Slashdot Mirror
Duqu Attackers Managed to Wipe C&C Servers
Trailrunner7 writes with an update in the saga of Duqu and Stuxnet. From the article: "Shortly after the first public reports about Duqu emerged in early autumn, the crew behind Duqu wiped out all of the command-and-control servers that had been in use up to that point, including some that had been used since 2009. An in-depth analysis of the known C&C servers used in the Duqu attacks has found that some of the servers were compromised as far back as 2009, and that the attackers clearly targeted Linux machines. All of the known Duqu C&C servers discovered up to this point have been running CentOS ... There also is some evidence that the attackers may have used a zero-day in OpenSSH 4.3 to compromise the C&C servers initially."
Damn, not the command and conquer servers. My weekend is fried.
To offset political mods, replace Flamebait with Insightful.
I ran kippo on SSH. Hell of a honeypot, with the ability to replay sessions to watch how hackers think.
Editors, your job is not simply to click "post." Read the submission and see if it makes sense. I have no idea what Duqu is or what this is about. I had to dig down 2 links deep to see that this was related to an attack in India. Context: provide it.
rooooar
You never need your server directly on the internet.
put it behind a firewall with holes poked through. they can't attach a zero day SSH exploit if the only hole is port 80 to Apache.
And if you are one of the incredibly rare cases where you really do need to have the machine on the net directly.. I suggest daily security audits.
Do not look at laser with remaining good eye.
The first thing you do in C&C is build walls around your MCV so engineers won't get it. Seriously, guys.
>All of the known Duqu C&C servers discovered up to this point have been running CentOS
Probably since this is a popular OS for web hosts that resell/sell servers. Who are the people who buy these server? Well anyone and everyone who wants to be another web host yet have no idea on how to secure a server so they hire some $40 per month security company to secure their servers. There must be 1000's of those servers out there ripe for raping.
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
Using complicated combinations of bugs / software features in code submitted to open-source projects by your own team is also an option for hi-tek low-profile teams like this. Especially if you're a secretly-government-sponsored team.
Am I the only one who is kind of worried about the whole stuxnet/duqu thing? We've been hearing/hypothesizing about the dangers of "cyber-warfare" (as much as I hate the term) for a while, pretty much since the beginning of Internet malware, but it seems as though recently shit has finally started to hit the fan, first with increasingly worrying allegations about Chinese hackers and such, and now with this (which seems to be the doing of the US/Israel, at least a lot of people think it is).
If things continue along this trend, one could expect a really bleak future for the Internet where major world governments and other well-financed organizations have virtually unlimited power to do what they like with any computerized system, and continually carry out covert attacks against each other. It seems the only thing that could prevent that from realizing would be some major game-changing advances in computer security, but I'm not seeing any indication that that's likely to happen...
weinersmith
4.The servers appear to have been hacked by bruteforcing the root password. (We do not believe in the OpenSSH 4.3 0-day theory - that would be too scary!)
5.The attackers have a burning desire to update OpenSSH 4.3 to version 5 as soon as they get control of a hacked server.
Ah yes, lets pretend there is no problem because the idea that there is, is too scary. Someone kill me, please. The only other reason I can think of, which also ties in with the fact they were appently checking the man page for sshd_config is that something changes in the default settings between 4.8 and 5 and this they wanted desperately, but even then this would point to some sort of exploit. *(Maybe an exploit in the way the default settings are in centos, rather than in openssh).
- http://www.milkme.co.uk
"An in-depth analysis of the known C&C servers used in the Duqu attacks has found that some of the servers were compromised as far back as 2009, and that the attackers clearly targeted Linux machines" - Posted by Unknown Lamer on Wednesday November 30, @11:46AM
from the nsa-reads-slashdot dept. FROM THE MAIN ARTICLE ITSELF
Current proof that Linux's NOT "invulnerable secure" yet again, & yes, that Linux does get targetted by malwares...
(Despite all the "FUD" you see & have seen for YEARS now on this website from the "Pro-*NIX/Penguinista" around here!)
Linux gets "hit" by the worst kind too, in these "blended-threat tech" types, that use rootkits that employ drivers + bogus bootsectors shown in this article today...
Plus - the entire LAMP stack doesn't do well http://www.theregister.co.uk/2011/06/10/domains_lamped/
(especially Apache lately -> http://apache.slashdot.org/story/11/11/28/0335213/apache-flaw-allows-internal-network-access & earlier still here http://www.theregister.co.uk/2009/09/03/apache_website_breach_postmortem/ ).
* Yes - Any OS' is securable, & far better than they come by default (yes, even SeLinux, but you have to go beyond its mere defaults to make it better, + MacOS X too (Apple produces guides for that in fact)), however/again:
The years of hearing how "secure" OpenSores/LAMP is around here was totally unrealistic & a blatant lie based on the information above, & yes, below next too!
APK
P.S.=> Top that off with this current information from this year 2011 also:
---
KERNEL.ORG COMPROMISED:
http://linux.slashdot.org/story/11/08/31/2321232/Kernelorg-Compromised
---
Linux.com pwned in fresh round of cyber break-ins:
http://www.theregister.co.uk/2011/09/12/more_linux_sites_down/
---
Mysql.com Hacked, Made To Serve Malware:
http://it.slashdot.org/story/11/09/26/2218238/mysqlcom-hacked-made-to-serve-malware
---
---
Linux's showing in CA's breached recently too? Ok:
http://uptime.netcraft.com/up/graph?site=StartCom.com
http://uptime.netcraft.com/up/graph?site=GlobalSign.com
http://uptime.netcraft.com/up/graph?site=Comodo.com
http://uptime.netcraft.com/up/graph?site=DigiCert.com
The majority (4/5) of what was breached RAN LINUX (StartCom, GlobalSign, DigiCert, & Comodo)... per these articles verifying that:
http://itproafrica.com/technology/security/cas-hacked/
---
Toss ANDROID (yes, a Linux since it uses a Linux kernel) also, since it's being "shredded" on the mobile phone security-front rampantly for years now? You get the picture...
... apkb
I was just restarting my Red Alert install into a VM.
I didn't have time to click the links in the summary.
Dude... you got a dell...
Not the Music Factory! How will we know when to dance now?
That makes me think twice about skipping on that Redhat license.
Perhaps the folks at Cent should be checking their logs.
I am very small, utmostly microscopic.
1. Don't run services you don't need. This goes for all systems, including Windows.
2. If you do need sshd running, install denyhosts.
3. If at all possible, run sshd on a nonstandard port.
#3 keeps the logs quiet from bots trying to jiggle a door handle that isn't there on 22.
--
BMO
Here's the post I just made to Kaspersky labs:
I found this very interesting, having followed the link from slashdot. Two details stand out, esp. after speaking to my manager about the sshd business: first, why would they yum update openssh, since you report they installed 5.8 from an ubuntu/debian source package. CentOS 6, like RHEL 6, is running 5.3p1 (with all known security fixes backported by upstream)?
Secondly, my manager agrees with the previous poster: you update to prevent other attackers' access. After all, their attacks might break your attack.
Finally, this indicates very, very bad password policy on the part of the compromised servers. If these belong to corporations, management should be looking very hard at why they were so easily broken... and why they're not running brute-force resistance, such as fail2ban.
mark
N/T
(INB4 "lmgtfy": The question was rhetorical. I don't care.)
"Have the balls (or ovaries) to stand up for what you said." - by MMAfrk19BB (2029982) on Wednesday November 30, @12:09PM (#38215854)
Oh, I always do (&, lol, it'd be the FORMER here) - & the facts from reputable sites that have them documented I use, do the job for me, the best, in that regard...
Plus, pretty much everyone here knows who I am (been around here since 2003-2004) by this timeframe... many of the "penguins" around here can't stand me because I use documented undeniable current information, like in the 1st post of mine here you replied to!
(However, I imagine the slashdot editors & owners just LOVE me, because controversy generates pageviews, which I pretty much always "generate" here by using facts Penguins can't deny w/out their std. effete retaliatory trolling off topic illogical adhominem based attacks they have to resort to when they cannot disprove the facts I use, does that much, easily!)
Also, as far as registering?
Hey - I honestly don't feel I actually gain anything by having a "registered 'luser'" account here really!
(Other than losing out on granting mod points, which I can merely say "good job" in reply to folks as needed by writing it out, or, even recommending those with mod points mod the poster up).
APK
P.S.=>
"f I had mod points I would give them to you for actually linking articles that prove your point" - by MMAfrk19BB (2029982) on Wednesday November 30, @12:09PM (#38215854)
First of all: Thanks!
I've already seen it go from +1 Interesting, to 0 Interesting, to +2 Interesting (quite the "roller coaster ride" eh?) back down to +1 Interesting ratings!
(So 'feedback' is coming per your point in upward mods - the downmods are doubtless from "the Penguinista" trying to bury the documented current & verifiable facts I posted, most likely).
---
"That being said, anyone who thinks that FOSS is $DEITY's gift to security by default is mistaken. Nothing is safe until someone competent configures, patches, and hardens it correctly." - by MMAfrk19BB (2029982) on Wednesday November 30, @12:09PM (#38215854)
Agreed, 110%, & I've been doing guides for securing Windows since the mid to late 1990's, & they do VERY well online:
To "immunize" a Windows system, I effectively use the principles in "layered security" possibles!
http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE
I.E./E.G.-> I have done so since 1997-1998 with the most viewed, highly rated guide online for Windows security there really is which came from the fact I also created the 1st guide for securing Windows, highly rated @ NEOWIN (as far back as 1998-2001) here:
http://www.neowin.net/news/apk-a-to-z-internet-speedup--security-text
& from as far back as 1997 -> http://web.archive.org/web/20020205091023/www.ntcompatible.com/article1.shtml which Neowin above picked up on & rated very highly.
That has evolved more currently, into the MOST viewed & highly rated one there is for years now since 2008 online in the 1st URL link above...
Which has well over 500,000++ views online (actually MORE, but 1 site with 75,000 views of it went offline/out-of-business) & it's been made either:
---
1.) An Essential Guide
2.) 5-5 star rated
3.) A "sticky-pinned" thread
4.) Most viewed in the category it's in (usually security)
5.) Got me PAID by winning a contest @ PCPitStop (quite unexpectedly - I was only posting it for the good of all, & yes, "the
I would think this points to an exploit in SSHD 5.x, not 4.3. Once I brute-forced into a system, I would think the first order of business is to ensure I can get back in if the password is changed, not to patch the little-known exploit I used to get in in the first place.
You won't hear an argument/debate from me on what you said, because I am in utter full agreement with it.
APK
P.S.=> Been "locking them all down" since the mid 90's in fact, per guides like these I have offered for Windows 2000/XP/Server 2003/7/Server 2008 users:
To "immunize" a Windows system, I effectively use the principles in "layered security" possibles!
http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE
I.E./E.G.-> I have done so since 1997-1998 with the most viewed, highly rated guide online for Windows security there really is which came from the fact I also created the 1st guide for securing Windows, highly rated @ NEOWIN (as far back as 1998-2001) here:
http://www.neowin.net/news/apk-a-to-z-internet-speedup--security-text
& from as far back as 1997 -> http://web.archive.org/web/20020205091023/www.ntcompatible.com/article1.shtml which Neowin above picked up on & rated very highly.
That has evolved more currently, into the MOST viewed & highly rated one there is for years now since 2008 online in the 1st URL link above...
Which has well over 500,000++ views online (actually MORE, but 1 site with 75,000 views of it went offline/out-of-business) & it's been made either:
---
1.) An Essential Guide
2.) 5-5 star rated
3.) A "sticky-pinned" thread
4.) Most viewed in the category it's in (usually security)
5.) Got me PAID by winning a contest @ PCPitStop (quite unexpectedly - I was only posting it for the good of all, & yes, "the Lord works in mysterious ways", it even got me PAID -> http://techtalk.pcpitstop.com/2007/09/04/pc-pitstop-winners/ (see January 2008))
---
Across 15-20 or so sites I posted it on back in 2008... & here is the IMPORTANT part, in some sample testimonials to the "layered security" methodology efficacy:
---
SOME QUOTED TESTIMONIALS TO THE EFFECTIVENESS OF SAID LAYERED SECURITY GUIDE I AUTHORED:
http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=2
"I recently, months ago when you finally got this guide done, had authorization to try this on simple work station for kids. My client, who paid me an ungodly amount of money to do this, has been PROBLEM FREE FOR MONTHS! I haven't even had a follow up call which is unusual." - THRONKA, user of my guide @ XTremePcCentral
AND
"APK, thanks for such a great guide. This would, and should, be an inspiration to such security measures. Also, the pc that has "tweaks": IS STILL GOING! NO PROBLEMS!" - THRONKA, user of my guide @ XTremePcCentral
AND
http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=3
"Its 2009 - still trouble free! I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008. Great stuff! My client STILL Hasn't called me back in regards to that one machine to get it locked down
I've already seen it go from +1 Interesting, to 0 Interesting, to +2 Interesting (quite the "roller coaster ride" eh?)
I bet you host one hell of a party, Alex.
U use off topic illogical adhominem attacks, vs. facts I use http://it.slashdot.org/comments.pl?sid=2551740&cid=38215752 which are documented, current, & undeniable.
(Gosh: I wonder who wins? NOT!)
---
"1. Please try again with a coherent critique of Linux security rather than a spittle spraying rant. I might read it and take it seriously." - by c0d3g33k (102699) on Wednesday November 30, @12:15PM (#38215916)
Funny, but I used nothing but documented facts on Linux security from this year (with ANDROID even more), vs. your off topic illogical adhominem attack attempt on myself...
---
"2. You seem to have an agenda here, and have convinced yourself that it is validated. Good for you (pat on head)." - by c0d3g33k (102699) on Wednesday November 30, @12:15PM (#38215916)
Your off topic illogical adhominem attack actually does that for me, & validates my 1st posts' documented current undeniable facts (that Linux security is being torn to shreds lately & the illusion of "security-by-obscurity" (lack of widespread overall usage on PC's & Servers combined)), which you apparently CANNOT DISPROVE...
LMAO, & you're left with attempting to attack myself (adhominem attack, very illogical), rather than the documented current facts I used to make that point (Linux != secure, despite years of FUD being spread here to mislead others it is).
---
"3. Schadenfreude is bad for your health." - by c0d3g33k (102699) on Wednesday November 30, @12:15PM (#38215916)
Trolling on your part, off topic illogical adhominem attacks & all, isn't helping yours (or your reputation I imagine).
---
"4. So ... what's your point exactly, and what do you expect people to do exactly if they happen to agree with whatever your point is?" - by c0d3g33k (102699) on Wednesday November 30, @12:15PM (#38215916)
Well, ok: Exactly what I've stated in my 1st post others have agreed & modded me up for: Linux is as vulnerable security-wise as ANY OS OUT THERE, unless you take active measures to secure it better (and it can be better, even SeLinux bearing Linux distros).
You've helped prove another point of mine though!
That point? Heh - that when Penguins are confronted by facts they cannot disprove? They become the trolls they TRULY are, as you have now!
(Trolling FUD spreaders that misled others for decades no less that "Linux = Secure")
Man... trolls always reveal themselves that way, as you have...
APK
P.S.=> So, that all "said & aside"? Well - If the "best you've got" is your off-topic illogical adhominem attacks, vs. very current documented + verifiable facts I use from reputable sources? You've proved another point for me!
Yes - that point being that when "penguins" are confronted by facts they cannot disprove? They become the trolls they TRULY reveal themselves to be (such as yourself & your reply does)...
Thank you for helping me make yet another point on that very note!
... apk
Funny how others feel differently (my init. post here's up to +2 Interesting @ this point in upwards moderation for example).
Others here tend to disagree with you over time as well as to the quality of my postings on /. here:
Roughly 75++ of them & I post as AC (hard to get even +1, as /. hides our posts & we "AC"'s start @ ZERO/0 points, unlike registered "lusers", lol!):
+5 'modded up' posts by "yours truly" (4):
HOSTS & BGP:2010 -> http://tech.slashdot.org/comments.pl?sid=1901826&cid=34490450
TESLA:2010 -> http://science.slashdot.org/comments.pl?sid=1872982&cid=34264190
TESLA:2010 -> http://tech.slashdot.org/comments.pl?sid=1806946&cid=33777976
NVIDIA 2d:2006 -> http://hardware.slashdot.org/comments.pl?sid=175774&cid=14610147
----
+4 'modded up' posts by "yours truly" (3):
INFO. SYSTEMS WORK:2005 -> http://slashdot.org/comments.pl?sid=161862&cid=13531817
WINDOWS @ NASDAQ 7++ YRS. NOW:2009 -> http://tech.slashdot.org/comments.pl?sid=1290967&cid=28571315
CARMACK'S ARMADILLO AEROSPACE:2005 -> http://science.slashdot.org/comments.pl?sid=158310&cid=13263898
----
+3 'modded up' posts by "yours truly" (6):
APK MICROSOFT INTERVIEW:2005 -> http://developers.slashdot.org/comments.pl?sid=155172&cid=13007974
APK MS SYMBOLIC DIRECTORY LINKS:2005 -> http://it.slashdot.org/comments.pl?sid=166850&cid=13914137
APK FOOLS IE7 INSTALL IN BETA HOW TO:2006 -> http://slashdot.org/comments.pl?sid=175857&cid=14615222
PROOFS ON OPERA SPEED & SECURITY:2007 -> http://slashdot.org/comments.pl?sid=273931&threshold=1&commentsort=0&mode=thread&cid=20291847
HBGary POST in Fake Names On Social Networks, a Fake Problem:2011 -> http://tech.slashdot.org/comments.pl?sid=2375110&cid=37056304
APK RC STOP ROOKIT TECHNIQUES:2008 -> http://it.slashdot.org/comments.pl?sid=1021873&cid=25681261
----
+2 'modded up' posts by "yours truly" (10):
HOW DLL API CALL LOADS WORK:2008 -> http://tech.slashdot.org/comments.pl?sid=1001489&cid=25441395
APK TRICK TO STOP A MALWARE:2008 -> http://tech.slashdot.org/comments.pl?sid=1010923&cid=25549351
DOING SHAREWARE 1995-2004:2007 -> http://it.slashdot.org/comments.pl?sid=233779&cid=19020329
MHTML SECURITY BUG FIX IE:2011 -> http://tech.slashdot.org/comments.pl?sid=1973914&cid=35056454
EXCEL SECURITY FIX:2009 -> http://it.slashdot.org/comments.pl?s
there are three things the "government" will never allow to function properly:
1. BIND
2. OpenSSH
3. the linux dekstop
by any means, even "under-cover" government spies posing as open-source programmers.
it's kind-of-like a missile defense shield but of cyberspace, isn't it obvious?
Alex is a performance artist, right? I mean c'mon, what kind of sad fuck would keep an actual log of his anonymous comments?
The compromised Linux servers were not attacked by bruteforce, but by a dictionary attack. Get a dictionary of say 10,000 common English words, and in automated succession try every one of them for the password. If its a common word, then you don't have to try millions or billions of unlikely words or jumble of letters that aren't normally a word, a mere 10,000 will do the trick. This is why security people insist on using passwords that aren't common words (or even uncommon words), but rather a mix of letters, numbers and punctuation: it defeats dictionary and ribbon table attacks.
1st: Topic here's not about Windows, it's about Linux having hosted Duqu's C&C Servers!
2nd: Said article (& my 1st post here ) use current undeniable documented information showing Linux's not as "secure" as was trumpeted about misleading others here for more than a decade now by many penguins (because security-by-obscurity was what made Linux perpetrate an illusion, of being 'so secure')... period.
3rd: Current history & documented facts I used from reputable sources in my intial post here:
http://it.slashdot.org/comments.pl?sid=2551740&cid=38215752
EASILY show that much... easily.
APK
P.S.=>
"You are absolutely right... A Windows machine with the default install and an easily guessable password would never have been compromised." - by Anonymous Coward on Wednesday November 30, @01:17PM (#38216768)
You might want to read my initial post here then & this "salient quote" here from myself:
"Yes - Any OS' is securable, & far better than they come by default (yes, even SeLinux, but you have to go beyond its mere defaults to make it better, + MacOS X too (Apple produces guides for that in fact)) - by Anonymous Coward on Wednesday November 30, @12:01PM (#38215752) FROM http://it.slashdot.org/comments.pl?sid=2551740&cid=38215752
That was from myself - ALL OS' out there in the "mainstream" can be security-hardened above their defaults OR vs. user/administrator screwups.
In other posts here:
http://it.slashdot.org/comments.pl?sid=2551740&cid=38216734
I merely "2nd that motion", that ALL OS' can be further "security-hardened"... & I even show guides I've been doing since 1997 online that help users do so!
(Not only on Windows mind you due to CIS Tool usage, a multiplatform highly esteemed tool for securing OS & more)
Those guides show how to security-harden Windows NT-based OS of "modern variety" (for decades now no less & yes, the guides work), & utilize a multi-platform JAVA driven security tool that's QUITE highly regarded/esteemed, that will do the same for other OS' too...
... apk
http://it.slashdot.org/comments.pl?sid=2551740&cid=38216998
APK
P.S.=>
"apk reveals that he keeps track of his comment moderations and pretends that they're Academy Awards. Alex is a performance artist, right? I mean c'mon, what kind of sad fuck would keep an actual log of his anonymous comments?" - by Anonymous Coward on Wednesday November 30, @01:46PM (#38217124)
They're useful for illustrating that many others here disagree with your initial comments (off topic illogical adhominem attack trolling ones directed MY way) on my posts' quality!
Via showing you're outnumbered 75:1 in your "opinions", off topic trollish ones though they are from you, here http://it.slashdot.org/comments.pl?sid=2551740&cid=38216686 are effete & useless...
Facts, documented undeniable ones such as I used vs. yourself and in my initial post on Linux security being shredded this past year alone?
Heh - they ALWAYS "blow away" trolls such as yourself... & all you're left with?? More trollish off topic illogical adhominem attacks, lol...
... apk
Seems ur a pot calling a kettle black by ur stalking my posts trolling off topic using your illogical adhominem attacks as you have been in replies to myself & others here, Mr. ac troll. Waste much time trolling? Yes, you do, contributing NOTHING to the topic @ hand whatsoever on YOUR part... pitiful & weak!
APK
P.S.=> It's "funny" (lol, NOT) how you cannot disprove the current documented undeniable data from respectable sources on Linux security failures I used in my 1st post here below (as well as those in the entire LAMP stack as well that rides on Linux):
http://it.slashdot.org/comments.pl?sid=2551740&cid=38215752
LMAO - you're off topic illogical adhominem attack based trolling reply "reactions", effete & useless as they are? They prove a point for me as well: Your trolling replies are how I KNOW I DID A DECENT JOB making my points, since that's all you have in response!
(Especially seeing my initial post's now up to +4 "interesting" ratings in upward mods too)
I simply use facts vs. off topic illogical adhominem attack utilizing ac reply based trolls such as yourself!
You?
You're merely resorting to such EFFETE & useless weak tactics, rather than attempting to disprove the facts I used (current & undeniable from reputable sources) - it shows me you are PARALYZED, & "U FAIL", as the saying goes, lol...
... apk
Nobody uses Linux on desktop essentially http://www.netmarketshare.com/operating-system-market-share.aspx?qprid=10
THUS , nobody bothers attack it on those grounds!
Simply because of that. Linux has been enjoying "Security-By-Obscurity"!
Penguins, here on /. especially for YEARS NOW, have attempted to mislead others on that note that "Linux = secure", when lately where it's being used, it's being shown as ANYTHING BUT THAT!
Per my 1st posts current, undeniable, & documented facts from reputable sources on that very note, here:
http://it.slashdot.org/comments.pl?sid=2551740&cid=38215752
and more over time also...
* FOR EXAMPLE: ANDROID however, being a Linux variant? It has become "the Windows of the smartphone world" in terms of usage/mindshare/marketshare!
(Thus, ANDROID, a Linux variant which uses a Linux kernel, shows that once Linux DOES get into the hands of "noob users" (for lack of a better expression, I am a "noob" too in various areas so not "putting them down" for being ignorant of things security on computers), it can be SHREDDED, & has been, for years on the very note I speak of - security by obscurity no longer works in Linux' favor there!)
It wouldn't on the desktop either were it higher than a 1.19% overall usage/marketshare/mindshare of the mass of both PC & Server usage... period.
APK
P.S.=> Hacker/cracker/malware makers (& the like)?
Hey - They're just like PICKPOCKETS near trains & in subways or malls + streets: They go where the MOST PEOPLE ARE (potential victims) & on PC desktops especially, that's Windows!
Linux doesn't qualify on PC desktops where the MOST vulnerable users are, not a worthy enough target because NOT ENOUGH USERS OF IT ON THE DESKTOP TO JUSTIFY THE TIME & EXPENSE ATTACKING IT ON PC DESKTOPS, not enough "ROI" for them!
Different story on smartphones though, again, look @ ANDROID being torn up security wise, month in & month out for YEARS now!
(Especially on end-user desktops, Linux just isn't used, & was "hiding behind 'security-by-obscurity'"... especially where the most easy victims ALWAYS are, on PC desktops usage, with they NOT being "security gurus" & OS' setup, by default, FAR weaker security-wise than they can be IF "security-hardened")...
... apk
http://en.wikipedia.org/wiki/Duqu
Duqu is a computer worm discovered on 1 September 2011, thought to be related to the Stuxnet worm. The Laboratory of Cryptography and System Security (CrySyS) of the Budapest University of Technology and Economics in Hungary, which discovered the threat, analyzed the malware and wrote a 60-page report, naming the threat Duqu. Duqu got its name from the prefix "~DQ" it gives to the names of files it creates.
Symantec, based on the CrySyS report, continued the analysis of the threat, which it called "nearly identical to Stuxnet, but with a completely different purpose", and published a detailed technical paper on it with a cut-down version of the original lab report as an appendix. Symantec believes that Duqu was created by the same authors as Stuxnet, or that the authors had access to the source code of Stuxnet.
More likely Duqu==Stuxnet==Stars. Same guys, different vulns, different tools. Duqu is an instance made from a lego-kit.
"People don't like your posts for several reasons." - by chill (34294) on Wednesday November 30, @02:45PM (#38217842)
Many others in this partial list below of my posts modded up over time, clearly shows otherwise:
---
Roughly 75++ of them & I post as AC (hard to get even +1, as /. hides our posts & we "AC"'s start @ ZERO/0 points, unlike registered "lusers", lol!):
+5 'modded up' posts by "yours truly" (4):
HOSTS & BGP:2010 -> http://tech.slashdot.org/comments.pl?sid=1901826&cid=34490450
TESLA:2010 -> http://science.slashdot.org/comments.pl?sid=1872982&cid=34264190
TESLA:2010 -> http://tech.slashdot.org/comments.pl?sid=1806946&cid=33777976
NVIDIA 2d:2006 -> http://hardware.slashdot.org/comments.pl?sid=175774&cid=14610147
----
+4 'modded up' posts by "yours truly" (3):
INFO. SYSTEMS WORK:2005 -> http://slashdot.org/comments.pl?sid=161862&cid=13531817
WINDOWS @ NASDAQ 7++ YRS. NOW:2009 -> http://tech.slashdot.org/comments.pl?sid=1290967&cid=28571315
CARMACK'S ARMADILLO AEROSPACE:2005 -> http://science.slashdot.org/comments.pl?sid=158310&cid=13263898
----
+3 'modded up' posts by "yours truly" (6):
APK MICROSOFT INTERVIEW:2005 -> http://developers.slashdot.org/comments.pl?sid=155172&cid=13007974
APK MS SYMBOLIC DIRECTORY LINKS:2005 -> http://it.slashdot.org/comments.pl?sid=166850&cid=13914137
APK FOOLS IE7 INSTALL IN BETA HOW TO:2006 -> http://slashdot.org/comments.pl?sid=175857&cid=14615222
PROOFS ON OPERA SPEED & SECURITY:2007 -> http://slashdot.org/comments.pl?sid=273931&threshold=1&commentsort=0&mode=thread&cid=20291847
HBGary POST in Fake Names On Social Networks, a Fake Problem:2011 -> http://tech.slashdot.org/comments.pl?sid=2375110&cid=37056304
APK RC STOP ROOKIT TECHNIQUES:2008 -> http://it.slashdot.org/comments.pl?sid=1021873&cid=25681261
----
+2 'modded up' posts by "yours truly" (10):
HOW DLL API CALL LOADS WORK:2008 -> http://tech.slashdot.org/comments.pl?sid=1001489&cid=25441395
APK TRICK TO STOP A MALWARE:2008 -> http://tech.slashdot.org/comments.pl?sid=1010923&cid=25549351
DOING SHAREWARE 1995-2004:2007 -> http://it.slashdot.org/comments.pl?sid=233779&cid=19020329
MHTML SECURITY BUG FIX IE:2011 -> http://tech.slashdot.org/comments.pl?sid=1973914&cid=35056454
EXCEL SECURITY FIX:2009 -> http://it.slashdot.
Funny how you never even mention all the "-1 Troll", "-1 Flamebait", "-1 Offtopic" posts that you've had and that are almost exact copy/paste of the aforementionned posts modded positively by clueless mods not knowing who and what you are ...
All these "-1-modded" posts largely conterbalance your list here above
Go Peter ! Go ! Now, just threaten to sue someone like you're used too (remember Jeremy, Thor and the others ?) and call me a troll without answering any of my questions, points and proofs that you're dead wrong on almost everything you say (you're right though : there is no such thing as a secure OS, be it OSX, linux, windows or BSD).
Keep up that awesomeness of yours Peter, we'll always love you and try do decipher your unreadable posts to make something out of it (not !)
On the Internet now, they call me "The One who kicked APK's ass" :-)
Ahem: Quoting Mr. Bruce Perens on that very note regarding this quote of yours:
"Funny how you never even mention all the "-1 Troll", "-1 Flamebait", "-1 Offtopic" posts that you've had and that are almost exact copy/paste of the aforementionned posts modded positively by clueless mods not knowing who and what you are ..." - by Anonymous Coward on Wednesday November 30, @03:04PM (#38218066)
I'll let Mr. Bruce Perens prove you wrong & he IS an "open sores" big-name:
"It just takes one Ubuntu sympathizer or PR flack to minus-moderate any comment. Unfortunately, once PR agencies and so on started paying people to moderate online communities, and to have hundreds of accounts each, things changed" - by Bruce Perens (3872) on Friday July 30 2010, @03:55PM (#33089192) Homepage Journal FROM -> http://linux.slashdot.org/comments.pl?sid=1738364&cid=33089192
That about explains MOST "downward mods" I have gotten, easily!
Especially considering the "flock of Linux Penguin trolls" that infest this place, & who are usually reduced 1st to offtopic illogical adhominem attacks as you have attempted to no avail using such WEAK & EFFETE "tactics"!
You trolls often use downmods in the end, rather than disproving documented current & verifiable facts from reputable sources I used here in my 1st post, often resort to "downmods" when they cannot disprove documented facts I use, per the next link:
http://it.slashdot.org/comments.pl?sid=2551740&cid=38215752
Just as you have done now... lol!
* Funny you're off topic using yet MORE illogical off topic adhominem attack attempts directed MY way rather than disproving my points based on current, verifiable, documented FACTS from reputable sources in the link above, eh?
LOL, not... This? Man, you KNOW I just GOTTA SAY IT, as is per my usual style vs. off topic illogical adhominem attack utilizing trolls such as yourself:
This was just "too, Too, TOO EASY - just '2EZ'"
Facts that are verifiable from reputable sources always do the job & reveal the "trollish mechanics" of online scum like yourself, everytime... it's all you can attempt to resort to in the end, and I just blow you away on those with more facts below too on your adhominem attack attempts... lol!
APK
P.S.=>
"Now, just threaten to sue someone like you're used too (remember Jeremy, Thor and the others ?) and call me a troll without answering any of my questions, points and proofs that you're dead wrong on almost everything you say"" - by Anonymous Coward on Wednesday November 30, @03:04PM (#38218066)
Funny how Jeremy Reimer who stalked me for years around the internet with other arstechnica members for stalking me online & more!
(E.G.-> Jay Little who got SHOT DOWN on facts on Exchange Servers who he literally said "I am an EXPERT on" didn't know that memory optimizers, from MS no less, unhalt frozen/stalled Exchange systems, & that Jarrett DeAngelis, then a doctoral CSC candidate @ Notre Dame & another "henchman" of Jeremy Reimer's agreed with 99% of what I noted on that note also).
Reimer was also caught libeling myself, impersonating myself (and others in a Mr. Martin Meszaros) on other forums & was caught + admitted it was not myself, making email threats & harassments my way across many forums, not just Windows IT Pro (along with Jay Little)!
This had his ISP (Shaw) put him on tracking tickets, had his local law enforcement in Vancouver Canada be advised of it - Funny how he STOPPED doing the above, had portions of his website removed (& Jay Little was entirely ousted on all of his sites from CrystalTech.com for it only to do it ag
Since for yrs. that went on here on /. & along the lines of "Linux = good/secure, Windows = bad/insecure!
That was purest FUD and bullshit, especially in regards to the current documented verifiable facts I posted here:
http://it.slashdot.org/comments.pl?sid=2551740&cid=38215752
To which I am getting in weak effete trolling retaliation, these types of responses:
---
A.) Technically unjustified mod downs on it seeing it from from +1, to 0, +2, to +3, & now +4 "interesting" ratings by others here now
OR
B.) Off-topic illogical adhominem attack attempts on myself in subsequent posts beneath it by trolls!
---
* Each trolling b.s. reply's simply failing weakly in resorting to either in the end!
(Especially since rather than disproving the documented current facts I used in my link above (ALL from reputable sources on Linux's security issues being exposed nowadays, rampantly...) all it seems the "penguins" can do, is act the trolls they are illustrating themselves to be, & weak/effete in doing so)...
U FAIL also, as the saying goes, on the same note!
APK
P.S.=>
"Yeah, go for it! You keep at it, pal!" - by Anonymous Coward on Wednesday November 30, @12:40PM (#38216232)
I will, & have AND have a +4 "interesting" rated post for it here (once more for your reference) currently:
http://it.slashdot.org/comments.pl?sid=2551740&cid=38215752
All you & yours have is off topic illogical adhominem attack attempts @ trolling & technically unjustified mod downs in response to its documented current facts that indeed show Linux is FAR from what it's been oft stated to be on /. here, for years:
Along the lines of "Linux = good/secure & Windows = bad/not secure" type FUD)...
* Each failing weakly in resorting to either in the end, rather than disproving the documented current facts I used in my link above (ALL from reputable sources on Linux's security issues being exposed nowadays, rampantly...)
Funniest part is, ANY claims I make have concrete, verifiable, current documented information from reputable sources in my initial post that's generated a frenzy of off-topic illogical adhominem attacks...
You? You have ZERO on that account as far as backing your alleged "points" (some of which I agree with, but the fact remains that Linux != what was said of it here FOR YEARS NO LESS, misleading others)
... apkb
Disprove the documented current facts from reputable sources I used here http://it.slashdot.org/comments.pl?sid=2551740&cid=38218414
Funny you avoid doing that eh? Can't be DONE is why!
---
* And, Yes, I freely admit that I've been banned from sites (the majority not, but a few over a 17++ yrs. long time online since 1994, & for a few years with a gap before it in academia in the 1980's)...
See, this will doubtless "escape you", since you troll as AC, but...
I figure you haven't LIVED until you have been banned from a forums!
OR
Rather, lived LIKE A MAN with some balls + faith in what he says!
(E.G.-> One like myself that doesn't try to hide behind AC trolling posts like yours, or using multiple 'usernames' rather than being himself!)
Heh - Trolls do that latter & it's widely known:
---
BBC News - Fake forum comments are 'eroding' trust in the web
http://www.bbc.co.uk/news/technology-15869683
---
OR HERE too (HBGary caught doing it)
An HBGary email that should concern you all:
http://www.dailykos.com/story/2011/02/16/945768/-UPDATED:-The-HB-Gary-Email-That-Should-Concern-Us-All
PERTINENT QUOTES/EXCERPTS:
"According to an embedded MS Word document found in one of the HBGary emails, it involves creating an army of sockpuppets, with sophisticated "persona management" software that allows a small team of only a few people to appear to be many, while keeping the personas from accidentally cross-contaminating each other. Then, to top it off, the team can actually automate some functions so one persona can appear to be an entire Brooks Brothers riot online... And all of this is for the purposes of infiltration, data mining, and (here's the one that really worries me) ganging up on bloggers, commenters and otherwise "real" people to smear enemies and distort the truth... "
and
"They are talking about creating the illusion of consensus. And consensus is a powerful persuader... And another thing, this is just one little company of assholes. I can't believe there aren't others doing this already. From oil companies, political campaigns, PR firms, you name it. Public opinion means big bucks. And let's face it, what these guys are talking about is easy."
and
"To the extent that the propaganda technique known as "Bandwagon" is an effective form of persuasion, which it definitely is, the ability for a few people to infiltrate a blog or social media site and appear to be many people, all taking one position in a debate, all agreeing, for example, that so and so is not credible, or a crook, is an incredibly powerful weapon."
---
* Nuff said, proofs in the pudding (via my usual style, documented proofs thereof of things I state, which you are welcome to disprove!)
APK
P.S.=> In the end, as per your stalking/trolling off-topic illogical adhominem attack using methods?
You're VERY easy to "dispatch" via documented facts + truths I use, & you only vindicate me vs. your off-topic illogical adhominem attacks even moreso, which ruins that for you also, easily (which only make you look a fool)...
... apk
Whew! A comment got moderated, I feel so ALIVE! THIS IS THE GREATEST FEELING IN THE WORLD. I can't believe people actually pay to go to amusement parks when they can get the same thrill by making posts on the internet for free.
Quotes of Reimer's words, from his original website, are cited in my source from WindowsIT Pro - see the link below!
(Which Reimer then moved his website, & started up again elsewhere on another hosting provider, iirc, himself now as Jay Little who did the same + suggested Reimer do that no less!)
Jay Little, Reimer's 'partner in crime' was ousted from CrystalTech.com for the same no less, suggested he do that (move site to another server, one of his own preferably)
In fact - the folks from CrystalTech told me that Jay Little & Jeremy Reimer would do that in fact (& they have, just be recidivistic criminals & start it on another server again!)
That's again, ALL here, quoted as it happened & from the original sources:
http://www.windowsitpro.com/article/internals-and-architecture/the-memory-optimization-hoax#feedbackAnchor
* Jeremy Reimer, & Jay Little did all of what I stated, impersonating myself & others, email harassing myself, making threats to myself, editing my posts on arstechnica (which I caught GOD & MWNH using the SAME EMAIL ADDRESS for doing, proving they're the same guy, lol) & it was documented years ago!
(Reimer can change servers or hosting providers all he wants to, & re-alter his website all he wants, but the facts are set in stone over @ Windows IT Pro... no getting around that!)
APK
P.S.=> Who are you trying to fool now? Yourself?? Please... lol!
... apk
For the case of most worms and other such automated attacks, moving your service from its default port is actual defense.
I can imagine worms that port scan looking for service signatures, but I haven't heard that that's common. Anyway, scanning lots of ports per machine would greatly slow a worm down or make an automated attack more obvious (showing up in more service logs).
I can just write one sentence, and make you waste your time responding with 10 paragraph rants. loladhominemhosts=>apkfartpoop
INFO. SYSTEMS WORK:2005 -> http://slashdot.org/comments.pl?sid=161862&cid=1353181
WINDOWS @ NASDAQ 7++ YRS. NOW:2009 -> http://tech.slashdot.org/comments.pl?sid=1290967&cid=28571315
CARMACK'S ARMADILLO AEROSPACE:2005 -> http://science.slashdot.org/comments.pl?sid=158310&cid=13263898
Check upratings++ if u dare...apk HOSTS
"Your rant has one HUGE hole." - by Jerry (6400) on Wednesday November 30, @05:51PM (#38220432)
Your mouth, lol (as well as your "trolling forums 'illogic-logic'"):
Clue/New News/Newsflash:
Linux is hosting Duqu: That's the topic!
Linux's victimized 2 victimize other systems that are targetted/susceptible by Duqu. More widely used ones, like Windows, & on systems overall on PC's + Servers on the most used hardware platform for them in x86!
My 1st post has documented recent facts regarding Linux's overall security track record the past few months now:
http://it.slashdot.org/comments.pl?sid=2551740&cid=38215752
In real-world security-breach scenarios on many levels ontop of the topic (inclusive of the sourcecode repository for Linux & the CA's (bad, bad, bad for SSL)).
(With ANDROID, lol, it's YEARS of nearly unending attacks/exploits too).
Anyhow, per that link above? Once more:
You're welcome to disprove the data there in my 1st posts' link above
* ... Good luck, lmao, you'll NEED it!
APK
P.S.=> Your argument has 1 huge hole: Your mouth (& b.s. that issues from it)...
... apk
"I understand you have provided useful and informative posts." - by chill (34294) on Wednesday November 30, @06:58PM (#38221000)
I look @ it more as posting simple undeniable truths (because I more often than not use backing documentation from reputable sources to support points I make in my posts).
---
"I was responding to YOUR assertion that the "Penguinistas" get up in arms about your posts. If they are a small minority, then why complain?" - by chill (34294) on Wednesday November 30, @06:58PM (#38221000)
Around here, on THIS site? /.?? Man, see my subject-line above... they're the MAJORITY here & have been for years to decade++ now!
---
"Why didn't you respond to my point that you were comparing well secured Windows systems to out-of-the-box Linux systems?" - by chill (34294) on Wednesday November 30, @06:58PM (#38221000)
They're ALL sent out not nearly anywhere as well secured as is possible is why... CIS Tool (try it sometime, it's multiplatform security benchmark based on industry best practices)...
---
"Posting links of compromised Linux systems doesn't "prove" anything. I can match every one with ten on compromised Windows systems." - by chill (34294) on Wednesday November 30, @06:58PM (#38221000)
Hmmm, but 1/100th of systems out there use Linux, thus, they're less of a target & not worth as much time (especially in the past) to target by "hacker/cracker" malicious types... not enough "ROI" attacking them @ the desktop home users level really (though Android shows otherwise, that once a Linux gets used more, it will be as attacked as Windows is on PC's &/or Servers).
Especially the most victimized market segment - Windows users, & mostly end-users @ home!
---
"However, in neither case can it be demonstrated that they were properly secured." - by chill (34294) on Wednesday November 30, @06:58PM (#38221000)
The same can be said for Windows boxes compromised over time, & the Linux examples I used PRETTY MUCH PROVED THEY WEREN'T PROPERLY SECURED BY BEING BROKEN INTO!
---
"You also didn't address my question of why you've been banned in the PC PitStop Forum" - by chill (34294) on Wednesday November 30, @06:58PM (#38221000)
I had an argument with a moderator iirc... that'll usually do it, but I could be wrong. People actually got "up in arms" about my being banned there though (which was nice), but no biggie - the owner & I are on speaking terms & have conversed via email before after it (regarding his working for NVidia or wishing too - he codes a decent diagnostic tool for video called GPU-Z is why).
---
"nor why I considered Linux superior for security" - by chill (34294) on Wednesday November 30, @06:58PM (#38221000)
I don't - it's mainstream kernel has more bugs & more unpatched bugs than does Windows over time, & again, per this article & others I cited from the past 3-4 months also show Linux security breaches like mad (important stuff too, like the linux sourcecode repository & CA's used for SSL!)
---
"-- because of the modularity that Windows simply does not have." - by chill (34294) on Wednesday November 30, @06:58PM (#38221000)
Linux doesn't the user mindshare or marketshare Windows does between Servers &/or PC's combined though, not anywhere NEAR it (1.19% for Linux, & what? 94.5% for Windows?)
---
"As for Android, a phone is a different environment." - by chill (34294) on Wednesday November 30, @06:58PM (#38221000)
It still shows that once a Linux is used more, it too can be turned into "security 'swiss-cheese'" (full of holes).
---
* There you go... nuff said!
APK
P.S.=> At least this dicussion wasn't a trolling off topic (totally) one like most replies I've gotten here so far... apk
The man who only posts as AC, or the man who only posts as AC and also praises himself as AC?
"Linux IS secure" - by Jerry (6400) on Wednesday November 30, @05:51PM (#38220432)
Jerry, this all puts your bullshit to rest easily with CURRENT information:
---
KERNEL.ORG COMPROMISED:
http://linux.slashdot.org/story/11/08/31/2321232/Kernelorg-Compromised
---
Linux.com pwned in fresh round of cyber break-ins:
http://www.theregister.co.uk/2011/09/12/more_linux_sites_down/
---
Mysql.com Hacked, Made To Serve Malware:
http://it.slashdot.org/story/11/09/26/2218238/mysqlcom-hacked-made-to-serve-malware
---
Linux's showing in CA's breached recently too? Ok:
http://uptime.netcraft.com/up/graph?site=StartCom.com
http://uptime.netcraft.com/up/graph?site=GlobalSign.com
http://uptime.netcraft.com/up/graph?site=Comodo.com
http://uptime.netcraft.com/up/graph?site=DigiCert.com
The majority (4/5) of what was breached RAN LINUX (StartCom, GlobalSign, DigiCert, & Comodo)... per these articles verifying that:
http://itproafrica.com/technology/security/cas-hacked/
---
Toss ANDROID (yes, a Linux since it uses a Linux kernel) in also, since it's being "shredded" on the mobile phone security-front rampantly for years now?
You get the picture...
* TOP THAT OFF WITH DUQU BEING SERVED FROM LINUX, PER THIS ARTICLE? You're FULL OF IT!
Period...
APK
P.S.=> Please Jerry: Your quote about "Linux is secure" BULLSHIT falls apart fast in light of the current information above about LINUX BEING ANYTHING BUT SECURE! Including its sourcecode, from kernel.org above...
... apk