Slashdot Mirror
Damn Vulnerable Linux — Most Vulnerable Linux Ever
An anonymous reader writes "Usually, when installing a new operating system, the hope is that it's as up-to-date as possible. After installation there's bound to be a few updates required, but no more than a few megabytes. Damn Vulnerable Linux is different; it's shipped in as vulnerable a state as possible. As the DVL website explains: 'Damn Vulnerable Linux (DVL) is everything a good Linux distribution isn't. Its developers have spent hours stuffing it with broken, ill-configured, outdated, and exploitable software that makes it vulnerable to attacks. DVL isn't built to run on your desktop – it's a learning tool for security students.'"
Heheh, previous story says:
"More than a year after Microsoft issue a patch to cover privilege escalation issues that could lead to complete system takeover, a security researcher plans to use the Black Hat conference spotlight to expose new design mistakes and security issues that can be exploited to elevate privileges on all Windows versions including the brand new Windows 2008 R2 and Windows 7."
WTF am I doing replying to an AC at 5 A.M on a Friday night?
Something philosophically similar which could be created is some sort of "weird arch" Linux for code debugging purpuses.
Like something with 16bit chars and ints, non-0 NULLs... Perhaps running under an emulated invented weird architecture with strange byte order (non-LSB/MSB) and weird alignment issues.
I wonder how many software would break.
Seriously, I once attempted to see how long it would take to get a fresh install of XP hijacked on a virtual box. After about one hour of bad IE6 surfing on suspicious sites (would you like to download and run this? yes please) I had one or two pieces of malware installed that had taken over the computer completely, filling the screen with popups and disabling all kinds of system configuration tools.
A while back, IIRC, there was a story about the different ways that vulnerabilities are counted in Linux vs. Windows. There have been various MS-sponsored "studies" which sum the total number of vulnerabilities for all distros, so that if, for instance, the same vulnerability exists in Debian and Fedora, it's counted twice. (Likely much more than twice, since if it's in Debian, it's probably in all the Ubuntus too.) Meanwhile, of course, Windows vulnerabilities only get counted once. So don't be at all surprised to see stories along the lines of "5000 new Linux vulnerabilities discovered!" coming from the astroturfers soon.
The correlation between ignorance of statistics and using "correlation is not causation" as an argument is close to 1.
Pretending you are secure using DSL is just stupid.
Your PC will be owned in 24h or less(how many rootkits are installed by default?). My web and ssh servers get attacks searching for common vulnerabilities constantly since the day I started them and they aren't even live yet. If they had been running any vintage version of Linux it would have been automatic pwnage.
I wonder if streaming a Tb or two of good quality PRNG data into a bot or a "security researcher"'s computer would get me into any problems. They always seem so sad when they find nothing to grab. They are the ones making the HTTP or SSH request it's not my fault they discover my RNG server ;)
That's not the point. The point is that if you actively download and run random stuff from the web, it doesn't tell much about the security of the OS if you get lots of malware.
However, I can imagine that the first sort of widespread malware on Linux will be cross-platform Firefox extensions. It shouldn't be too hard to write an extension that does something users want, but also contain some malicious code. That code would have full access to anything you browse, including your banking site and all passwords to various web sites, and it could silently send that data to an arbitrary place, or silently manipulate it. If the extension is otherwise useful, people may install it. For example, how many people have inspected the source of NoScript before they installed it? And of every update as well? I haven't. I installed it because it has functionality I want, I've read lots of recommendations, it has lots of users, and it is on the official Mozilla add-on site. Also the fact that this add-on is quite complex and very actively maintained and developed is IMHO a indication that it's not just a way to introduce malware. However, what if someone would manage hack the web site and push a slightly modified version as update? Note that this would hit exactly those people who are least likely to get other malware.
There's a reason why I created a second profile in Firefox where absolutely no extensions are installed. That's what I use for online banking.
The Tao of math: The numbers you can count are not the real numbers.
So all anyone really wants to know after reading your post is: "Are you a simply an ignorant moron, or are you a troll as well?"
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
A few years ago, around 2006/7, I worked in a (UK) school doing IT support. One of the guys in the science department was some kind of Linux geek. He had a Red Hat server running on the school network for some reason or other, I forget what, and he had requested and been given an external IP address on the network so that he could get in from home and do... whatever.
So, one day the big talk is that the local education authority, who provided the Internet connection, have been getting calls from the US Department of Defence wanting to know why they're getting hundreds of thousands of hits to some of their servers from this address block. The education authority traced it to the school and we traced it to this guys Red Hat server and pulled the plug. I didn't get a good look at it, but it was running a 2.4 kernel well into the 2.6 days, so I'm guessing there were plenty of other things that were out of date on there.
I don't know whether you'd lay the blame on the science teacher or the admin who let him put that box on the network with an external IP address and then didn't spot oodles of outgoing SSH attempts or whatever, but one way or another someone took it on trust that someone else knew what they were doing with Linux when they clearly didn't.