Slashdot Mirror
Damn Vulnerable Linux — Most Vulnerable Linux Ever
An anonymous reader writes "Usually, when installing a new operating system, the hope is that it's as up-to-date as possible. After installation there's bound to be a few updates required, but no more than a few megabytes. Damn Vulnerable Linux is different; it's shipped in as vulnerable a state as possible. As the DVL website explains: 'Damn Vulnerable Linux (DVL) is everything a good Linux distribution isn't. Its developers have spent hours stuffing it with broken, ill-configured, outdated, and exploitable software that makes it vulnerable to attacks. DVL isn't built to run on your desktop – it's a learning tool for security students.'"
Don't tell my boss.
Or use a fresh install of XP.
So it's like Fedora then.
We used it in my Forensic Computing masters program in some classes, definitely useful in our Network Security and Architecture of Secure Operating Systems classes to show what can happen with buffer overflows, gaining root access, etc.
"Its developers have spent hours stuffing it with broken, ill-configured, outdated, and exploitable software that makes it vulnerable to attacks. DVL isn't built to run on your desktop" is a chillingly accurate description of embedded systems design; but the risk you cite seems exceptionally remote. If the embedders are clueless and barely paying attention, they'll just default to the OS or distribution with the highest mindshare, which won't be this. If they are not clueless and barely paying attention, they'll select something approaching the right tool for the job, which won't be this.
A good rule of thumb is that you know you packed too much if your retinue for carrying your luggage needs more food per meal than one person can carry alone.
A notable team of security researches are suggesting windows users migrate to a platform known as DVL. "DVL is a mess. It is vulnerable to a variety of attacks, but it is still more secure than the average windows install". Another researched pointed "Windows users must migrate to DVL immediately, in order to protect their computers".
While several independent research groups are considering DVL as a valuable alternative to windows, Microsoft didn't stay behind, and promised to use DVL as the base of Windows 8, the upcoming version of windows. A spokesperson for Microsoft notified that microsoft decided to use DVL after thoroughly analyzing it, "It provides a great building block for the next release of our greatest product, DVL certainly fits like a glove within our strict security and QA policies".
Windows 8: DVL Edition, the most secure windows version ever released, is scheduled to hit the shelves next summer.
WTF am I doing replying to an AC at 5 A.M on a Friday night?
till Microsoft uses it in get the facts comparisons?
The best ideas are common property
Something philosophically similar which could be created is some sort of "weird arch" Linux for code debugging purpuses.
Like something with 16bit chars and ints, non-0 NULLs... Perhaps running under an emulated invented weird architecture with strange byte order (non-LSB/MSB) and weird alignment issues.
I wonder how many software would break.
Basic knowledge for whom?
I'm not the most technical guy around, but I try to keep up on things (certainly WRT Linux, as it's my main OS), and I'd never heard of it. Of course, I'm not in school studying security concepts either, so there ya go.
We are working on a honey pot module for Damn Vulnerable Linux, it should be coming out soon ;-)
Basically log all activity to a network server while hiding the fact that we are doing it. Just refresh from a fresh image once in a while. Once an intruder is noticed, we can give him as many rights as we want in real time, especially with regards to network connectivity, which is done at the firewall level. It is a nice way to get a good grip of what is running in the wilderness of the internet. If you are lucky enough, you can even learn about unpublished exploits although I would use a up to date distro to specifically discover these.
Everything I write is lies, read between the lines.
0x11223344 was stored in memory as 0x33 0x44 0x11 0x22
I did it all for the NUXI (come on) the NUXI (come on)
So you can take that cookie and stick it up your (yeah).
This will bring Linux to the desktop!
would it be ClosedBSD?
"The problem with socialism is eventually you run out of other people's money" - Thatcher.
Apple will *always* have its fans to prop the company up, at least marginally.
Back during the Scully era I had a co-worker that worked on a Quadra, and no matter how many times a day we'd all hear the "bunnng" restart sound coming from his cubicle (at least 4 times a day), he swore it was the best thing ever and that's all he was ever going to use.
Of course, now Apple has an entirely different demographic with their iPods, iPhones and now iPads, so who knows.
My bet's on the fans though. Apple would have to really mess up to drive them away. This latest iPhone trouble isn't going to phase them. Seriously, how many times have we read posts from users parroting "A fix is coming out, so no worries"?
DVL is mentioned quite regularly when the topic of securing Linux or webservers in general comes up or in topics discussing specialized distributions.
IIRC he last Slashdot article where it was explicitly mentioned was less than 3 weeks ago.
And I develop web applications for a living. Certainly not a Linux security expert but one has to have at least some knowledge of the tools of one's trade. ;)
I was thinking it might be fun to make a linux distro like this. I would have called it "OpenLinux - Opening your Systems to the World!"
What did Consumer Reports say about DVL? I predict its either "No thanks, we'll pass, not vulnerable enough." or "Excellent! The most vulnerable OS yet!"
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
You just know MS is going to count the vulnerabilities in this distro against Linux just like how they count one vulnerability which affects 10 distros as 10 vulnerabilities because 10 warnings get sent out.
This was in the list of "most interesting linux distros" posted here maybe two weeks ago. Sigh.
For every problem, there is at least one solution that is simple, neat, and wrong.
Now they have something they can favorably compare themselves against!
"This Linux has all these bugs in it and they haven't repaired ANY of them!"
Chas - The one, the only.
THANK GOD!!!
At my last job, the "boss" was too cheap to purchase a descent VPN solution (I later convinced him to buy a Cisco ASA5520), so I deployed a series of IPCop servers... one as a firewall and one as a VPN server. Between the firewall and VPN Server I had fronted an old Pentium 2 based Windows 2000 server in the DMZ to give the appearance that an attacker, had they gotten through, would have figured they hit the "honeypot". I ran this configuration for almost a year and had one attacker get through because I had not patched my IPCop firmware soon enough to cover a LAMP exploit running on it, but they none the less only stopped at the Windows 2000 server and loaded a bunch of mail relays on it. One quick re-format, an IPCop patch, and some E-mails to SORBS and I was good to go again.
Distributions such as Damn Vulnerable Linux will not only help students, they will be a great asset to SMB's wanting something to do front similar topologies as mine to keep the bad guys out. I am sure there are other uses for DVL out there.
Good job DVL team!
Ebola and/or AIDS. Even more choices!
testing out my trending skills
Enough said, I think. It'll take a while to get rid of that image.. :)
Insert
Basic knowledge for whom?
Slashdot readers, for example.
Something like this is a good learning tool. I fully support the idea. Make people think. I know alot of old hats might have a diffrent view but I think this has potential as a skill builder.
I blithely expect them to fill in themselves the implied "a number of above zero and up to but probably below 100% of".
Insert 10 year outdated cheap shot against Microsoft here.
How many people had more than one PC in their home in '03? Sure we now have 3 or 4 netbooks laying around the house, a couple iPod touches, a few old laptops and 3 half-dead PCs in the back room, but 52 year old, rural moms had (and probably still have) the one PC sitting sitting in the den, plugged directly into their dsl modem. Most people view routers as a way to get more than one device onto the internet, not a device that controls the flow of traffic.
I hope they kept a ledger of all the broken things, so that you could technically grade a student by what he fixed and set up property compared to what was done to break it...and then see how good a student he was...or how creative.... cool idea though!
It's all just fun with exploits until someone burrows through the giant's eye.
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
Any reasonably alert admin can easily secure a Linux system with Mandatory Access Controls via AppArmor or SELinux. And no, it's not the rocket science people make it out to be ... it's now very straightforward, with one or the other approach (often both) being well supported in every major distro. And profiles for most major apps are easily found, or even if you need to develop one, it's just not that hard
Is there an equivalent in Windows? (asking honestly) I never hear it talked about. When I read about the sandboxing being applied to recent versions of IE (which is a good thing), it sounds like an app-specific version of the same concepts. But is there a general ability to define and constrain resource requirements/access rights for any app? Or are Windows systems reliant on one-off app-specific implementations, and at the mercy of the product producer for such?
"Ahh! I see you're in that indeterminate Schrodinger state where - oh, uh
LOL.
Anyway, we often did straightforward trips that included the food transported in a trailer or pickup truck. Nevertheless, consistently buying more food than necessary has been one of our logistical issues.
One of the rules *was* that we needed to be able to move the personal gear ourselves (both quantity of gear and how it was packed.)
I listen to both RIAA and non-RIAA stuff if I like the music, tangential business/politics nonwithstanding.
Which release of Ubuntu is it based on?
Hey All, This article prompted 30K downloads of DVL and is going to cost me thousands in bandwidth overage fees. As a result, I'm looking for donations while I fight with my hosting provider to get the costs cut. You can read more here: http://www.computerdefense.org/2010/07/ive-become-a-cyber-pan-handler/ If you downloaded DVL and appreciated the direct download link, a few dollars would go along way to helping out :)
THanks,
Tyler.
ComputerDefense Blog - http://www.computerdefense.org