Slashdot Mirror
Industrial Control Software Easily Hackable
jfruh writes "CoDeSys, a piece of software running on industrial control systems from hundreds of vendors, has been revealed to be easily hackable by security researchers, giving rise to a scenario where computer hacking could cross the line into the physical world. Worse, many of these systems are unneccessarily connected to the Internet, which is a terrible, terrible idea."
Kaspersky says they'll come up with a new OS specifically designed to protect industrial control systems from hacking and sabotage.
http://www.pcmag.com/article2/0,2817,2411052,00.asp
Now you're just being paranoid. Instead, you should develop an artificially intelligent system to defeat would-be attackers and malicious software. That sounds like the best idea.
- Skynet
It's not necessary.
Mostly random stuff.
PLC = programmable logic controller
...that they'll come up with something, the REAL solution has NOTHING to do with what they're talking to.
The OS isn't just the problem. It's the SCADA applications themselves as well. Something I've pointed out on several occasions to industry and even to people at NIST on the subject- in fact, quite a few researcher's have pointed this out over the last decade now. (And, all of a sudden, it's a "problem" now...sigh...)
Kaspersky's solution WON'T fix things like they're claiming- it's just more snake oil in a field FILLED with it.
They're more worried about having to change out things and the expenses of these deeply flawed designs they've cobbled together to manage the system components of things. The solution is to START OVER with honest security in mind instead of all of the half-assed solutions including authenticated DNP3 and the like.
Old news is old
Just got a memo on "Enabling proactive facilitation of clowd services with our industrial controls offerings."
The operators of the Iranian centrifuges thank these researchers for the warning.
Make the first episode of BSG Season 1 required viewing for "intro to computers" class.
This is a mouse, this is a keyboard, this is why you don't jack your global defense grid into a wifi hotspot.
At what point will software engineering be professionalized like the other branches of engineering?
Surely there are well established guidelines for securing software at this point.
1) Create a professional society for software engineers (the SPSE, let's say) with the power to grant and revoke certificates. Assemble a blue-ribbon committee and give them 6 months to come up with membership requirements
2) Have the SPSE adopt existing standards regarding security, stability, and whatever other categories are needed
3) Amend the existing construction/operating permitting mechanisms by adding a requirement to use certified software engineers
Voila, now whenever you build a factory, hospital, or other civil engineering structure that is already heavily regulated, you will be required to use certified gear, and that certified gear must now be built to a minimum industry standard.
Other industries can then piggy-back on your new standards: the codes for banks can be rewritten, and miscellaneous unregulated industries and companies can write the requirement into their contracts.
...you have physical access and hand tools. The ease of access in-place isn't a problem.
Controlling access itself is the problem.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
What we have here is a TCP port that let you have an unauthenticated shell access. In other words, this an easy to find backdoor. It is so easily exploitable that I am not sure it even deserve the term "hack".
may need unions as well so the coders can stand up to the PHB's and say that...
That time table is to tight
We need more staff and the 80 hour weeks are just makeing us make more errors.
We can't cut QA
You can't hire people who can't pass the certified test but have BA/BS while passing over people who have passed the test but don't have a BA/BS.
No I will not add this new stuff to the code this late in the roll out hell we still have some big bugs in the code base to work out.
No will not use that POS best buy special as the system that will run the PLS hell it's PSU is a very poor one per this review of it.
tell that to the PHB who said we can save by remoteing control to some offsite place.
I'd mod you off-topic, but seeing as you're in slashdot-superuser mode you'd just remove it.
Same thing has happened to my account. I just thought they loved me.
With the emergence of 3D Printers, rapid prototyping and the domestication/democratization of manufacturing, I don't think it's going to do so much harm. Manufacturing is undergoing a revolution. Many parts (and even burritos... Google that up to see what I mean) will be "printed out" at home. People won't give toys and dishes for Christmas, they'll gift the blueprints and some resins instead. Heavy Duty Industrial will remain somewhat the same, but not manufacturing as we think of it now.
Eyes Open Self-Hypnosis for Victory: Summon the Warrior
"many of these systems are unneccessarily connected to the Internet, which is a terrible, terrible idea."
Someone is finally getting it. These systems are __not__ designed to be secure. It would cause too many problems, make things needlessly complex, as well as much less robust.
The one good thing is, the languages these things use are quite esoteric - the example given, CoDeSys, is programmed in a block diagram language. It is NOT easily understood, and if somebody uses custom blocks (as my company does) you stand even less a chance of figuring out what it does.
CAN it be done? Well, of course. There is Stuxnet. We have learned, though, that Stuxnet was created just for one brand of SCADA system, running one brand of PLC, and using one particular type of variable-speed drive.
And, yes, we do have customers who utilize "air-gap" security. Very successfully, too.
"Did professional engineers prevent the Challenger Disaster?"
.. ref
No, nor did they cause it, what did cause the disaster was political interference, such as the decision to manufacture the solid booster rockets in another state, necessitating them being made from segments bonded together with O-rings
AccountKiller
I was doing some electrical work at an oil refinery up north in Canada about 5 years ago. I wasn't specifically attached to their control systems or PLCs, though since the electrical was intertwined with a bunch of the automation I naturally knew all the guys who were taking care of that portion of the project since we were required to collaborate together.
On one particular day, I entered the facility as usual and was heading to an unfinished section to check out some conduit. On my way there I noticed a CAT5 cable stretched across a walkway, disappearing into a stairwell. This was so incredibly absurd and suspicious that I just had to see what the hell was going on, even though something in my head told me I didn't want to know. I traced the cable back to the management office where it was plugged into one of the network switches. Okay, weird- follow it back in the opposite direction, all away across the plant- after about 80 meters there was a hub/repeater dangling over a walkway rail plugged into the wall and another CAT5 cable stretching off into the oblivion. Following the second extension cable led me to a set of PLCs and a group of the control guys throwing vulgar insults at an Allen Bradley PLC unit.
Turns out the PLC was a "new" model. Instead of handling the licensing through a floppy disk (!) like all the old units did, this one used some sort of a proprietary activation scheme that had to run over the friggin' internet before the PLC would actually do anything. The CAT5 cable I'd traced about 180 meters across the plant going back into the office internet connection was setup to allow this process to complete, since they had apparently failed to do it earlier when the system was OOTB but not yet hooked up.
They eventually got it all working, but it took them about 5 hours of fiddling to get the damned thing working properly.
Shit like that is the reason why things are hooked up to the internet, sometimes improperly. I know there's certain requirements for remote monitoring and such, and that should all be done over an isolated, encrypted VPN- but then you've got licensing bullshit like this that expects to phone home to a random server on the internet with little or no fire walling in-between. There's no reason for it otherwise- apart from the PLC guys wanting to make sure you're licensed and all paid up, god forbid anyone should buy a second hand PLC and reprogram it to do something useful again.
-AC
I've said it before, and I'll say it again: What possible reason could industry have to put controls networks on the internet? I can understand putting some type of reporting on the internet, so the bigwigs can keep track of up to the minute production. *disclaimer: I am an industrial electrician. I work on industrial controls in a sawmill. The day a production foreman asks us to give him control of machinery over the internet is the day I find a new industry.
the PHB's over redid there issues.
That seams like a good way and they can be hard to copy as well.
Soon pinball games will have WIFI and PC's driving them.
Just think of the fun some can do by hacking one and they better not put windows on the pc's. At least lunix is safer but they still need to update the OS so hackers can use a hole to get into the system and better be a good watch dog system so some can lock a coil on and maybe start a fire.
And an "air gap" is not exactly the answer because that will fail in a lot of cases too.
Good luck
Sadly no one will listen until something bad happens.
If you told someone pre-2009 about the need for financial regulations and the upcoming collapse people would call you a communist and a liberal! Peter Schiff did jsut that and was laughed at before he earned fame when the Great Financial Collapse hit.
Same is true with nuclear powerplants after fukashima, airport security after 9-11, and same after the space shuttle Challenger exploded, IE 6 security after code red. Money talks and shit walks. Only when deemed necessary does something change.
Right now sadly we might be without power or worse another nuclear powerplant meltdown here in the US caused by Iran before anything gets done. Not unions or professional software orgnaizations or even licensing.
People hate change and especially MBA PHBs who never have heard of a single internet security attack on a PLC piece of equipment. If you can't do it MR. Slashdotter reading this then someone else will since it is never a problem.... therefore it is perfectly secure etc.
I mean they hated upgrading browsers too until IE 6 was shown a risk and they still love XP despite it. Why? Money. Until it becomes a liability and laws come into effect and PHBs shit their pants the problem will nto be solved
http://saveie6.com/
Not just you - I'm god here too now.
Well then, the Gods Must Be Crazy.
(Actually is happened to me earlier this week. I think it's Obama's fault.)
Faster! Faster! Faster would be better!
Did you accidentially log in to the Microsoft account?
The CAT5 cable I'd traced about 180 meters across the plant going back into the office internet connection was setup to allow this process to complete, since they had apparently failed to do it earlier when the system was OOTB but not yet hooked up.
Assuming it was all Rockwell/Allen+Bradley gear then it was undoubtedly the FactoryTalk Activation system they were struggling with, and they were undoubtedly unqualified to be doing the work they were assigned to do (disclosure: I am a former Rockwell Automation employee so I have familiarity with the subject, but apart from that I do not speak on behalf of any employer past or present here).
First and foremost, Allen+Bradley(AB) PLCs don't need activations, so the licensing really isn't relevant to this story. AB makes a crap-pile of profit on that hardware the moment they've sold you the box--activation makes no sense. What DOES need to be activated (and is what creates profit for the Rockwell Software division) is the RSLogix programming software, without which the PLC is as useful as a doorstop. So unless they were completely clueless they'd have just taken their laptop into the office and activated their software then come back, rather than break all sorts of IT, security and safety rules stringing out 180m of CAT5 and a spare switch to get internet. The same goes for their drives--the drive units don't need activating but DriveTools software on the programming laptop may have.
That said, there may have been an industrial PC like a VersaView or third-party unit running the Rockwell HMI software and was bolted into the cabinet with un-activated software for some reason, but Rockwell/AB have thought of that...
The legacy licensing system used utility software called "EVMove" and relied on "master disks" (towards the end you could set up a USB flash drive) and in the field this was a royal pain in the ass--floppies and their drives are far too sensitive for such an environment, and USB memory sticks are terrible to manage and secure. Thus the development of the FactoryTalk Activation internet service-based scheme. Though it requires the internet the end system does not need to be connected to activate. The easy "wizard" way sends a "host ID" (the ethernet MAC address or some such number) from the end device to Rockwell via the internet. However, you can actually write down the mac address, or generate the hostID file on the target machine, then go to an internet-connected computer and type the hostID into a secure web form or upload the hostID file. The website then generates a license file that you can save to removable media or a laptop/portable machine to take over to the target machine physically, thus preserving the air gap (and making the method more similar to the old EVMove floppy method).
I do agree that licensing/DRM/activation is a big problem that costs end users millions of dollars globally (above and beyond the actual purchase cost of the products). It adds complication and downtime and confusion and contributes exactly zero value to its users. One might argue about its value to the vendor as well--FactoryTalk activation and many other similar schemes are just as trivial to circumvent as CoDeSys' ladder logic runtime for hackers, and adds the burden of extra support costs from the honest users it keeps honest. But the problem in industrial automation is bigger than that. The problem is that the world in general moves faster than industrial control systems can keep up, and the people who have "experience" honed their skills in the mid 1990s or earlier and haven't kept up. In the meantime, PHBs of the world in management and government demand of them far more than they are capable of delivering.
It used to be that refineries/factories/etc were content with paper chart recorders where operators and plant managers could peruse them if something came up to troubleshoot. Then came data recorders where you could plug in a serial cable or transfer via floppy to a computer for more deta
Preaching that automation systems be kept off the internet is like preaching abstinance until marriage to teens. It sounds like the lgical solution to all the problems but it is unreasonalbe to ever expect it to happen, so the best course of action is to educate on how to do it safely and responsibly.
Ther are many valid reasons that automation systems are connected to the internet in some fashion (though they never need direct internet access). Some of those reasons relate to not braking the law.
In industries like oil and gas, regulators require data to be collected 24/7/365 on all critical aspects of an operation. If an environmental or safety incedent were to happen and such data was not available for scruitiny it could lead to the permanent closure of that operation in extreme cases. Lack of due diligence in such matters can mean huge monetary fines and even jail time for wilful violations.
As such, in those operations a "process historian" server is standard equipment. These are central data logging servers that have essentally full read-only access to the industrila control system, and even some limited write access too (say, to assert a bit in a PLC to confirm it has received data, or to reset a totaliser or set a new batch number). Becasue of how vital the data is, there has to be some way to get the data off-site for archival and reporting purposes, and because of the volume of data and the immediacy that is demanded removable media is not an option. Thus these systems end up with some means of corporate network access. This does NOT mean the need "direct internet" access, but very commonly it means tunnelling through public/internet infrastructure via VPN (the "condom" if you will). Though technological measures can be taken to make this route into the plant impeneratable, it is complex enough to set up that people make mistakes and thus you end up with "holes in the condom".
The other use for outside conenctivity relates to support from off-site engineers, vendors and operators. A control system can be set up to report critical alarm conditions to smartphones, email inboxes and the like automatically with much more rapidness than a human operator at the board can do. The more rapid response to a critical incident the less likelihood for loss of revenue, damage to equipment, and injury or death of workers (again, in the case of "sour sites"--thouse that deal with natural gas containing deadly H2S, rapid response is vital to evacuate the facility and surrounding area and some of these are required by law).
So "preaching abstinence" in the complete absence of "sex education" is a bad idea. It is ineffective to say "disconenct from the internet" and not say how you can manage network security safely and responsibly, because at some point these people will be pressured into doing it and need to be able to "say no" if they aren't ready, and to know when and why it is "the right time", becasue if you DO use that internet connection responsibly it can actually be a great experience ;-)
Necessity is the mother of invention. That, or an article in the business newspaper your boss reads.
My solution to that problem was simply to subscribe to the same magazines my boss reads, peruse them for articles supporting my case and getting him to read it. Not only will he listen to them more than to you, he'll also think that you read "relevant" magazines and start listening to you, at least from time to time.
I know it's silly. hey, it's management!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
We've been saying this for years, but then again - our company makes data diodes.
Religion is what happens when nature strikes and groupthink goes wrong.
isn't this why we have think tanks though? people who think up the worst possible scenario? then they find a way to fix it? you could even make it like a Reddit for professionals, who can post ideas and up vote them? en-mass idea generator... ?
NEVER NEVER NEVER NEVER NEVER NEVER NEVER NEVER GIVE UP! "No limitations, no boundaries, there is no reason for them."
The industrial world with PLC's and SCADA equipment is totally different then what we hav ein our offices.
That is often hard to believe, but the industial world is still 10 years behind on IT. And with a good reason.
Current systems simply do guarantee the responce time needed for a lot of process control situations.
Imagin what would happen if your pressure control value would suddenly deside that it is time for a virus scan, of then it wants to reboot because microsoft has issues a bugfix for the office environment that is nowhere found on the pc, but still it has the checkbox 'reboot' marked in the installer.
Every update is a nightmare for these environments because it needs to be checked and checked again befor it can be taken into production. When it;s into production it cannot be changed so fast as more processes are 24/7 running. There are even chemical processes that take days to startup. No late night server reboots for these guys.
This mixture makes it very hard to evolve the overall IT environment as they need systems without bugs and we are all so very used to live with buggy software.
We all know the PLCs themselves are insecure as hell. That does not mean you have to expose that insecurity to an intranet or (god beware) the internet. Hook all those shitty little controllers to Linux or BSD machines. Then set up a Virtual Private Network using IPSEC on Linux/BSD. If you need Windows-based control GUIs, hook them into the secure VPN, too. Don't connect the Windows crapola to the intranet. I am not sure you know this, but proper secure VPNs are secured against man in the middle. Of course, you must physically protect all the hardware and the cabling between PLC and Linux boxes. The cables between the Linux machines are secure courtesy of the secure VPN.
Certainly you have to interface to the guys in R&D, sales, marketing and so on. They might want to describe custom chemical mixtures by means of an Excel file and that information has to be somehow communicated to the PLCs. DO NOT bring the Excel shit into the secure VPN. At least not in the "microsoft way" by starting an Excel process to parse (and execute if it contains macros) the file. Instead, use the xlsx format, unpack the ZIP and then parse the xml files to get the bespoke chemical mixture parameters, That can be done on the Linux machines, no Macrosuck software required at all.
All the tools are there, all the experts are there; they are just ignored/not hired by the MBA CRAP.
..don't forget to check the sanity of the Excel file. All parameters should be bounds-checked and in many cases you need to do more complicated checks to ensure your plant does not "accidentally" make explosives because the idiots in sales have fucked up or their computer have been hacked. But that knowledge should firmly exist in your company or you are 100% screwed.
..electricians are too stupid to look up passwords in a little red book ?
Only the PLC crap and their legacy Windows crap need to be physically separate. Linux and BSD can happily route secure traffic over insecure networks, including the internet. It is called IPSEC.
http://en.wikipedia.org/wiki/IPsec
All the tools are out there, they are free except for the expertise to set them up properly.
Regarding your argument that "passwords will be forgotten" - that is insane bullcrap. If a company cannot maintain a list of their passwords in a fucking little book, their plant should be forcibly shut down by the government.
You The Engineer will be between a rock and a hard place because the PHBs will demand lots on insane ("need excel run a marketing-supplied macro to control process") things while the "SPSE" will later get you for violating some insane rules ("all machines must run virus scanners").
Better leave it as it is; wait and see until a refinery blows up spectacularly ( I am banking on the Iranians to do that as revenge). Or better, let them test the efficacy of a reactor containment vessel after cyber attack.
Our politicians and leader are corrupt ignorants who are 100% capable of manipulating the sheeple, but they don't have and don't want a clue about technology. That is all "geek stuff" and they want to play angry birds instead of learning anything "hard". Compare that to the Chinese Politbureau, which is stuffed full with engineers and they apparently manage to kill the "social science" turkey that is the western world leadership - one cheap excavator, one cheap telephone at a time.
Haji has a crap education, while John got a proper one from an American or European university. But I agree we don't need unions - see what they did to GM. We need to switch jobs if we don't like a boss or a company. If you need to work more than 40hours per week on a regular basis, there is something wrong and you need to switch. So simple.
And no, John is not the self-trained idiot who calls himself "C# programmer". He got a BS or an MS in Computer Science, he loves what he does and he researches things he is interested in thoroughly. He is an "Expert" or "Meister", whatever you like to call it. Not a monkey trained by himself or a Monkey School.
You are over-simplifying it. The Great General Curtis LeMad (or was it LeMay ?) ordered all the nuke locks to be set to "1111111", to ensure a Quick Armageddon Capability. He essentially gave a fuck about technology and relied 100% on "command authorization by voice".
Boy, wean yourself off that computer and venture out into reality. All the plastics, the concrete, the fertilizer for your cheap food, the pesticides, all the medicine, all the fuel, all the textiles, all the metal around you will continue to be made in large facilities for the next 100, probably 1000 years.
Or at least go to youtube and look at a video of a burning refinery or a burning chemicals plant. All the stuff that makes your life so easy is directly or indirectly made in huge plants controlled by PLCs.
eg:
http://en.wikipedia.org/wiki/Sandoz_chemical_spill
IPSEC VPNs are very secure and you can double down by setting up router rules which allow only designated IP addresses talk to your IPSEC router machines. You can indeed control industrial plants remotely over the internet, if you follow the best security practices. Don't expect 100% uptime of your internet connection, of course.
The problem is that the MBA Crap does not want to spend a dime on competent security experts (Linux and BSD admins who know IPSEC, iptables and so on). They don't want to hire programmers who have CS degrees and who know their stuff. It has all to BE CHEAP ! I mean SUPER-CHEAP. The corporation is making billions a year, by saving 50000 dollars/euros on proper experts, don't cha know ?
..use SSL for the link between factory and smart phone.
Setting up IPSEC and iptables is within the grasp of thousands of Linux and BSD pros. A simple setup will cost you less than 2000 dollars in consulting fees. You can route that data via Iran, France, a Huawei Switch or Russia (that could/will actually happen during to a routing cockup) and it won't reduce your security.
http://en.wikipedia.org/wiki/IPsec
This is not rocket science to Experts. You just have to find and hire them. The latter seems to be the big issue.
I am an altruistic man who does the googleing for you:
http://www.ipsec-howto.org/
http://openvpn.net/
http://www.netdigix.com/linux-vpn.php
http://linas.org/linux/vpn.html
http://www.tummy.com/Services/Consulting/networking.html
http://atxconsulting.com/posts/Giganews_VyprVpn_on_Linux_with_IPSEC_and_L2TP/
http://www.managed-it.eu/?page_id=20
http://bookshop.pearson.de/main/main.asp?page=englisch/bookdetails&ProductID=103369
http://www.m-it.com/?article=vpn&lang=de
http://www.google.com/url?sa=t&rct=j&q=%22ipsec%20consulting%22%20linux&source=web&cd=3&ved=0CCsQFjAC&url=http%3A%2F%2Fwww.iabg.de%2Finfokom%2Fit_sicherheit%2Fdokumente%2Fitsec_en.pdf&ei=4SWNUOXzFdT04QTSsIDwCQ&usg=AFQjCNE3KjLUFC07JDKlgS5aC_kn0ZSoew&cad=rja
http://www.openbsd.org/support.html (search for IPSEC)
http://www.google.com/search?client=ubuntu&channel=fs&q=ipsec+consulting&ie=utf-8&oe=utf-8
http://www.milesconsultingcorp.com/IPSEC-Security.aspx
http://blogs.metcorpconsulting.com/tech/?p=435
http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html
No security expert will code their own software as long as OpenSSL, IPSEC, GPG and so on will do the job. Too expensive and too many mistakes to be make by bespoke software.
I suggest you hire one of these bearded Unix admins with some real crypto and networking experience and he is going to sort out the security issues in short order. Just listen to his advice and don't fuck his advice up with some el-stupido low-level requirement such as "PLC must talk directly to enterprise datat warehouse SQL server". Set up a clean, simple concept with defined interfaces and application-level firewalls which control the data flow in/out of the PLC secure VPN (delivered by BSD or Linux) and ensures sanity of any data inflowing. Don't bother too much about data flowing out, that is only a concern regarding industrial secrets and we all know the average corporate intranet is Insecure As Hell.
Must read " Also the typical ethernet SWITCH has no realtime assurances"
What is the problem with remote access to a PLC ? Only if the transport network or the opposite endpoint is insecure. So if you come with a (truly) secure laptop, a UMTS, connect to the PLC via Ethernet and then the PLC does a proper SSL connection with its manufacturer ? Nothing at all insecure with that, as long as it is properly done.
Problems only pop up if the Laptop runs in Admin mode 100% of time and is used for internet porn so that the maintenance technician can jack one off during lunchtime in a remote part of the factory. Or the session is not SSL encrypted.
2012:
Medicaid hack update: 500,000 records and 280,000 SSNs stolen:
http://www.zdnet.com/blog/security/medicaid-hack-update-500000-records-and-280000-ssns-stolen/11444
So, what's dts.utah.gov running everyone?
LINUX (and yes, it got HACKED) -> http://uptime.netcraft.com/up/graph?site=dts.utah.gov
What's health.utah.gov running too??
YOU GUESSED IT: LINUX AGAIN -> http://uptime.netcraft.com/up/graph?site=health.utah.gov
* Ah, yes - see the YEARS OF /. "BS" FUD is CRUMBLING AROUND THE PENGUINS EARS HERE & 2012's starting out just like 2011 did below!
===
2011:
KERNEL.ORG COMPROMISED - The Cracking of Kernel.org: (that's VERY bad - do you trust it now?)
http://linux.slashdot.org/story/11/08/31/2321232/Kernelorg-Compromised
---
Linux.com pwned in fresh round of cyber break-ins:
http://www.theregister.co.uk/2011/09/12/more_linux_sites_down/
---
Mysql.com Hacked, Made To Serve Malware:
http://it.slashdot.org/story/11/09/26/2218238/mysqlcom-hacked-made-to-serve-malware
What's that site running? You guessed it - Linux -> http://uptime.netcraft.com/up/graph?site=mysql.com
---
London Stock Exchange serving malware:
http://slashdot.org/submission/1484548/London-Stock-Exchange-Web-Site-Serving-Malware
(I mean hey - NOT ONLY DID LINUX FALL FLAT ON ITS FACE less than a few minutes into the job http://linux.slashdot.org/story/11/02/19/0147232/London-Stock-Exchange-Price-Errors-Emerged-At-Linux-Launch, & crash not only ONCE, but TWICE there? You see "Linux 'fine security'" in motion @ the LSE too!)
---
DUQU ROOTKIT/BOTNET BEING SERVED FROM LINUX SERVERS:
http://it.slashdot.org/story/11/11/30/1610228/duqu-attackers-managed-to-wipe-cc-servers
---
Linux Foundation, Linux.com Sites Down To Fix Security Breach:
http://linux.slashdot.org/story/11/09/11/1325212/linux-foundation-linuxcom-sites-down-to-fix-security-breach
---
Linux's showing in CA's breached recently too? Ok: (very, Very, VERY BAD for ecommerce, online shopping, banking, etc./et al)
http://uptime.netcraft.com/up/graph?site=StartCom.com
http://uptime.netcraft.com/up/graph?site=GlobalSign.com
http://uptime.netcraft.com/up/graph?site=Comodo.com
http://uptime.netcraft.com/up/graph?site=DigiCert.com
http://uptime.netcraft.com/up/graph?site=www.gemnet.nl
The list of CA Servers BREACHED that RUN LINUX (StartCom, GlobalSign, DigiCert, Comodo, GemNet)... per these articles verifying that:
http://itproafrica.com/technology/security/cas-hacked/
&
http://threatpost.com/en_us/blogs/site-dutch-ca-gemnet-offline-after-web-server-attack-120811
---
The Stratfor SECURITY hack: (can't blame it on poor setup, this IS a security firm that uses Linux)
http://yro.slashdot.org/story/11/12/28/1743201/data-exposed-in-stratfor-compromise-analyzed
What's that domain run? Yes kids - you guessed it: LINUX -> http://uptime.netcraft.com/up/graph?site=www.stratfor.com
---
Phishers/Spammers FAVOR attacking LAMP: (Linux, Apache, mySQL, PHP)
http://www.theregister.co.uk/2011/06/10/domains_lamped/
PERTINENT QUOTE/EXCERPT:
"Phishers compromise LAMP-based websites for days at a time and hit the same victims over and over again, according to an Anti-Phishing Working Group survey. Sites built on Linux, Apache, MySQL and PHP are the favoured targets of phishing attackers"
---
Toss ANDROID (yes, a Linux since it uses a Linux kernel) in also, since it's being "shredded" on the mobile phone security-front rampantly for years now?
* You get the picture...
APK
P.S.=> Linux Security Blunders DOMINATE in 2011-2012, despite all /. "FUD" for years saying "Linux = SECURE" (what "b.s."/FUD that's turning out to be, especially on ANDROID where it can't hide by "security-by-obscurity" anymore & is in the hands of non-tech users galore - & EXPLOITS ARE EXPLODING ON ANDROID, nearly daily)
... apk
So a lot of noobs use Linux to create insecure PHP scripts that allow for SQL injection ? That is the fault of Linux how ?
Ok then - See "fine Linux security" in 2011-2012 -> http://it.slashdot.org/comments.pl?sid=3213621&cid=41795889
* Now, would you care to explain that "fine security track-record" for us? It's quite current...
APK
P.S.=> Android's the funniest one of all, lol... especially after all those years of the b.s. people like YOU spouted just now (which we've ALL HEARD YEARS OF on /., & it's falling apart around your ears Penguins):
"So hell, yeah, lock that shit behind BSD or Linux because you cannot trust it. Sorry to offend your skillset or your "nice business partners"" - by Anonymous Coward on Sunday October 28, @09:12AM (#41795831)
Funny how that link I posted above "dusts" the typical "/. b.s. that 'Linux will fix it'", eh? LMAO - yea, it'll "Fix It" alright - just like it did for CA's, right? Man... lol!
... apk
...concern anyone?
"We software Automation." is prominently put up on their website...a German company's TYPICALLY better at English than that.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
We can never validate all software correct, but we can have lots of trust into the Linux kernel and IPSEC based on historic experience. From that we can build a "secure enclave" that itself contains insecure stuff. Some people have claimed to proven correct entire operating systems (e.g. L4).
It is like defending/controlling borders very strictly while having many potentially insecure situations/locations in a country's territory.
Let's examine your "list of 'noobz'" then, shall we? Ok, here we go:
---
1.) Noobz - like kernel.org, maintainers of the LINUX kernel iirc?
2.) Noobz - like STRATFOR (a security company no less, lol) ???
3.) Noobz - like London Stock Exchange????
4.) Noobz - like NUMEROUS BREACHED CA's?????
5.) Noobz - like mysql.com??????
6.) Noobz - like linux.com??
---
* Yea, lol, riiiighhtt... some "noobz" in that list above, eh?
APK
P.S.=> Fools was more like it, believing the "hype" that "Linux = invulnerable" which WE ALL HEARD HERE ON /. FOR TOO MANY YEARS now...
Funny how THAT is especially "falling apart" considering ANDROID (yes, a Linux variant itself) most of all, eh? No more hiding behind "security-by-obscurity" Penguins... your OS is OUT THERE, being torn apart, along with years of /. "FUD" too!
... apk
Now, please send me link"e where the Linux Kernel (!) had security failures that could be exploited via "drive by" or via internet or when running Apache. Shitty PHP scripts and crappy Appstores (like that of Android, where they don't even properly establish the submitter of software) don't mean anything.
Just because the government of Iran uses Mercedes trucks to run over dissidents does not mean Mercedes trucks are evil.
Ok then - See "fine Linux security" in 2011-2012 -> http://it.slashdot.org/comments.pl?sid=3213621&cid=41795889
* Now, would you care to explain that "fine security track-record" for us?
After all - It's quite current...
APK
P.S.=> Android's the funniest one of all, lol... especially after all those years of the b.s. people like YOU spouted just now (which we've ALL HEARD YEARS OF on /., & it's falling apart around your ears Penguins):
"Only the PLC crap and their legacy Windows crap need to be physically separate. Linux and BSD can happily route secure traffic over insecure networks, including the internet. It is called IPSEC."- by Anonymous Coward on Sunday October 28, @09:12AM (#41795831)
(Windows CAN'T DO IPSEC? b.s.! More /. "1/2 truths" abound, as-per-usual... which is FINE BY ME, I just come along & SHATTER it for what it is, b.s.!)
Also, lastly - Funny how that link I posted above "dusts" the typical "/. b.s. that 'Linux will fix it'", eh? LMAO - yea, it'll "Fix It" alright - just like it did for CA's, right? Man... lol!
... apk
http://it.slashdot.org/comments.pl?sid=3213621&cid=41795889
* What made me LAUGH THE MOST, was some fool here -> http://it.slashdot.org/comments.pl?sid=3213621&cid=41796025 saying it was "NOOBS" making mistakes in Linux...
Funny - my list has MOSTLY what SHOULD BE NON-NOOBZ running things in the examples I posted in that link above!
Man - no, instead?
They were FOOLS that believed in the "/. hype" (which IS proving to be COMPLETE BULLSHIT per that link above, & ANDROID does the job most of all - no more "hiding" behind "security-by-obscurity" boys... that's all done now, & you SEE THE RESULTS!)
(So much for "spinmasters" eh?)
APK
P.S.=> The "Anti-Windows/Anti-Microsoft" stuff just doesn't CUT IT anymore, Penguins... especially after seeing the link above, and ANDROID proves it most of all...
... apk
..is a fault of Coca-Cola Company ?
If you run crap PHP scripts on top of Linux and Apache and your database is being compromised it means nothing regarding Linux security. It means you can't write secure PHP scripts.
Malware hosted by the Android Appstore and then being executed on the Linux kernel does not mean the Linux kernel has been compromised. It means Google did no proper identification of Android software authors. All you need is a stolen Credit card to "establish" your Android Software Author identity.
Now show me the drive-by virus than pwns my kernel just by me surfing the site.
..but of course the code is "secret" and contains probably 200 secret bugs out of which 175 are exploitable. Courtesy of your Paymaster's paranoia and business model.
kernel.org does not directly control the code repository. It is actually quite distributed over various git repositories. You can break into Linus Thorvalds house, fiddle with the code secretly only to have the other kernel maintainers to realize this quite quickly.
Stratfor is a kind of consultancy. They specialize in writing poltical/national security-related papers, not at all in computer security.
LSE is Bunch Of Known Idiots. They attempted to outsource their coding to Sri Lanka and it blew up in their face. Nowadays the Brits are in most instances First Rate Idiots who have a shoddier education than Horatio Nelson had. The real leaders in electronic exchange trading is Deutsche Börse in Frankfurt and they ran on VMS and Solaris. They currently switch to Linux and Postgres. RBS is one of their happiest customers.
CAs breached ? Yeah, they are as shoddy as Microsoft, despite some of them using Linux. But that is not the fault of Linux, but the fault of the crap they built on top.
Mysql - the worst open source database and I fully expect them to have PHP scripts with SQL Injection possible. Real open source experts don't use a system that loses data all the time. They use Postgres instead.
Linux.com - yeah, a commercial site trying to make some ad dollars from Linux. I see it the first time, despite using Linux as a C++ developer for years. I guess they had their crap PHP content management system pwned by one of the PHP insanities or an SQL injection. Not the fault of the Linux kernel.
I have no doubt the average programmer can hack up something we can call an "encrypted TCP session". But it probably is
- not safe against replay attacks
- reusing session keys
- not integrity-protected (switching a bit in the cipherstream will switch one or more bits in the cleartext without your app knowing)
- not safe against low-level attacks against the crypto/session establishment parameter parser
- not properly vouching for the identity of both communication partners
There has a lot of work gone into getting this correctly done in SSL and its successor TLS. Even they made a couple of mistakes which had to be fixed. Chances are 99 to 1 you cannot easily get the same security level as you can get by simply coding against OpenSSL or GnuPG. Just using OpenSSL is a challenge for many, because they don't properly understand the concepts behind Public Key crypto. But replicating SSL/TLS - that is by far out of the technical and financial reach of most developers and their bosses.
So - just take OpenSSL and integrate it properly into your product. Make your boss send you to a training regarding the basics of PK Crypto, if your experience is only superficial. Or hire an known expert and let him show and explain you how to do it.
Read and try to understand Schneier's Applied Cryptography, play with the gpg and openssl command line programs, read code samples. This is not a "quick addition of capability", it is actually the painful and time-consuming acquisition of expertise. Management idiots don't appreciate this. Redmond fucked up their crypto efforts in the first iteration. Now they are somewhat better.
They all got "nooked" running Linux & aren't noobs: So much for slashdot years of FUD on the invulnerability of Linux, cuz "New NEWS/NewFlash": It isn't!
* ANDROID proves that assertion of mine MOST OF ALL, since it too, is a Linux and yet it's being "SHREDDED" daily on the security-front...
(NO questions asked...)
APK
P.S.=> Yes, /. "penguins" - face it: , especially in light of ANDROID... Linux is no more "invulnerable" to attack & exploit than Windows is, and your YEARS OF *HIDING* BEHIND "SECURITY-BY-OBSCURITY"? All done now, thanks to Android most of all (and, of course, these examples of "fine Linux security" @ the server level too, from the past 2 yrs. now -> http://it.slashdot.org/comments.pl?sid=3213621&cid=41795889 )
... apk
Use the stream cipher RC4 and a secret key. Whenever establishing a connection, the RC4 cipher is also reset, creating an identical key stream.
Attackers can
a) replay commands
b) XOR two sessions to get an XOR of the two plaintexts. From that the plaintext itself is not too difficult to get.
c) cut out parts of the stream without detection
Of course you can use AES, but that only eliminates b)
Fire sail. Bruce Willis is getting old to save our asses.
Running Windows, managing 99.999% 'Fabled "5-9's"' secure uptime, vs. your TOTAL b.s., troll (eat your words, phool):
---
38 HIGH TPM & 99.999% "uptime" examples:
---
XEROX: Managing 7++ million transactions a day for office devices for its customers using Windows Server 2003 + SQLServer 2005 64-bit with 99.999% uptime!
NASDAQ: The U.S.' LARGEST STOCK EXCHANGE, Since 2005 has had Windows Server 2003 + SQLServer 2005 in failover clusters running the "official trade data dissemination system" for them in 24x7 fabled "5-9's" 99.999% uptime, doing 64,000 transactions PER SECOND (compare London Stock Exchange using Linux @ 3,000 per second)
FUJIFILM GROUP: Tracks data for its imaging, information, & documentation for its products & services using Windows Server 2003 w/ a custom SAP solution on SQLServer 2005, achieving 99.999% uptime.
HILTON HOTELS: Manages 1.4 Billion records a day for customers in 1000's of their hotels worldwide - for 370,000 rooms & catering services forecasts (switching from 6 *NIX systems to 1 Windows Server 2003 + SQLServer 2005 clustered failover system using a data warehouse with 7 million rows & 99.998% uptime).
MEDITERRANEAN SHIPPING COMPANY: Manages & Tracks 7 million containers out of 116 countries daily using Windows Server 2003 + SQLServer 2005 in failover clusters with 99.999% uptime.
SWISS INTERNATIONAL AIRLINES: Serves 70 airport destinations worldwide, with 6,500 employees + 110 branch offices via Windows Server 2003 & Active Directory with 99.95% uptime (all while growing their business 30% per year). THEIR PREVIOUS LINUX SYSTEM COULD ONLY HANDLE 250 concurrent users - the Windows one handles over 500++ users concurrently/simultaneously!
UNILEVER: Global consumer good leader, migrated to mySAP on SQLServer 2005 + Windows Server 2003 & scaled UP their operations by over 200% & yet saved money + have 99.999% uptime!
MOTOROLA: Using System Management Server, Windows Server 2003 & SQLServer 2005 to conduct inventory of 65,000 desktops from a single location (e.g. for system updates corporate & worldwide).
NISSAN: Uses Windows Server 2003 to manage 50,000 employees' email & calendaring (w/ out VPN, & using Exchange Server 2003) for local AND remote + mobile users.
TOYOTA MOTOR SALES: Reduced the # of techs needed per dealership (1,000's worldwide) from 7, to 1 using Windows Server 2003.
SIEMENS: 420,000++ people, 130 business units over 190 countries managed in Windows Active Directory
REUTERS: Managing 3,000 servers worldwide @ customer sites internationally (using only 4 managers to do so, remotely).
DELL COMPUTER: Managing 130,000 servers & 100,000 PC's worldside using Windows Server 2003 + 40 million customers' data worldwide.
LEXIS NEXIS: Searches BILLIONS of documents each second delivering news, legal, & business information.
HSBC: Deploys System Center solutions to 15,000 Servers worldwide & 300,000 desktops using Windows Server 2003.
RAYOVAC: Chose Windows Server 2003 over Linux to manage their infrastructure - saving 1 million dollars estimated in software, staffing, & support costs.
JETTAINER/LUFTHANSA/U.S. AIRWAYS: managing shipping to 3,000 flights to 400 airports every day.
CONTINENTAL AIRLINES: Manages crew communication systems, log on/log off, schedules, & shifts using Windows Server 2008 worldwide.
JET BLUE AIRWAYS: Managing 12 million flights & their data annually + ticketing, finance, & personnel too.
TIMEX: Using Windows + Exchange Server for remote personnel & executives (for their ENTIRE workforce)
7 ELEVEN STORES: Chose Windows Server 2003 over Linux with a 20% TCO (total cost of ownership savings not only ESTIMATED, but actually REALIZED!), managing 1,000's of in-store servers via AD worldwide.
"Worse, many of these systems are unneccessarily connected to the Internet,"
Instead of spending the oodles of money for those worthless airport scanners, department of defense boondoggles, and useless shit, flame, etc...
we could have spent the money to develop an ultra secure replacement for hardware controllers, and manditory audits of mission critical systems, and unplugged needlessly internet connected components from the internet.
Instead we spent our money foolishly on shit we don't need.
I am calling for the same people in the NSA who do the SHA and AES competitions to do something along these lines, because they've already proved themselves competitant, where other branches fail.
Somebody load us up the bomb.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Or start your own magazine.
I did consider bringing out "Management Fad Monthly" but I was worried that some silly bugger might try to implement an obvious spoof like TQM, stand-up meetings or employing Indian programmers, and then where would we be?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Windows is a complex mess where you cannot easily turn off single components to get rid of their security issues. It runs stuff in kernel mode which don't belong there - increasing the attack surface. For example, it parses font and image files in kernel mode because a bozo decided everything else "would be too slow". Windows needs IE as an integral part.
The Linux kernel can be stripped down to a minimum, it can be hardened with several sandboxing/capability frameworks and most importantly researchers can inspect everything. You can't sneek crap into the kernel and let it rot forever as easily as a Microsoft employee can do that with Windows.
Windows is being pwnd at the kernel level on a regular basis and that is why even Windows 7 PCs are regularly infected by viruses. You need the virus scanner band-aid.
A nice list of clueless corporations right out of the Dilbert comics. Corporations who judge computers by looks instead of the innards - these are loyal Windows users. Those who have a clue avoid it like the plague:
+ Google
+ Facebook (yeah, stupid business, but they have more teenagers hooked than everyone else; enormous scale issues)
+ Tokio Stock Exchange
+ CERN
+ Deutsche Börse / Eurex
+ Skype until M$ pwned them
+ French National Police
+ City of Munich
+ Your DSL router
Indeed, they have.
1st of all, I outnumbered the hell out of you already, here -> http://it.slashdot.org/comments.pl?sid=3213621&cid=41797255
Secondly, per my subject-line above? Here goes (they won't all fit in this post even, it has another part still):
367++ TOP FORTUNE 100/500 Part #1 of 2 (or best 100 to work for per CNN Money) COMPANIES, EDUCATIONAL INSTITUTIONS, &/or GOVERNMENT AGENCIES USING WINDOWS (over other solutions like Linux) both in HIGH TPM ENVIRONS, & FROM "TOP 100 COMPANIES TO WORK FOR" (per CNN Money 2011):
---
TRAVELERS INSURANCE: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.travelers.com
PHILIPP MORRIS: Runs their domain on IIS (mix) -> http://uptime.netcraft.com/up/graph?site=www.pmi.com
ENTERPRISE HOLDINGS: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.enterpriseholdings.com
TYSON FOODS: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.tyson.com
HESS: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.hess.com
SUNOCO: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.sunocoinc.com
HONEYWELL: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=honeywell.com
HUMANA: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.humana.com
GENERAL DYNAMICS: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=generaldynamics.com
STATE FARM INSURANCE: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.statefarm.com
COMCAST: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.comcast.com
DISNEY: Runs their domain on IIS -> http://uptime.netcraft.com/up/graph?site=disney.go.com
SYSCO: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=sysco.com
KRAFT FOODS: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.kraftfoodscompany.com
PEPSI: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.pepsico.com
INTERNATIONAL HOLDINGS CORP.: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=intlfcstone.com
DOW CHEMICAL: Runs their domain on IIS (mix) -> http://uptime.netcraft.com/up/graph?site=www.dow.com
MARATHON OIL: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.marathon.com
UNITED TECHNOLOGIES: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.utc.com
WELLPOINT: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.wellpoint.com
COSTCO: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.costco.com
BRISTOL MYERS SQUIBB: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.bms.com
AMERISOURCE-BERGEN: Runs their domain on IIS (mix) -> http://uptime.netcraft.com/up/graph?site=www.amerisourcebergen.com
KROGER: Runs their domain on IIS (mix) -> http://uptime.netcraft.com/up/graph?site=www.kroger.com
UNITED HEALTH GROUP: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.unitedhealthgroup.com
MCKESSON: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.mckesson.com
BERKSHIRE HATHAWAY: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.berkshirehathaway.com
CONOCO-PHILLIPS: Runs their domain on Windows -> http://uptime.netcraft.com/up/graph?site=www.conocophillips.com
CHEVRON: Runs their domain on IIS (mix) -> http://uptime.netcraft.com/up/graph?site=www.chevron.com
EXXON-MOBIL: Runs th
Do ANDROID smartphones use a Linux kernel?
* If so (and Yes, it IS SO), then, they're using a Linux (or will you tell me they're really Microsoft Windows now too??).
APK
P.S.=> You fail, but... that's NOT REALLY YOUR FAULT - you were faced with a superior mind (mine), lol...
... apk
"You can't sneek crap into the kernel and let it rot forever as easily as a Microsoft employee can do that with Windows..".." - by Anonymous Coward on Sunday October 28, @03:03PM (#41798239)
LMAO - tell THAT, to "Kernel.org" -> http://linux.slashdot.org/story/11/08/31/2321232/Kernelorg-Compromised (the linux kernel repository iirc)...
---
"Windows is a complex mess where you cannot easily turn off single components to get rid of their security issues." - by Anonymous Coward on Sunday October 28, @03:03PM (#41798239)
Spoken by a fool that doesn't KNOW how to use it, apparently: THIS -> http://www.google.com/#hl=en&output=search&sclient=psy-ab&q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&oq=%22HOW+TO+SECURE+Windows+2000%2FXP%22&gs_l=hp.3..0i30.2185.13160.0.13347.49.35.6.0.0.2.434.5664.0j13j10j2j1.26.0.les%3Bcqn%2Cfixedpos%3Dfalse%2Cboost_normal%3D40%2Cboost_high%3D40%2Ccconf%3D1-2%2Cmin_length%3D2%2Crate_low%3D0-035%2Crate_high%3D0-035%2Csecond_pass%3Dfalse%2Cignore_bad_origquery%3Dtrue..0.0...1c.1.nUoK9GkR220&pbx=1&bav=on.2,or.r_gc.r_pw.r_qf.&fp=d3ddaee4ee84f1b4&bpcl=35466521&biw=1024&bih=608
Shows you QUITE differently (I know, I wrote it, & it's from the very 1st security guide for Windows ever that I wrote also -> http://web.archive.org/web/20020205091023/www.ntcompatible.com/article1.shtml )
---
"It runs stuff in kernel mode which don't belong there - increasing the attack surface.." - by Anonymous Coward on Sunday October 28, @03:03PM (#41798239)
Like what? The video subsystem (since Windows NT 4.0, before that it was in usermode)?? So what - it's built of SOLID, PROVEN templates from the DDK (device driver kit) & WHQL tested!
Clue - running in kernelmode/ring 0/rpl 0 makes a process MUCH faster than usermode/ring 3/rpl 3!
---
"For example, it parses font and image files in kernel mode because a bozo decided everything else "would be too slow".." - by Anonymous Coward on Sunday October 28, @03:03PM (#41798239)
For gaming yes, post Windows NT 3.51 - before Windows NT 4.0, video subsystems (GDI & Win32 + drivers) ran in usermode... but, see above, you know why (AND, why they're stable as well as fast).
---
"Windows needs IE as an integral part.".." - by Anonymous Coward on Sunday October 28, @03:03PM (#41798239)
And, this means what?
---
"The Linux kernel can be stripped down to a minimum, it can be hardened with several sandboxing/capability frameworks and most importantly researchers can inspect everything. " - by Anonymous Coward on Sunday October 28, @03:03PM (#41798239)
See that security guide I wrote... same with Windows!
---
"Windows is being pwnd at the kernel level on a regular basis - by Anonymous Coward on Sunday October 28, @03:03PM (#41798239)
Really? Show us a kernel level exploit that's not patched then (good luck, there aren't any remotely exploitable ones there (they're what count)).
---
"and that is why even Windows 7 PCs are regularly infected by viruses. You need the virus scanner band-aid. - by Anonymous Coward on Sunday October 28, @03:03PM (#41798239)
Yea, & what about ANDROID (a Linux on smartphones since it uses a Linux kernel)?
---
* Man, lmao - You FAIL...
Now - IF Linux is "so good", then WHY does it only command what? 1.5% of the desktop market & roughly 50% of the server market split with Windows (even though Linux is GIVEN AWAY FREE, defying business logic, since something JUST AS GOOD FOR FREE SHOULD HAVE "BLOWN AWAY" WINDOW, & it hasn't... not by a LONG shot of about 95% of marketshare overall on PC's + Servers combined over Linux!)
APK
P.
What do you think will happen when managers learn how much software that gets signed off by a PE costs and how long it takes to develop?
"It runs stuff in kernel mode which don't belong there - increasing the attack surface." - by Anonymous Coward on Sunday October 28, @03:03PM (#41798239)
Earlier in the post I am replying to of mine, in regards to that quote above? Since VISTA &/or Windows 7 moved to the AeroGlass interface driven by DirectX?? Video IS in usermode, again (as it was in NT 3.5 - 3.51) & thus, UNABLE to "Crash" the system completely...
* Any takers on that?
APK
P.S.=> The fool trolling me's disappeared in defeat so... there you go!
... apk
Hey, stop that! You're threatening my job, because coming up with harebrained ideas how to hack our security IS my job!
And damn, I love it!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.