuid root) that immediately downloads and installs all the rootkit stuff.

Re:Removal instructions from the site

[Ant P.]

You don't realise how much copy-pasting you do until you use the Windows command prompt, which doesn't even support ctrl+v.

Re:Removal instructions from the site

[Anonymous Coward]

I'm the same way, so I've got True X mouse (http://fy.chalmers.se/~appro/nt/TXMouse/) for middle click paste and highlight -> clipboard, and Virtual Dimension for my multiple desktop goodness

Re:Removal instructions from the site

[Anonymous Coward]

you can have a bit X feeling (middle mouse)on windows :-)
http://fy.chalmers.se/~appro/nt/TXMouse/

Re:Removal instructions from the site

[rdnetto]

Fortunately, it does support paste (on Windows 7 anyway) - just right-click to get the context menu.

Re:Removal instructions from the site

[thisisntme]

Who is this "Slashdot" person you talk about?

Re:Removal instructions from the site

[snadrus]

Education as things go mainstream? Or rip out sudo to force users through management utilities. Sudo is still around for those booting into recovery mode, for everyone else:

For most admin tasks, a handful of GUIs would do: kernel mod add/remove, config file change, compile-deb-and-install a program, etc. Taking these "lesser-but-common" use-cases pull admin-users away from the command-line. This is also going to be useful in large-scale deployments with administration capabilities where 1-off console commands piped to everyone's station wouldn't make complete sense. With the right abstraction, a variety of kernels could exist to vary the user environments just for diversity's sake.

Repositories!

[h4rr4r]

This is why you only install packages from the repositories.

Re:Repositories!

[binarylarry]

Why? Because it's a sane method of delivering software, which is becoming widely used (i.e. Steam, iTunes Store, etc) vs the traditional "Herpes" model used by Windows?

Re:Repositories!

[sopssa]

Well do you really want the iPhone like only-approved-software app store for your computer? With no way to download software from anywhere else than that said approved app store.

Re:Repositories!

[wizardforce]

No one is being locked into the repositories. If they want they can go elsewhere to get their software. The repositories merely provide a reasonably safe set of software available for the user.

Re:Repositories!

[Anonymous Coward]

Yes, for typical users absolutely...
People should have to jump through hoops to install arbitrary untrusted software, so that only technically competent people will ever try to do so.

Re:Repositories!

[selven]

You can always download software from elsewhere. Also, the Ubuntu repositories really aren't like the iPhone App Store - the approval process isn't nearly as evil, for one.

Re:Repositories!

[Anonymous Coward]

No one is proposing making it impossible to install other software; the point is one must be very very cautious when getting programs from outside the official repositories. And a clueless user probably shouldn't try it before getting a clue.

Re:Repositories!

[LinuxIsGarbage]

And windows users can likewise get a reasonably safe set of software from the likes of Softpedia.com or Download.com. And it gives the user choice, so they aren't tied to one specific repository only. That way if there's a custom program not available on one of those sites (but is from a trusted source), it doesn't involve pulling teeth like manual installations on Linux usually end up.

Re:Repositories!

[DogDude]

"Sane"? Not particularly.... When you have to install something that's not in the repository, then you're in the same boat.

Re:Repositories!

[smoker2]

Why don't you shut the fuck up. You are determined to make linux out to be the most insecure OS for some fanatical reason, I'm guessing you've been pwned on windows and want to share the love. Here's a clue, most linux users don't download and run software they find on random internet sites. According to people like you and your cronies, people generally have to compile any software they want to run. But yet now we are vulnerable to idiot windows-user-itis. Like I said, Fuck off and die, all you ever seem to do is spout shit on any topic, and it is really getting tiresome. One of these days somebody's going to catch up with you in real life and kick your whining ass. (at which point you'll be running to the authorities complaining that you're only 14 and people are being mean to you).

Re:Repositories!

[slack_justyb]

No but how about a balance between the two. Repos for what most people want. PGP signed debs for the 3rd parties. Straight deb for all those feeling frisky. It's not hard to warn people that, "Hey you're installing a unsigned package, chances are this will ruin your computer, sure you want to do that?" If a third party wants to distribute packages the least they can do is self-sign (bottom end), get a real cert (higher end).

The inherent problem with the iPhone is that you can only go to one store to buy apps (namely iTunes). With Repos you can pick and choose which stores you trust and which you don't. Much like how I choose if I want to buy software from BigBoxMart or BestStolen. The Internet in general could (since I am using a store analogy apparently) be seen as buying stuff off the street. Yeah, the stuff looks cool and at these bargain prices you can't beat. But I do need to exercise some caution when I flash my wallet to some guy hanging out the back of a van.

So yes, I agree, I'm not too hip on the one store to rule them all policy. But I do believe that the store concept actually has some utility to offer if given the ability to go to another store should I so choose later. I obviously don't want to exclude the random vendor on the street that is selling hand made crafts, or even the random kisok by the bus stop selling phones. I do however what to keep in mind the burly looking thug over there selling "Snoby" Radios. I think it is all a matter of getting people to get inside a way of thinking.

To me, and that only applies to me, Mac OSX screams "Hey buy more shiny Apple stuff" (Security by insulating ones self by coolness). Linux says to me "Hey subscribe to a Repo because we are always changing stuff and you want to have the latest build." (Security by trust of subscription [or maybe sheer geekness]). Windows just looks like, "Hey we're cool with everyone, you want herpes? No problem we're cool with that. Want to do really neat spreadsheets? We're cool with that too." (Insecurity by being a software whore. We're just trying to please everyone.)

Re:Repositories!

[nmb3000]

Because it's a sane method of delivering software, which is becoming widely used (i.e. Steam, iTunes Store, etc) vs the traditional "Herpes" model used by Windows?

Yes, software repositories are all nice and fuzzy until you want to install a new (or old) version of a program which is not in the repository. Now you get to install it by hand which causes two problems: all related libraries may have to be upgraded or downgraded, and you've completely broken your package-managed system, putting you in a state of limbo that is worse than either all-packages (Linux) or no-packages (Windows). Any future changes you make by using the repository have a good chance of breaking that manual install.

While I see the advantages to repositories, I also see the disadvantages. That's part of not being a fanboy (that, and not throwing around meaningless comments like "herpes model"). At least on Windows I can download software directly from the publisher (no unknown middleman) and install it using their installer (not some broken "patched" installer -- Debian-branded OpenSSH anyone?). If the program requires some special version of a library it can be contained in the installer and installed if needed without disrupting the rest of my system.

Is installing common, generic software easier with a repository? Yes, probably. Is installing specific (or even just newest) versions all software easier with a repository? Certainly not. I like the fact that the version of Windows I might run has no bearing on the versions of Firefox, Office, Eclipse, PHP, etc that I can run (within reason obviously - some things won't run on old systems of a vastly different architecture).

Re:Repositories!

[LOLLinux]

So if the software in your repo is a year out of date and you want something more recent it should be made as hard as possible to do so? What an asinine view.

Re:Repositories!

[h4rr4r]

So add any repository you want.

Re:Repositories!

[h4rr4r]

Yeah, installing debs is so hard. We understand, you were picked on as a kid and windows was easy enough even for your room temperature IQ, so you will defend it till the last slosh of your water filled head.

Re:Repositories!

[h4rr4r]

Most major linux software will have either it's own repository or it's own debs/rpms.

educate yourself a little before you spread FUD like this.

Re:Repositories!

[LordLimecat]

With no way to download software from anywhere else than that said approved app store.

Yes, its a pity that theres not some file that specifies which repositories are used, which would be changeable by the user...

Re:Repositories!

[jim_v2000]

"Why don't you shut the fuck up...Fuck off and die, all you ever seem to do is spout shit on any topic...One of these days somebody's going to catch up with you in real life and kick your whining ass."

Please tell me this is an attempt at making satire of OS fanboys in general. If not, you might want to reconsider what it is about a piece of software that makes you so insane when people don't like it as much as you do.

Re:Repositories!

[sopssa]

Your points would come off a lot better if you didn't throw around such foul words and hoping for me to die because I dislike the idea of iPhone like app store and locked-up experience for computers. While I think there's something seriously wrong with you, I'm going to respond anyway.

If at any point Linux gained marketshare, people would install their latests games off DVD's, download their third party software they want from the internet and the old repositories-only model just wouldn't work. Linux itself is great currently and I love it in server environments. But the practices Linux and the distros use, and which arguably provide some additional security for it too, aren't going to run with casual people.

Re:Repositories!

[visualight]

He said nothing of the sort. What an asinine response.

Re:Repositories!

[visualight]

I've never (really I mean never) needed anything that wasn't in my distro repository within weeks, often software makes it in on the same day. I have learned that there is almost always a reason software is not in a repo and that reason is almost never manpower, it's because the software itself is buggy or problematic to integrate. In such a case it's best that I wait anyway.

Re:Repositories!

[ljw1004]

I think it *IS* hard to warn people that "what you're doing is potentially risky".

That's because all the user sees is a bright eye-catching yellow box that says "blah blah blah blah blah blah blah [OK]".

The website where they downloaded the thing has soothing instructions and screenshots that when a yellow bar appears you just click "OK" on it, with "OK" helpfully circled in the screenshots. Whom will the user trust -- a bizarre yellow box with words they don't understand and concepts they don't care about, or a soothing website which has anticipated their problem well enough to walk them through it?

Re:Repositories!

[Anonymous Coward]

Assuming it had enough software in it, heck yes. Android Market works great for me.

Re:Repositories!

[Anonymous Coward]

there is always ppas

Re:Repositories!

[Anonymous Coward]

If there are multiple repositories and methods to go elsewhere, it doesn't change much. Still comes down to trusting the source you download from. The method in which it gets onto your system is kinda irrelevant.

Re:Of course the ninja was infected...

[royallthefourth]

He scurries in the darkness because he fears the light that is the Sun Source... Sinanju.

So Solaris users are unaffected?

Okay

[Anonymous Coward]

So a user runs untrusted software as root and gets malware. Never heard of this happening.

auto-update

[TheSHAD0W]

Okay, this scares me.

1. What happens when a publisher includes auto-updating code, but not specific attack code, like the DDoS software in the mentioned examples? If discovered it will appear to be a security risk, but not specifically malicious...

2. What happens when a software developer produces some completely innocuous software, gets into the repositories - and then months down the road, produces an update with DDoS capability, and has the update pushed into the repositories and automatically distributed?

Re:auto-update

[Aim Here]

You're describing Microsoft Windows XP.

XP came with an automatic update function. A few years into XP's life, Windows Genuine Advantage was automatically rolled out in a service pack, and once installed it will degrade your computer if Microsoft decides you might be a pirate.

Your nightmare scenario is everyday reality for most people. Pleasant dreams.

Re:auto-update

[sexconker]

In theory all updates pushed to repositories are vetted, tested, analyzed, and probed by your friendly, mythical repository manager.

In practice, shit will go down like a Valve launch.
http://www.beefjack.com/wp-content/uploads/2009/07/valve-launchbox.jpg

Re:auto-update

[wizardforce]

Any developer that gets caught doing that will only have one chance to do it and frankly, if they were well known enouh to get into the repos the last thing they need is being banned from the repos and ostracised from the Linux community.

Re:auto-update

[BikeHelmet]

This is why prompt-on-connect Firewalls exist for Windows. ;)

You can't trust what your computer is trying to do behind your back!

Re:auto-update

[nfk]

Ah, the joys of using Debian stable. If this DDoS update is released months down the road, it will probably be detected in the year and a half before my next update.

Re:auto-update

[Anonymous Coward]

The "Redundant" moderation was a funny touch.

Re:auto-update

[Alex Belits]

1. What happens when a publisher includes auto-updating code, but not specific attack code, like the DDoS software in the mentioned examples? If discovered it will appear to be a security risk, but not specifically malicious...

This is precisely why Linux-specific software NEVER has built-in auto-update -- it's installed by a package manager and can only be updated by root. Things like Firefox extensions may have auto-update functionality, however if an extension is installed by a package manager, it won't be auto-updated by anything other than package manager.

2. What happens when a software developer produces some completely innocuous software, gets into the repositories - and then months down the road, produces an update with DDoS capability, and has the update pushed into the repositories and automatically distributed?

Then he won't remain a package maintainer for too long. It also would be very easy to detect such malware after the first report because all sane repositories require the source to be available unless the package is a wrapper that installs something closed but sufficiently trusted (from NVIDIA, ATI, VMWare, Adobe).

Re:auto-update

[Anonymous Coward]

Why are Linux apps including any auto-updating code whatsoever? Shouldn't that be handled by their package management application for their distribution? If it's content updates (album covers, electric sheep, rss feeds, etc.) they shouldn't require administrator privileges at all. Any Linux app that does some automatic connection to the internet AND requires elevated permissions is one I would be extremely weary of. How to squelch situations like what has happened with this screensaver? If you are new to Linux get your installs only from official repositories for your distribution. Maintainers probably would have caught this before it was officially released to the public. If you aren't new and could have come to the same conclusion that conorsulli came to on the Ubuntu forums, more power to you, stay pervasive and thank you for being a tester of the newest, half produced, future of everyone's software.

Re:auto-update

[schotty]

1) That is a non-issue because you will fall into two very simple (across the board) methods. Either release a new package or if you are using something akin to Loki's Update tools, then it is implied that you will be using that tool to update the application (I see the latter to be more useful for companies too lazy to sell their software and update it with a repo).

2) Good point. But since we all trusted Microsoft at one point and many of us no longer (from a coding quality standpoint that is), that will be the case with another hapless company due to lazy auditing procedures.

Although, on your second point, which is an amazingly spot on point that we techies are going to have to solve, didnt Fedora run into that issue not too far back? If I am not mistaken, a new set of keys were reissued, but I am not certain as to what else. Perhaps that is a lesson we could learn somthing from. Or maybe not.

Great post though, Shadow.

scare the crap out of me

[qbasicjedi]

I swear to god, not thirty seconds before I came to slashdot and saw this story, I closed the gnome-look.com tab and had just finished pimpin' out my Gnome desktop. Good thing I didn't download any screensavers...

Whoop dee doo

[Dega704]

Like windows or any operating system linux is only as secure as the user keeps it. In a way this is sort of a win because it means linux is now popular enough for the malware makers to pay attention to it, and it will motivate the linux community to be more vigilant. Welcome to the mainstream and everything that comes with it. This highlights the advantage of using software repositories as well............

At least it was fixable.

[supersloshy]

Before trolls start yelling about how "OMGZ LINUX ISN'T SECURE HAHAHA" and things like that, let me tell you something: because GNU/Linux is so open and configurable, malware like this can be very easily removed. All you have to do is run a few commands in a terminal to remove this. On Windows and the like, things are so complicated that Anti-virus software is almost required to remove some of their malware. I am glad to use an OS that doesn't restrict me like that. :)

Re:At least it was fixable.

[PeanutButterBreath]

Before trolls start yelling about how "OMGZ LINUX ISN'T SECURE HAHAHA" and things like that, let me tell you something: because GNU/Linux is so open and configurable, malware like this can be very easily removed. All you have to do is run a few commands in a terminal to remove this.

Before trolls start yelling about how "OMGZ WINDOZE AV SOFTWARE IS COMPLICATED HAHAHA" and things like that, let me tell you something: because Windows is so accessible, AV software like this can be very easily deployed. All you have to do is click a few icons in the Start Menu to remove this. Blah, blah, blah

On Linux and the like, everything is simple if you already know what you want to do. Otherwise, you have to trust unaccountable internet entities to provide you abstruse commands to run and hope they aren't trying to trick you into doing even more damage to your system. It should be obvious why that is a no way to combat malware.

Re:At least it was fixable.

[imerso]

Although I like Linux as well, I think you are somewhat wrong here. This specific malware is a basic one. Wait for the upcoming Linux malware generations, and try to keep your statement that it'll be easier to get rid from Linux... I can't see any difference, the malware author could patch your bin executables, wreak havok on your etc configuration files, and what not, considering the installer was running as admin. Think more about that.

Re:At least it was fixable.

[Anonymous Coward]

because GNU/Linux is so open and configurable, malware like this can be very easily removed. All you have to do is run a few commands in a terminal to remove this

That has nothing to do with Linux being "open and configurable" and everything to do with the way this specific piece of malware is installed.

Re:At least it was fixable.

[Anonymous Coward]

The main difference between this 'virus' and many windows viruses it that with Windows you can get a virus without user intervention, i.e spread via network port, etc.

Often windows virus's use a vulnerability in the OS itself.

Re:At least it was fixable.

[Nutria]

Wait for the upcoming Linux malware generations

I've been waiting for 9 years, and fully expect never to see anything but small, isolated outbreaks of client side linux malware.

Re:At least it was fixable.

[Drakin020]

Ah but here is the problem.

To you, removing a virus from Linux is easy, because you are obviously an intelligent Linux user.

(Someone posted above the removal instructions)

For you to write out: sudo rm -f /usr/bin/Auto.bash /usr/bin/run.bash /etc/profile.d/gnome.sh index.php run.bash && sudo dpkg -r app5552

seems like nothing at all, but what about the average computer user? Do you think they know what sudo is? Hell I don't use Linux and I have no idea what the shit any of that stuff means. So no, that would only work with someone who really knows what they are doing with Linux.

Now on the flip side, you say...

"On Windows and the like, things are so complicated that Anti-virus software is almost required to remove some of their malware"

Ah, but this is going off the assumption that we are dealing with an average Windows user, not an expert user (Such as your self with Linux)

An expert Windows user like myself would say "Removing Malware is easy, just go into the registry's run section, remove what looks suspicious, delete temp files, prefetch, and search for the malware running process (Example: virus.exe) in the registry, and delete it"

Ah see that to me is easy, I've done things like that all the time, and it's just cake.

So I guess the point I'm trying to make is that...To you, removing a virus like this from Linux can be really simple...to someone who knows Linux, but the same can be said to a Windows user...who knows about Windows.

Re:At least it was fixable.

[philipgar]

ah yes, because linux applications have never had holes allowing someone to get a shell on a system, and users are always running the most up to date kernel that has no root exploits available for it. The main difference between windows and linux is that the linux kernel has so many different versions, and not all distros are using the same one, so that it's hard to choose which kernel vulnerability to exploit. if 99% of people used linux, and were using the same distribution (with mostly the same kernel), believe me, these exploits would exist, and we would see viruses hitting linux machines over the network. Already, there exist worms that have targeted linux machines.

And saying the problem is not in the kernel but the software applications doesn't cut it either. The same could be said for many of the windows issues, it's just that the software applications in question are in every install and part of the windows user environment. It's no different than applications that might be part of the ubuntu user environment (gnome, samba, etc) etc.

Phil

Re:At least it was fixable.

[LordLimecat]

You dont think a specially designed package could work its way into the innards of your system?

On Windows and the like, things are so complicated that Anti-virus software is almost required to remove some of their malware.

This shows me that you really dont know that much about it; most AV software is rubbish once a successful infection has occured. The best way to remove viruses is either by hand with tools such as Autoruns, Process Explorer, or recovery console, or using automated kits like SDFix, Combofix, or (so ive heard) Malwarebytes.

Once theres real money in doing deep down infections of linux boxes, youll start seeing packages which install rootkit drivers, and require live-booting to remove.

Re:At least it was fixable.

[DiegoBravo]

This kind of problem is not about Linux or Windows but about distro that added malware in some crap application. In order to avoid that:

1) The typical crap software should not be allowed the same privileges as a typical user (why an screensaver should open sockets? remove files?) There are capabilities and several security options that nobody takes seriously

2) The package system should allow only a predefined set of actions in the installation process. Currently it runs as root any package' script; that's the reason I avoid all .deb files as provided by software vendors but obviously the problem is worse if the malware comes from the distribution

Re:At least it was fixable.

[LordLimecat]

I dont think thats a simple instruction at all; how did they discover the name of the package? What if the package had gone on to purposefully screw up dpkg so that the command would fail? What if it installed additional components not covered by the package installer?

Re:At least it was fixable.

[ShadowFlyP]

Open and configurable has nothing to do with this. A sufficiently intelligent malware could have made things as bad as a virus on Windows. Think of a malware that infects your libc to catch certain system function calls (such as those done by the "remove instructions") and redirects them to innocuous behavior. Even on a system that provides SHA1 checksum verification of all libraries and binaries installed through the package manager, you are still susceptible to a ill-behaving fopen/fread. The only way around something like that would be to boot from a clean boot disk with a known-good libc, which is pretty similar to the only way to be sure to clean a virus off Windows.

The fact of the matter is if you have root access and you run programs without knowing what they do, you are exposed to nasty things irrespective of what OS you are running.

Re:At least it was fixable.

[maugle]

To bolster your point: How did they find the name of the package? Only someone knowledgeable in Linux could've found that out, or the various locations it installed itself to

To refute your point: Malware can get its hooks into Windows in a variety of different ways, and removal often requires specialized tools. For example, I had to remove one of those hideous fake-antivirus programs from a neighbor's computer. Real antivirus was no help. MalwareBytes Anti-malware couldn't get rid of it. Going into Safe Mode and manually cleaning things out didn't even work. I had to search the Internet and use a specialized tool to finally uproot that crap. (And, while I trusted it, the removal tool could have also been malware, I had no way to tell)

So: Linux gets infected, smart user can eliminate it. Windows gets infected, smart user still needs to rely on either antivirus or malware-specific removal tools.

Re:At least it was fixable.

[FreelanceWizard]

I'm afraid not. The reason this malware is easy to remove is because it doesn't do anything truly wretched, like patch libc and other applications, install a rootkit kernel module, and the like.

Having dealt with Linux boxes that have been hit by automatic exploitation tools that go well out of their way to hide their presence, I can tell you that no matter what the operating system, the standard advice holds: once the machine is infected, the only sure way to get it back to a known state is to restore from a backup made prior to the exploitation or to wipe it completely and start over. I should also point out that these machines were rooted through the exploitation of previously-patched vulnerabilities in setuid services -- which is the exact same vector many Windows worms use, including Slammer and Conficker.

The only difference between the tools I've run into and a full-on worm is that they run at the command of a cracker and scan IP address ranges of his choice. With a bare amount of automation, they could become very successful Linux worms, breaking into all those machines that, say, have old OpenSSH binaries that haven't been patched against its known remotely exploitable vulnerabilities.

Re:At least it was fixable.

[MMC Monster]

It's easy to get this to a whole bunch of Ubuntu users. Scary easy:

1. Create a repository for a new build of a popular program which doesn't have it's own repository, such as nightly builds of Firefox or Handbrake.

2. Update the repository as you normally would for the builds of the above application.

3. Create a trojan piggybacking on an application which is always installed on Ubuntu, such as Transmission. Give it a version number higher than the one in the standard repository.

4. Since your repository is already trusted, the next time the system is updated, your trojan version of Transmission is automatically installed.

Like I said. Scary easy.

Re:At least it was fixable.

[Anonymous Coward]

with modern viruses you really do have to start digging into the registry. modern viruses now also include retrovirus style attacks that inject themselves into the AV system as well. I foresee when viruses start adding MAD philosophy, similar to how in biology a parasite will kill the host if it is removed.

The antivirus industry would be in deep trouble if the computer equivalent of a guy with a bomb strapped to his chest started to become popular.

Re:At least it was fixable.

[quacking duck]

Before trolls start yelling about how "OMGZ LINUX ISN'T SECURE HAHAHA" and things like that, let me tell you something: because GNU/Linux is so open and configurable, malware like this can be very easily removed. All you have to do is run a few commands in a terminal to remove this.

Before trolls start yelling about how "OMGZ WINDOZE AV SOFTWARE IS COMPLICATED HAHAHA" and things like that, let me tell you something: because Windows is so accessible, AV software like this can be very easily deployed. All you have to do is click a few icons in the Start Menu to remove this. Blah, blah, blah

On Linux and the like, everything is simple if you already know what you want to do. Otherwise, you have to trust unaccountable internet entities to provide you abstruse commands to run and hope they aren't trying to trick you into doing even more damage to your system. It should be obvious why that is a no way to combat malware.

Don't tell our IT manager that AV is very easily deployed after today.... He spent 2 frustrating hours on the phone with Symantec (plus 3 hours on hold before that--yay "enterprise"-level support) trying to get one of their products deployed across our small network.

Re:At least it was fixable.

[Blakey Rat]

How small? At some point you just put down the damned phone and walk the CD from cube to cube. (Not an ideal solution, but, hey, it's a solution.)

Re:At least it was fixable.

[quacking duck]

About a dozen client machines. I don't know if CD installs onto client machines were an option with this product.

But you never know beforehand just how much time you're going to waste on tech support. I don't think he expected consumer-level support for an enterprise-level product.

Re:At least it was fixable.

[RMS Eats Toejam]

All you have to do is run a few commands in a terminal to remove this. On Windows and the like, things are so complicated that Anti-virus software is almost required to remove some of their malware.

Another lie often repeated here. It's not easy to remove for the average user who has no idea where installed files go in Linux. It's also not easy for people like you who don't have advanced knowledge of how to fix problems in Windows because you are a Linux user.

Re:At least it was fixable.

[armanox]

Which is why we have anti-virus and such on Linux as well. A healthy dose of paranoia...

Re:At least it was fixable.

[orange47]

um, they should know what sudo is because they used it for installing the trojan..

Re:At least it was fixable.

[cbhacking]

Indeed. In fact, since things like rm (or for that matter, glibc) are open-source, it's a lot easier for an attacker to develop a modified version that simply can't see the malware, or fails with a "file not found" (or does something else weird, like renaming it instead of deleting it) when you run the removal command. This is the basic idea of a rootkit, and unlike on Windows, it doesn't require reverse-engineering the system or anything - just a little knowledge of C and a working build toolchain. Really serious rootkits modify the kernel so that system calls which would normally reveal the malware don't. The only way to remove something like that is to either inspect to volume from an uncompromised system, or get closer to the hardware (block-level access, for example, though even that could be subtly edited).

Re:At least it was fixable.

[Anonymous Coward]

I am no expert on neither Linux or Windows. But for me copy/paste/enter one command in terminal IS more easy than your "Removing Malware is easy, just go into the registry's run section, remove what looks suspicious, delete temp files, prefetch, and search for the malware running process (Example: virus.exe) in the registry, and delete it"

So as a no-expert I would rather have problem in Linux and follow the guides from experts, easy as copy/paste/enter. While on Windows I would rely on AV software or try "your way" and probably get lost.

Re:At least it was fixable.

[ChienAndalu]

Only because this is some pretty unimaginative malware. What if the replaced sudo, dpkg and rm? Could you still trust these commands?

Re:At least it was fixable.

[Anonymous Coward]

open your filebrowser and clic the root mode, go to files ..., and delete them
open add/remove software, and remove app5552

Better?

Re:At least it was fixable.

[Anonymous Coward]

No vulnerability was exploited in this attack. It was pure social engineering.

On another matter, the Ubuntu forums are down right now. Coincidence? - or retaliation by the aforementioned scriptkinder.

Re:At least it was fixable.

[Bent Mind]

The main difference between windows and linux is that the linux kernel has so many different versions, and not all distros are using the same one, so that it's hard to choose which kernel vulnerability to exploit. if 99% of people used linux, and were using the same distribution (with mostly the same kernel), believe me, these exploits would exist, and we would see viruses hitting linux machines over the network.

So, what you are saying, is everyone using the exact same code on their computers is a security risk. That if 20% used Windows, 20% used Ubuntu, 20% used BSD, 20% used OSX, and 20% used something else, overall security would increase. It makes you wonder why everyone insists on running the exact same code.

Re:At least it was fixable.

[jp10558]

I think the point here is you can either
a) Know what you're doing
b) have someone who knows what they are doing lock it down and make any changes for you.
c) Hope nothing bad happens

Now, many many more individuals are OK with b) when it comes to their car, their house, etc, but not their computers.

Then again, there are many c)s as well, listen to NPR Car Talk sometime ...

Re:At least it was fixable.

[Rennt]

Otherwise, you have to trust unaccountable internet entities to provide you abstruse commands to run and hope they aren't trying to trick you into doing even more damage to your system.

Or you do some reading and actually learn something. Being spoon-fed isn't the only option. Especially on Linux.

Re:At least it was fixable.

[Rennt]

...because linux applications have never had holes allowing someone to get a shell on a system, and users are always running the most up to date kernel that has no root exploits available for it.

Pretty much yeah. One thing that linux distros get right is automatic security updates by default. People actually respect these updates so if its connected to the net, its patched. Windows has auto updates too, but for one reason or another people don't trust security updates from Microsoft, so its not unusual to find systems that have NEVER been patched.

Otherwise, a pretty accurate assessment.

Re:At least it was fixable.

[Drakin020]

I've never had to use a tool to remove a virus. The thing is, those tools are designed to remove some of the key entries of the virus, but it's still just registry keys and temp files. I've seen those fake anti-virus programs, and if you know your way around the registry, you CAN remove it without the need of a 3rd party tool.

Re:At least it was fixable.

[armanox]

Symantec does not provide CD's cooperate anti-virus

Re:At least it was fixable.

[philipgar]

It would increase "security" (through obscurity) for the same reason it would make everyone's life a living nightmare. It would be a royal pain to get anything to run properly on more than a small group of people's machines. While Microsoft has many versions of their OS out in the wild, they do a MUCH better job than the linux community does of preserving backward compatibility. If you wanted to install a new version of gimp or some application on a version of redhat from 10 years ago, you'd likely have to replace half the system. However, installing gimp on Windows XP works fine... It would probably even install fine on Windows 98....

Phil

Re:At least it was fixable.

[philipgar]

or the fact that the people who run linux are the "computer geeks" who see playing with their computer, and securing it as a hobby, whereas Windows users tend to see a computer as a tool to do XYZ, and get annoyed when anything gets in the way of them accomplishing their task.

Phil

Re:At least it was fixable.

[schotty]

Sadly the single user Linux/BSD versions are horrid and borderline useless. The decent ones are all 25/50 license packs minimum. Trust me, every month I pester them all about making at least the CLI version available for sale at the standard $40-50/yr cost that the full Win32/Win64 versions cost. Nobody is sofar. I would prefer to release my repair shop from needing a copy of Windows on any of my repair systems, since ALL other tasks can be done in Linux (or BSD for that matter, and Solaris).

Re:At least it was fixable.

[armanox]

I have found Avira's Antivir UNIX to work quite nicely, although I do not have the paid for version (nor do I use it commercially).

What the summary didn't mention...

[AlgorithMan]

What the summary didn't mention: the screensaver has been there less than 24 hours.
see pro-linux.de (german)

Re:What the summary didn't mention...

[FlyingBishop]

Damn. Score one for Linux then.

Patch news...

[ghostis]

The Gnome team is working with several university neurology departments to develop a patch for human nature that fixes this problem. It will be included in Gnome 4.

Re:Patch news...

[kai_hiwatari]

awww......i was hoping it'd come in Gnome 3 :p

Re:Patch news...

[refactored]

The Gnome team is working with several university neurology departments to develop a patch for human nature that fixes this problem. It will be included in Gnome 4.

Don't you mean "Genome 4"?

old chinese proverb

[Anonymous Coward]

You can't patch stupid!

It is exploiting a weakpoint that can be resolved.

[Anonymous Coward]

The tools exist that would have rendered this form of attack useless.

Linux has out lasted many forms of attack already. Hardening of the package system to prevent such problems is not hard.

Simple point is a lot of infection vectors don't exist into Linux. Package manager is one of the major targets left.

"And before everyone jumps on the "but you can't get infected by just browsing on porn sites on linux!", why not? What was the last time you got infected by Windows vulnerability? Those attacks are usually against 3rd party programs like PDF or Flash. And guess what, those apps are on Linux too and are just as well exploitable."

If you system is setup right you cannot. Browser inside a selinux sandbox. The tech to shut all this crap down is waiting in the wings. Just up until now there has been no critical need to deploy. Massive amount of damage risk can be contained.

Linux response the threats enabled more secuirty.

Fine-grained privileges

[noidentity]

I want a mainstream OS that allows fine-grained privileges for programs. Why should I have to give my screensaver permission to do anything except display graphics, and perhaps read some data files from its own directory?

Re:Fine-grained privileges

[Dice]

You want SELinux. It's enabled by default in, for example, Fedora.

From the description I do not believe that it would have helped in this instance, however. The screensaver was distributed as a system package which would have allowed the package's install runtime scripts to set everything up with whatever privileges the author desired.

Re:Fine-grained privileges

[Hatta]

What we need is a package manager that lets users install packages if they don't require writing anywhere that requires root privileges. If I can download a tar, compile it, and run it from ~/bin, I should be able to install packages that do the same.

O/S Permissions Model Broken - try plash

[_greg]

The idea that software that I have no opportunity to audit runs with my privileges when I run it is fundamentally broken. There is no way to clean malware that had a network connection long enough to hide a trojan anywhere and then overwrite itself to appear relatively innocuous. While a complete redesign of the way permissions and permission-delegation would be ideal, it is not practical in the short term. Using systems like http://plash.beasts.org/ can help.

Re:The Elegance of Programming

[sexconker]

There is an easier (read: more elegant) way to get rid of this Linux malware:

sudo rm -rf /

Pussies.
rm -rf /
works fine for me!

Why can't we call it what it is...

[mysidia]

It's a Trojan Horse

Malware is a generic term for malicious software.

But the notion of Trojan applies here; you download a seemingly innocent program, but it contains a hidden nefarious payload.

AV software makers love it, because it means that once software gets classified as Malware instead of an actual virus, they don't have to worry about detection and safe removal anymore, that's another program's job...

Re:Why can't we call it what it is...

[jim_v2000]

Malware is an all inclusive term for viruses, trojans, adware, spyware, etc.

Spot the anachronism

[welshbyte]

Given that screensavers just help to drain your laptop battery, waste energy and have no practical use these days (unless these people have ancient monitors which are succeptible to screen burn) why do people keep using them and why are they still a feature of modern operating system distributions? Monitor and graphics card power saving features should be all that's needed.

Re:Spot the anachronism

[the_womble]

X-screensavers includes one that is supposed to reverse the LCD equivalent of screen burn. I run it occasionally. It makes the screen flicker, and will probably hospitalise any epileptic who sees it.

That just goes to show

[dandart]

Use your repos or you'll be as defenceless as the rest of them!

Re:The Elegance of Programming

[kai_hiwatari]

wow! how this rated as informative? sudo rm -rf /will delete everything from your system drive

No biggie, Ubuntu

[harris s newman]

I'll not worry until Linux hackers attack Linux. A windoz hacker attacking Linux is a joke. Good luck with that.

WTF?

[soundguy]

Who the hell runs screensavers these days anyway? This isn't 1995. Modern monitors don't need "saving". Log out and/or shut down the display if you're not actively using the account.

STILL more safe than Windows.

[ilsaloving]

Linux and Mac *are* still more secure that Windows installations. There's a difference between social engineering attacks and vulnerabilities that are exploited without user intervention.

You can't eliminate the former without locking down the user so badly that they are no longer in control of their computer.

The latter can and has been stopped very effectively through various, simple, defensive techniques. The most obvious such technique is to not give the user 100% access to the system by default. You have to put solid effort in order to infect a *ix based system. Meanwhile Windows users can be rootkitted by doing nothing more than visiting a completely legitimate website that unknowningly has a malicious banner ad.

Re:The Elegance of Programming

[Anonymous Coward]

There is an easier (read: more elegant) way to get rid of this Linux malware:

sudo rm -rf /

Pussies.
rm -rf /
works fine for me!

Indeed, rm -rf / works great for most people because it suffices to remove all the files the current user actually can.

That said, I don't know how it came that my lame joke above was honored as being informative; but this has since been corrected. Although I don't consider it as being flamebait, it's more like, err, a lame joke. Troll would be fine with me. ;)

Donloading Patchs is almost a no brainer

[Anonymous Coward]

The system checks for updates every day, an icon appears showing the intended updates and once given the OK the system takes care of everything. Yoj can even tun on automatic updates and have no intervention. It a disservice to suggest applying software updates is difficult with the average linux system. I might also add the system checks updates almost everything installed on your system.

Re:Donloading Patchs is almost a no brainer

[Thinboy00]

That's only through the repository.

Granted, there are big (well, maybe not) warnings about installing debs not through a repository (saying things like "you won't get updates").

Point is, if the user would just do what the OS tells them to, said user wouldn't be in this mess.

So, i need to install the package first?

[Anonymous Coward]

> DO NOT RUN THIS SCRIPT UNLESS YOU HAVE INSTALLED THE .DEB IN QUESTION.
>
> * sudo rm -f /usr/bin/Auto.bash /usr/bin/run.bash /etc/profile.d/gnome.sh index.php run.bash && sudo dpkg -r app5552

Okay, will do.

Re:So, i need to install the package first?

[Anonymous Coward]

I see what you did there...

Re:So, i need to install the package first?

[Anonymous Coward]

^ Don't run this.

Unsigned package, I presume

[adaviel]

Yes, that's how to make a nonprivileged exploit (mess with .bash_profile etc.) Ideally, the .deb package should have been digitally signed, and the person who signed it should have checked to make sure it was safe. Then if you only install packages from trusted repositories and check the sigs, you are safe (unless the signing keys are hacked, which happened to Fedora. Or they were playing safe, in that they might have been hacked. I forget) In practice, that only works for corporate deployment (protection against autohacking of the entire client PC base). People will always download toys without checking the provenance.

Re:The Elegance of Programming

[Nutria]

Woosh!!!!

Holy SHIT!

[Anonymous Coward]

Time to run yum install clamav.
(shivering and scared)

A friendly tip

[Anonymous Coward]

Don't bother with him. jedidiah is a known anti-ms troll.

Basic computer security

[Anonymous Coward]

The problem is NOT that GNU/Linux is insecure, the problem is that some users refuse to learn how to properly administer their systems. The weakest link in any operating system is the user. I've outlined some basic security practices that everyone should use. Computer security is a process, not a product.

"I downloaded it from rpmfind"

[Culture20]

The quote in my subject line is from a user who was allowed complete sudo access. I can't remember the "it" in question, but it was an rpm that wasn't from our distro back then. The machine was reimaged, the user was instructed that rpmfind et al is the *worst* choice for software installation, and sudo access was restricted to one specific command with pre-set parameters.
Looks like this .deb came from a similar site (for sceensavers).

It IS "more safe" at the moment

[dbIII]

What Mac and Linux "zealots" claim is that it's not likely to get malware in Linux/Mac just by browsing a site, opening an e-mail, or just by keeping the computer on and connected to the network

We claim that because it is currently true for a variety of reasons, if nothing else the stuff out there now is not compatible with anything except for MS windows.
Unix has a long history of a lot of different exploits and reactions to fix various holes made that style of system quite secure before Win NT was written. The superior security now is simply due to there being more of a tendancy to learn from mistakes and giving it a higher proirity than backwards compatibility. There is also little in *nix that is driven by marketing pressures that meant stupidity like Active-X or early versions of MS Outlook did not emerge on those platforms. The challenge is to keep it secure from whatever emerges.

"cleansing your system"

[Lost Race]

For those affected, both sites also provide instruction on cleansing your system.

There's only one way to "cleanse" your system of malware once it's infected:

1. Boot from known-good media (i.e. pressed CD from OS distributor)
2. Block-erase hard drive(s)
3. Re-install OS
4. Restore documents from backup

Any malware that can auto-update itself can potentially install anything at all. It could, for example, set up a file-sharing node which caches illegal data files on your system.

Re:"cleansing your system"

[istartedi]

You forgot to verify the BIOS checksum.

Although most malware probably doesn't go that far, it seems like if I really wanted to "pwn yur box", I'd at least patch rm to not delete my executable and instead simply fool the user into thinking it was gone. Patch ps to not display the process.... and general other rootkit mischief. I'm not terribly familiar with that kind of thing, but I assume there are people who have made it their life's work to hide executables on Linux, whereas I KNOW there are people who've made it their life's work on Windows.

The only real solution, IMHO, is to drop-kick the computer out the door and use parchment and a quil pen for all your correspondance. Let's see 'em hack the Amish.

Re:"cleansing your system"

[Anonymous Coward]

That won't help if the malware is capable of infecting the BIOS as well.
I mean, if you're going to go to extremes...

This assumes your desktop is themeable.

[tlambert]

This assumes your desktop is themeable.

"It is more of a social engineering thing - trying to trick unsuspecting users to install a malicious script by hiding it as a theme or screensaver."

Not all desktops are themeable. Apart from security, this is also a good thing when a user calls into technical support, and the person answering the phone needs to be able to tell them which icon they need to click on and where it is/should be located on their desktop. Only desktops which support/permit themes need to worry about trojans in theme bundles.

-- Terry

Re:The Elegance of Programming

[Anonymous Coward]

I think you missed his point.. he was making a joke that he doesn't have to use sudo because his account is root.

Security is like sex

[argent]

Security is like sex. Once you're penetrated you're ****ed.

When you install software, you're having unsafe sex.

Don't do it lightly.

Re:Security is like sex

[Anonymous Coward]

Sex?
Don't know anything about that, could you describe security with a car analogy please?

Re:Security is like sex

[argent]

Yo, listen up, installing software is like giving a brother the pink slip to your ride.

Re:Security is like sex

[drinkypoo]

This underscores a gigantic advantage of Linux. If you "only" install software from the collection of hundreds to thousands of packages included with your distribution, provided you're using one of the majors or a derivative, then you can have a reasonable expectation that you will not receive a trojan. The average user will never need anything they can't get from Ubuntu, for example, except for perhaps some things they will need from medibuntu. Even that, I admit, is something of a hassle, but the default-least-trust model for installing software is a big win.

Re:Security is like sex

[BlueParrot]

Did we not establish a while back that "abstinence only" doesn't work ?

Redux from 1996

[Anonymous Coward]

I think there was a Windows screensaver with a virus in it back in 1996...or maybe even more recently. Linux, you have a long way to go if you're going to become famous for being insecure.

Busted

[mwolfe38]

I remember reading an ask slashdot post about a week ago in which the poster asked if releasing linux malware out into the wild was an ethical thing to do or not. Looks like we've got somebody to blame. Personally though, I blame the idiots who download screensavers, especially a "waterfall" screensavers.

Interesting...

[jonaskoelker]

Gnome team is working [...]] to develop a patch for human nature that fixes this problem.

I suspect they've decided that a free will is unusable and will replace it with sane defaults ;)

Question for those who are in the know...

[Anonymous Coward]

Does Ubuntu still have the horribly in-secure default setting of caching elevated privileges for a time after sudo is invoked? This allows malware like this to lurk in the user-space and wait for the invocation of sudo - thus never requiring elevation to completely own the users system.

that was fast, was it not?

[Pharago]

if in doubt ask this guy, he/she may or may not have something to with these news xD http://ask.slashdot.org/story/09/12/01/0025213/Ethics-of-Releasing-Non-Malicious-Linux-Malware

No matter how well you build the O/S

[Akita24]

You still can't fix stupid. Stupid is forever.

Close call

[yamfry]

Good thing I don't have to worry about that. I use Linux!

FTFY

[10101001 10101001]

"A confusing command ... which most people would [copy] is actually a pretty good way to get a virus onto a ... newbie's computer."

Re:FTFY

[selven]

I agree, no OS can hope to be secure from user stupidity. I'm just pointing out that command line commands are the big Linux vulnerability in this area.

Computers to the populace...

[Letalis001]

Are appliances, they are tv's, washing machines, a glowing toaster if you will. most people could care less how the thing functions so long as it works, and the only time they do care is when it doesnt. thus, the people who create malware, viruses, spyware and the like will always have a market for this. as for linux, lack of popularity really is its saving grace. if MacOSX and Linux shared equal parts of the desktop market with Windows, its a guaranteed fact that the people who create the above would be making them for all three respectively to get the maximum amount of damage/profit. and as long as people do not care about how a computer works, its equivocal to handing a child a loaded gun and telling them to have fun. its all fun and games untill little Bobby blows his hand off.

Linux holds the majority for Web servers

[DJRumpy]

Your argument would work except for that fact that Linux holds a majority of web servers, yet they are arguably more secure than their Windows counterparts, with more vulnerabilities and infections being reported on Microsoft systems. Central points of access would always be the preferred infection vector to workstations.

Just check, forum down

[MooPi]

Forum is down at this moment. hmmmmm. Could it be retaliation?

Trusted sources

[arcofile]

Spank me. Weren't those "free" screensavers a big source of malware for Windows users? If you install any file on Linux, you've got to say "yes". If you get it from a dodgy source, it can be malware, just like in Windows, and you are the one who gave it permission to do what it wants. DEBs, RPMs, it doesn't matter, they are just like "setup.exe" files on Windows. Get them from a sleazy source and install them and you are just asking for trouble. The problem here is the source. Gnome-look is trusted by many people and is almost always safe, but something slipped past their radar here. I only use respectable repos and sources. I'd have thought Gnome-look to be one of them. Maybe they need to be more careful. They can lose that trust if they let things like this happen. I guess I'm glad I am happy with the normal screensavers available on Linux.

Is KDE going to do something similar?

[Provocateur]

Jes sayin'...

But come on, have them GNOME guys steal all the thunder? Lookin for a new sensation?

Linux not trivial to disinfect

[Mathinker]

> check the (graphical, so-easy-to-use-a-caveman^H^Hgrandma-could-do-it) Gnome startup programs tool for suspicious entries

If you think that this is the only way a user account can be infected under Linux, you are very naive. I, myself, can think of about 7 additional ways to do it. The only way to be totally sure is to open a new user and very carefully transfer only non-virulent things like bookmarks (and to know what is non-virulent you have to have more knowledge than "Grandma" --- e.g., you don't want to transfer bookmarklets).

Now that I think about this, Linux needs someone to develop a tool for this purpose. It wouldn't be all that hard to do if you were happy to severely limit what can be transferred. Probably the hard part would be the explanation why the other stuff which the use wants cannot be transferred safely.

OTOH, even this is not foolproof, because the tool would either be useless, or would let you transfer bookmarks to web pages which could infect you via Flash (since it is not possible for the program to know if a web page is safe, and even if it would be at the time checked it could change).

Don't be naive

[Mathinker]

Even if one can assume that the infection has been safely sandboxed to the user account in question, it is theoretically impossible to discover all the possible ways the user account could have been compromised (exactly like it's impossible to discover how a compromised OS is infected).

You're already the second poster I've seen here (the first chronologically, tho) with this erroneous idea, see my reply to the first one.

Good timing, there

[Mathinker]

Funny how the latest patch being pushed for Ubuntu includes a vulnerability where any system which is installed on an ext4 filesystem is vulnerable to privilege escalation.

Good timing, there!

And yes, I agree that Linux systems get patched more frequently and my guess is that the percent of Linux systems which are actively patched is greater than with Windows. Doesn't change the argument in a qualitative way.

No OS which is usable is is totally secure.

Re:Not more safe - yes it is

[Anonymous Coward]

On Linux a program belongs to user and runs with user privileges, which implies 0 acess to system area. On the other hand, on Windows anything can modify everything. A one-liner script that broke loose through your browser can wipe out entire system (or take full control of it). True, Linux is not a panacea, but surely will stop 95% of things that install themselves on my Windows computer until they bring it to a grinding halt.

Oh wow, first post!

[Alex Belits]

I see, now Microsoft marketing subcontractors click faster than trolls' scripts.

Too bad, their "arguments" are still total crap.

And?

[chucklebutte]

So this makes what now 10 or so if that Viri/Mal/Spy/Trashware on *nix distro's to the 10,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000 on the Windows X series? Just checking.

Are systems with SELinux affected?

[Anonymous Coward]

SELinux (Security Enhanced Linux) was supposed to help in those situations, by having tight restrictions on what programs where can and cannot do.
Anyone has any idea if that's the case?

you know what i'm commenting on.

[wentzr]

so ubuntu is the new windows. what damn good way for a "community" to shoot itself in the foot.

Good News

[savvyart]

Finally, the year of Linux desktop is coming. Even malware authors are taking notice and creating trojans and sneakware, so indeed linux adoption is up, yay!

Re:Of course the ninja was infected...

[Anonymous Coward]

Yes, all 3 of them :)

You've invented the iPhone

[_merlin]

You'd end up with a horrible, unfair review process, and people would complain no end about their right to run whatever they want on their computers being violated. Besides, if you wanted a reasonable amount of software to be available, there's no way they'd be able to review everything completely.

Says sopssa the Windows 'zealot'

[Anonymous Coward]

Hey, don't take offence. I'm a zealot too. We zealots should stick together no matter the OS and leave the others to their confusion.

Linux needs a "Zone Alarm" like program

[TractorBarry]

> keep itself updated via downloads

I keep boring people with this point and I'm going to keep doing so until the Linux peeps get it. Linux needs a program that performs the same function as Zone Alarm. In other words no program on a desktop system should be allowed to connect to the internet before the user has okayed it.

One of the first things I do when a non tehcnical friend asks me to help with their Windows PC is to install Zone Alarm simply because it will prompt you before a programm cann connect to the network or internet. I then explain that if they don't know what a program is, or why it's trying to connect to the internet, don't let it. You can always change your mind later and you can always google it, or ask me, to find out what the program is and what it does.

This has stopped numerous malware infestation getting serious (i.e. downloading their real payload) I believe there's very little real malware nowadays that doesn't require 'net access to do it's work (reporting personal information such as credit card details, being a node in a botnet etc.) so having a gatekeeper between programs and the network should be a primary design consideration of all desktop systems.

Without this functionality it's just a matter of time before the first serious auto updating Linux virus problem occurs. It might well be harder to get a root infestation on a Linux box but does this matter ? A userland program can steal information, participate in a botnet etc. quite adequately for most purposes. If it's well written and consumes little in the way of resources a user probably wouldn''t even notice either.

On Windows Zone Alarm acts like a nightclub bouncer for 'net access. Meanwhile on Linux any old program gets full internet access without the user knowing a thing.

Re:Linux needs a "Zone Alarm" like program

[Bent Mind]

Linux needs a program that performs the same function as Zone Alarm

It is called Netfilter and it is built into the kernel. For low-level configuration, take a look at the iptables command. Several hundred programs offer "simpler" configuration tools, from command line to GUI. Take a look at the L7-filter for application layer packet classification.

Re:Linux needs a "Zone Alarm" like program

[oojah]

I suspect the GP is talking about the interactive features of Zone Alarm. My understanding is that it only allows outgoing network traffic from known executables that the user has allowed. If an executable hasn't requested network access before, or if an executable that previously asked for access and was granted it but has now been modified (an upgrade/overwritten by malware/...) then Zone Alarm will ask the user again if network access should be granted. It also notes that the executable has previously asked for access and that the file has changed since the last access. L7 filtering is a good start, but it's the user interaction at the time of network access that makes Zone Alarm really useful.

Re:Linux needs a "Zone Alarm" like program

[word_virus]

Linux already has one - it's called Firestarter and it's great. Integrates with the gnome desktop and let's you specifiy a per-process inbound and outbound access policy. It's in the main ubuntu repos last time I checked, but that was Hoary... Check out it here.

Re:Linux needs a "Zone Alarm" like program

[Bent Mind]

I suspect the GP is talking about the interactive features of Zone Alarm.

Yea, I should have caught that. I wonder if TuxGuardian is more what the GP is looking for. From their site:

TuxGuardian was developed after the observation that Linux security applications were not tailored for lay users. With TuxGuardian you'll be able to implement access control policies to the network resources in order to identify and control every application that tries to access the network.

I remember seeing a conversation in the UBuntu forums a while back. It was talking about how application level firewalls didn't offer much protection. Someone had asked about Zone Alarm for Linux. The reply was that it would be difficult to implement because many of the tools you want to access the net can also be used to do Bad Things. For example my Linux distribution uses wget to download updates. However, wget can be used by any script to upload information from your system or download payloads. If you block wget, you block both the good and bad applications that make use of it.

Zone Alarm checks to see if the binary has changed since it last connected to the net. This is good. However, does it also check all of the settings? Wouldn't it be possible to construct an application in Windows that seemed beneficial to end user and had the ability to update itself over the net? The application binary wouldn't need to change to do Bad Things. It could be a data file it uses, or a different site it points to.

I've seen some conversation concerning the restrictions available that can isolate an application to prevent this kind of damage. SELinux seems like a match. It is difficult to set up. However, it can control what various applications can access. AppArmor offers similar protection based on path names.

Yes

[Make]

The reference policy has a module for xscreensaver, and it's very tight - it doesn't allow network access.

Windows ok, but no pron?

[spynode]

I don't visit sites that are prone to malware, and I use safe searching habits.
Well that doesn't sound very professional.

Re:The Elegance of Programming

[ais523]

Actually, it won't. Deleting / is such a ridiculous operation that most modern copies of rm need a special command-line option to let you do it. (I'm slightly worried that it might recurse and try to delete other files/directories, though.) (Incidentally, there was an interesting bit of POSIX rules-lawyering to show that that interpretation of rm was legal; the idea is that it necessarily deletes the current working directory, and rm is allowed to act differently when the user tries to delete the current directory.)

Re:The Elegance of Programming

[Anonymous Coward]

I think you missed his point.. he was making a joke that he doesn't have to use sudo because his account is root.

No, I didn't. I just wanted to point out that doing the rm thingie as root is not necessary to get devastating results. Although it helps ...

App store for windows: YES!

[DrYak]

Well do you really want the iPhone like only-approved-software app store for your computer? With no way to download software from anywhere else than that said approved app store.

Yes. A huge big bold YESSSS!!!!!

As long as there are *several* such app stores that a user can choose to trust. (Say, Microsoft's official, Steam, a Google one with Chrome, Firefox and other cool OSS, etc.)

---

Well, software only from stores *and* self-compiled software, to be more precise. That's the way I work in Linux. But I wouldn't expect 99.99% of windows users to care about- or even understand what is- compiling software.

GNOME gconf safe?

[Anonymous Coward]

So it's no surprise that GNOME with its Windows Registry clone gconf is a target?

openSUSE Zypper and repository switch

[DrYak]

4. Since your repository is already trusted, the next time the system is updated, your trojan version of Transmission is automatically installed.

It'S fun you mention this because, interestingly enough, the latest package manager from openSUSE, will only install an update from a different repository than the original software if :

1. the user explicitly asks for it.

2. if the new version is required by some dependencies we can't be solved by the original repository, in which case the package manage issues a warning to the user.

If the users see :
"Warning, 'Fluffy Pet Screensaver' depends on 'Transmission >=99.99' which is only available on 'Fluffy Pet Screensaver repo', a different repository from 'openSUSE 11.2' where it was installed from"
most of them will have suspictions.

Though some Windows-UAC trained users will probably yes-click-through.

Perfect example of the Fedora problem

[BitZtream]

This is a perfect example of why allowing users at the console to install system wide software without requiring a password is a bad idea.

All it takes is this happening on one the already listed repos and you've got your vector into systems via stupid polkit choices.

Let's try again

[dbIII]

For some reason malware got on there before the antivirus could deal with it the first time around. They went online to buy the antivirus and by the time I saw it the thing couldn't even stay on for more than three minutes unless it was in safe mode.

what is the check/cure

[Anonymous Coward]

Doesn't anybody running linux want to tell me "the cure"?

Like please answer:
    1. How can such malware be detected on Linux once installed?
    2. How can one configure the system so as to be prevented?
    3. What can be done to remove it?

I run "clamscan". Anyone wanna comment on that. Because I don't have a clue what it does... but it seems to check for something.

Anyone?
Any useful info between the chatter?
Anything?

ok, well I guess you can go back to your nit pickin' now.

There are easy solutions for this

[Anonymous Coward]

This is not a problem, not even a threat at all.The good thing about FOSS is that there are thousands of contributors and developers. Will this kind of things happen often, would be easy to implement review procedures, create "digital approval stamps" for every single file and place them at safe site locations for download.

What a crock of CRAP

[Anonymous Coward]

Oh bullshit. You can remove just about anything, easily, using Process Explorer (by using its DLL lower view pane, & freezing any DLL/lib called by an infested process, so no IO is going on between the calling infected process & the malware lib/dll, then freezing/pausing the malware .dll/lib itself, & deleting it using Explorer.exe or a cmd.exe tty console prompt to delete its file on disk & regedit.exe to remove any registry entries it uses. It can also be traced in its complete operations using Process Monitor as well, in case it uses something else, like an .ini file to store "state" for itself) OR Recovery Console on Windows if need be even, doing the same.