>>When a Windows user receives a zip file containing a file >>named hello.txt.exe", the default explorer settings makes >>it appear as "hello.txt", because of the "mask extension >>of known file type 'feature'". >This is a UI semantic, nothing more.
Right, but this is dangerous (this allows to lure users) and this doesn't bring anything to the user. After all the trouble it caused, why hasn't MS simply made the default to show the complete filename ?
>>Then instead of launching a command like "notepad.exe hello.txt" >>or opening a text editor and opening the file from within, when >>you double-click on a file in Windows, it gets EXECUTED. >Of course it gets executed - it's an executable file. Why >wouldn't it ?
Because an application like a mail reader shouldn't expect to receive executable code from an e-mail. So the file shouldn't be executable. Again, a minor tweak that could save people a lot of problems. Why on hell should a data file (a file generated with a "Save As..." dialog) be executable ? It would be a minor tweak in default Windows permissions, not to put the "Execute" flag. Like on Unix: saving a file puts the permissions to "-rw-------", not to "-rwx------".
>Not that you can directly open executable attachments on any >remotely recent version of Outlook or Outlook Express in the >first place, making your whole argument moot.
Ok, so some minor progress from MS...
>(The real irony here is that GUIs like KDE and GNOME are, >if anything, *more* vulnerable to this style of attack >because they don't make any attempt to verify whether a >file's extension matches its type. So a file called blah.txt, >if it's really an executable binary, will be run as an executable >binary regardless - rename a.exe to.txt in Windows and Explorer >will just open the file in notepad.)
No, sorry this is wrong. The mechanism is to associate a file extension with a program to view it. mpg files are associated with xine or mplayer typically. If you feed mplayer with an executable, it would say something like unknown file format, no codec found for this file, etc... txt files are associated with KEdit, typically. When there is no extension, the file isen't associated with anything and the user can eventually choose a program to open with. But the file is never run. Doing a command like:
$ mplayer malicious.mpg is very different than:
$ chmod u+x malicious.mpg
$./malicious.mpg The former requires only a mouse click and can happen by accident, but is harmless. The latter not.
>>Ok, but in that case, the use would only be able to destroy >>its own files, which he's allowed to do anyways...
>The user's files are typically the most important on the machine.
I agree for a home PC. (mono-user) Else there are other's users files that are more important.
>>Without Admin access, there is no spyware installation, no >>dirty tools added at the startup and the like. This makes >>a huge difference.
>Of course there is. The malware gets hidden away somewhere in >~ and the user's dotfiles and GUI are modified to relaunch it >whenever they login (KDE, GNOME, etc - most have some sort of >"launch on login" functionality).
Right... There could be an attack vector here. But this assumes that the user has already executed a rogue executable.
>>In the linux a stupid user would destroy its own data, in the >>Windows case, he has destroyed the whole OS and potentially >>infects other machines around...
>"Destroying the OS" barely qualifies as a minor irritation >compared to losing all your data files
Well, we're talking here about people needing to reinstall Windows every 6 months due to spyware
>>Do you really think a linux user could easily be >>tricked into saving a suspicious e-mail attachment >>on the disk, adding the x flag, logging as root >>and attempting to run it ?
>No, but this is because of the Linux *user*, not >Linux. (Although many would argue it is indirectly >because of Linux requiring more savvy users).
The difference is in Linux and it's application.
When a Windows user receives a zip file containing a file named hello.txt.exe", the default explorer settings makes it appear as "hello.txt", because of the "mask extension of known file type 'feature'".
Then instead of launching a command like "notepad.exe hello.txt" or opening a text editor and opening the file from withing, when you double-click on a file in Windows, it gets EXECUTED.
This is such an ill-design that it's not surprising that so many people are tricked.
>Added to that, the "logging in as root" part is largely unnecessary.
Ok, but in that case, the use would only be able to destroy its own files, which he's allowed to do anyways... Without Admin access, there is no spyware installation, no dirty tools added at the startup and the like. This makes a huge difference.
In the linux a stupid user would destroy its own data, in the Windows case, he has destroyed the whole OS and potentially infects other machines around...
>>Have you heard such a thing as latex documents, man >>pages, pdf documents, etc... being infected with >>rogue macros ?
>I seem to recall some problems with PDF documents...
Right, that was a security issue that was patched. To my knowledge noone had the time to exploit it, no user was victim of this. Again there is a big difference here. On Windows such flaws remain for years and MS only correct them when there are hundreds of thousands of machines infected.
>The others, of course, aren't a valid comparison since >they can't *have* those kinds of macros in them. Which is perfectly sensible from the security point of view.
>Not to mention it's an application, not OS, issue. This is also an OS issue. Per default, on Windows, users are running with admin privileges. One small problem in an application and the whole system is compromised.
>>Why do Unix anti-virus scanners only search for >>Windows viruses in files that are typically >>hosted on Samba shares ? Why don't they recognize >>Linux viruses ?? >Because no-one bothers writing viruses for other platforms. Which is wrong. In the 80s and beginning of the 90s, there were numerous viruses for Amiga, Atari and Macintosh (the old generation before Mac OS X) Amiga and Atari were much more marginal than Linux.
So here again the difference is in the OS. Amiga, Atari and pre-OS X Macs had no security at all. Virus writers didn't wait for the market share to rise to write viruses.
>>Have you heard of a Web browser on Unix being hijacked >>by something like Active-X... >I've heard of remote code execution bugs in versions >of Netscape Navigator, yes. Again, same problem as with the pdf. This typically a security flaw in a particular version and that was corrected rapidly enough. I've never heard of anyone being actually attacked by this.
And also, there is an OS issue here. If such a flaw is exploited, it's obvious that OS were people are typically running as admin would create much more trouble.
>>Why wouldn't Bill Gates simply create huge virus >>outbreaks for Linux instead of attempting to fool >>the world with ridiculous FUD arguments ? >Because, unlike you, Bill Gates isn't an angry >teenager who thinks causing damage is the solution >to every problem. I'm not a teenager first of all. And yes, Bill Gates tries to damage Linux. Simply look at the SCO/Baystar/Microsoft scandal and the FUD from Redmond.
Ok, let's assume this, but what would be the multiplication vector ?
Do you really think a linux user could easily be tricked into saving a suspicious e-mail attachment on the disk, adding the x flag, logging as root and attempting to run it ?
Have you heard such a thing as latex documents, man pages, pdf documents, etc... being infected with rogue macros ?
Why do Unix anti-virus scanners only search for Windows viruses in files that are typically hosted on Samba shares ? Why don't they recognize Linux viruses ??
Have you heard of a Web browser on Unix being hijacked by something like Active-X...
Why wouldn't Bill Gates simply create huge virus outbreaks for Linux instead of attempting to fool the world with ridiculous FUD arguments ?
How many Unix users run word processors, spreadsheets, e-mail clients, web browsers using the root account ? Even a total beginner wouldn't such a thing on Unix because the normal installation procedure asks the user to create a normal user account. Running as root would in fact be more complicated for the end user than running with his user account.
Is there any Unix machine in the world that is transformed in a zombie that sends spam ?
Have you heard of any Unix rootkit that would be automatically installed simply by inserting a CD or a removable device ?
How many Linux or Unix systems have their executable, drivers or system files writeable by users ?
There simply appear to be no credible virus threat on Linux at all, no propagation mechanism, no way that an eventual malicious program run inadvertently by a user could do any significant damage besides on his own files...
And please don't tell that it's a question of market share... Linux is widely deployed on servers which makes it an interesting target.
Don't worry to much about weak passwords in Windows... The most important security problems in Windows are: 1) Users running on their machine with admin privilege. This is completely stupid (no Unix user would read mail and surf the web as root), but this is Microsoft default. 2) Bad code which allows buffer overflow, stack smashing, etc.. attacks.
There are hundreds of millions of Windows PC infected with malware and this is not due to weak passwords...
There is also vnc over ssh: ssh -N -C -L 5901:localhost:5900 yourname@yourserver1 ssh -N -C -L 5902:localhost:5900 yourname@yourserver2 And then open do a VNC to localhost::5901 and localhost::5902
And remote desktop over ssh: ssh -N -C -L 3390:windowsmachine1:3389 yourname@somesshserver ssh -N -C -L 3391:windowsmachine2:3389 yourname@somesshserver And then open a remote desktop to localhost:3390 and localhost:3391
Well, it may also depend how we count the percentage... Most Firefox users also have IE installed. So I would almost agree with the 99% figure if we assume that the total market share is above 100%...
But my point is: a market share of 82% doesn't mean necessarily that 82% of the web pages are downloaded with IE. Why ? Because, from my point of view, IE users are typically not intensive internet users.
It's not specifically Bush's fault... The NSA was spying on US citizens and the rest of the world since a very long time... That was also the case with Clinton and many others...
Ok, let's admit that this is legitimate for the govnerment to have a right to solve crimes by installing spyware on a computer... But what kind of crimes could be solved by installing trojan on the computer of someone ?? - murders ? - rapes ? - car thefts ? None of these... Are the people really so naive to think that a murderer will list the victims and all the details in an Excel sheet, to be then conviniently found by the police ?
And what about the financial crimes ? In this case, it would be more appropriate to cease the servers of a company instead of people personal computers...
This looks just like a new way to invade the privacy of people without good reasons...
Is this trojan really made to solve crimes or to plant evidence ?
You're perfectly right... So called anti-spyware vendors are cowards. Simply remember the Sony rootkit story. They perfectly knew about it but did nothing to remove the rootkit. Even Microsoft apparently didn't care that Sony was corrupting the Windows install of millions of users.
By the way, these stories are a supplementary reason not to use Windows.
If you need Skype, download the statically linked binaries and run it into a chroot jail. The authorities will be able to spy on your communications, but at least not on your personal files.
There is a big difference between market share (number of people using a particular browser) and web usage (how many hits by a particular browser).
When someone says that market share of IE is 82%, it should IMHO mean that 82% of users are using IE.
But IE users tend to use the web a lot less than Firefox users. Why ?
Huge amounts of pop-ups, no tabs (lots of Windows saturating the task-bar, security holes).
IE users are, from my point of view, mostly occasional users of the Web. They simply use what is installed as default.
Advanced web users will be rapidly pissed off by the pop-ups and other annoyances... and switch to something else...
So some DVDs won't be playable on PCs using some operating system... Will it be effective ? Absolutely not...
The fact that files will be tagged as 0-byte in length may cause DVD players to refuse to play it, but that doesn't prevent anyone to make a raw copy of it...
Slashdot Mirror
>>When a Windows user receives a zip file containing a file
.exe to .txt in Windows and Explorer
./malicious.mpg
>>named hello.txt.exe", the default explorer settings makes
>>it appear as "hello.txt", because of the "mask extension
>>of known file type 'feature'".
>This is a UI semantic, nothing more.
Right, but this is dangerous (this allows to lure users) and this doesn't bring anything to the user. After all the trouble it caused, why hasn't MS simply made the default to show the complete filename ?
>>Then instead of launching a command like "notepad.exe hello.txt"
>>or opening a text editor and opening the file from within, when
>>you double-click on a file in Windows, it gets EXECUTED.
>Of course it gets executed - it's an executable file. Why
>wouldn't it ?
Because an application like a mail reader shouldn't expect to
receive executable code from an e-mail. So the file shouldn't
be executable. Again, a minor tweak that could save people a lot
of problems. Why on hell should a data file (a file generated with
a "Save As..." dialog) be executable ? It would be a minor tweak in
default Windows permissions, not to put the "Execute" flag.
Like on Unix: saving a file puts the permissions to "-rw-------", not to "-rwx------".
>Not that you can directly open executable attachments on any
>remotely recent version of Outlook or Outlook Express in the
>first place, making your whole argument moot.
Ok, so some minor progress from MS...
>(The real irony here is that GUIs like KDE and GNOME are,
>if anything, *more* vulnerable to this style of attack
>because they don't make any attempt to verify whether a
>file's extension matches its type. So a file called blah.txt,
>if it's really an executable binary, will be run as an executable
>binary regardless - rename a
>will just open the file in notepad.)
No, sorry this is wrong. The mechanism is to associate a file extension with a program to view it. mpg files are associated with xine or mplayer typically. If you feed mplayer with an executable, it would say something like unknown file format, no codec found for this file, etc... txt files are associated with KEdit, typically. When there is no extension, the file isen't associated with anything and the user can eventually choose a program to open with. But the file is never run.
Doing a command like:
$ mplayer malicious.mpg
is very different than:
$ chmod u+x malicious.mpg
$
The former requires only a mouse click and can happen by accident, but is harmless.
The latter not.
>>Ok, but in that case, the use would only be able to destroy
>>its own files, which he's allowed to do anyways...
>The user's files are typically the most important on the machine.
I agree for a home PC. (mono-user) Else there are other's users files that are more important.
>>Without Admin access, there is no spyware installation, no
>>dirty tools added at the startup and the like. This makes
>>a huge difference.
>Of course there is. The malware gets hidden away somewhere in
>~ and the user's dotfiles and GUI are modified to relaunch it
>whenever they login (KDE, GNOME, etc - most have some sort of
>"launch on login" functionality).
Right... There could be an attack vector here. But this assumes that the user has already executed a rogue executable.
>>In the linux a stupid user would destroy its own data, in the
>>Windows case, he has destroyed the whole OS and potentially
>>infects other machines around...
>"Destroying the OS" barely qualifies as a minor irritation
>compared to losing all your data files
Well, we're talking here about people needing to reinstall Windows every 6 months due to spyware
>>Do you really think a linux user could easily be
>>tricked into saving a suspicious e-mail attachment
>>on the disk, adding the x flag, logging as root
>>and attempting to run it ?
>No, but this is because of the Linux *user*, not
>Linux. (Although many would argue it is indirectly
>because of Linux requiring more savvy users).
The difference is in Linux and it's application.
When a Windows user receives a zip file containing a file named hello.txt.exe", the default explorer settings makes it appear as "hello.txt", because of the "mask extension of known file type 'feature'".
Then instead of launching a command like "notepad.exe hello.txt" or opening a text editor and opening the file from withing, when you double-click on a file in Windows, it gets EXECUTED.
This is such an ill-design that it's not surprising that so many people are tricked.
>Added to that, the "logging in as root" part is largely unnecessary.
Ok, but in that case, the use would only be able to destroy its own files, which he's allowed to do anyways... Without Admin access, there is no spyware installation, no dirty tools added at the startup and the like. This makes a huge difference.
In the linux a stupid user would destroy its own data, in the Windows case, he has destroyed the whole OS and potentially infects other machines around...
>>Have you heard such a thing as latex documents, man
>>pages, pdf documents, etc... being infected with
>>rogue macros ?
>I seem to recall some problems with PDF documents...
Right, that was a security issue that was patched. To my knowledge noone had the time to exploit it, no user was victim of this. Again there is a big difference here. On Windows such flaws remain for years and MS only correct them when there are hundreds of thousands of machines infected.
>The others, of course, aren't a valid comparison since
>they can't *have* those kinds of macros in them.
Which is perfectly sensible from the security point of view.
>Not to mention it's an application, not OS, issue.
This is also an OS issue. Per default, on Windows, users are running with admin privileges. One small problem in an application and the whole system is compromised.
>>Why do Unix anti-virus scanners only search for
>>Windows viruses in files that are typically
>>hosted on Samba shares ? Why don't they recognize
>>Linux viruses ??
>Because no-one bothers writing viruses for other platforms.
Which is wrong. In the 80s and beginning of the 90s, there were numerous viruses for Amiga, Atari and Macintosh (the old generation before Mac OS X) Amiga and Atari were much more marginal than Linux.
So here again the difference is in the OS. Amiga, Atari and pre-OS X Macs had no security at all. Virus writers didn't wait for the market share to rise to write viruses.
>>Have you heard of a Web browser on Unix being hijacked
>>by something like Active-X...
>I've heard of remote code execution bugs in versions
>of Netscape Navigator, yes.
Again, same problem as with the pdf. This typically a security flaw in a particular version and that was corrected rapidly enough. I've never heard of anyone being actually attacked by this.
And also, there is an OS issue here. If such a flaw is exploited, it's obvious that OS were people are typically running as admin would create much more trouble.
>>Why wouldn't Bill Gates simply create huge virus
>>outbreaks for Linux instead of attempting to fool
>>the world with ridiculous FUD arguments ?
>Because, unlike you, Bill Gates isn't an angry
>teenager who thinks causing damage is the solution
>to every problem.
I'm not a teenager first of all. And yes, Bill Gates tries to damage Linux. Simply look at the SCO/Baystar/Microsoft scandal and the FUD from Redmond.
>From a te
Ok, let's assume this, but what would be the multiplication vector ?
Do you really think a linux user could easily be tricked into saving a suspicious e-mail attachment on the disk, adding the x flag, logging as root and attempting to run it ?
Have you heard such a thing as latex documents, man pages, pdf documents, etc... being infected with rogue macros ?
Why do Unix anti-virus scanners only search for Windows viruses in files that are typically hosted on Samba shares ? Why don't they recognize Linux viruses ??
Have you heard of a Web browser on Unix being hijacked by something like Active-X...
Why wouldn't Bill Gates simply create huge virus outbreaks for Linux instead of attempting to fool the world with ridiculous FUD arguments ?
How many Unix users run word processors, spreadsheets, e-mail clients, web browsers using the root account ? Even a total beginner wouldn't such a thing on Unix because the normal installation procedure asks the user to create a normal user account. Running as root would in fact be more complicated for the end user than running with his user account.
Is there any Unix machine in the world that is transformed in a zombie that sends spam ?
Have you heard of any Unix rootkit that would be automatically installed simply by inserting a CD or a removable device ?
How many Linux or Unix systems have their executable, drivers or system files writeable by users ?
There simply appear to be no credible virus threat on Linux at all, no propagation mechanism, no way that an eventual malicious program run inadvertently by a user could do any significant damage besides on his own files...
And please don't tell that it's a question of market share... Linux is widely deployed on servers which makes it an interesting target.
Don't worry to much about weak passwords in Windows...
The most important security problems in Windows are:
1) Users running on their machine with admin privilege. This is completely stupid (no Unix user would read mail and surf the web as root), but this is Microsoft default.
2) Bad code which allows buffer overflow, stack smashing, etc.. attacks.
There are hundreds of millions of Windows PC infected with malware and this is not due to weak passwords...
Well, I can already tell that this will do nothing for security. Copying an mp3 is not a security risk :-)
You should perhaps try rdesktop over ssh.
BTW, rdesktop also works perfectly with cygwin, so when MS says "no remote desktop for Vista Home", I laugh...
There is also vnc over ssh:
ssh -N -C -L 5901:localhost:5900 yourname@yourserver1
ssh -N -C -L 5902:localhost:5900 yourname@yourserver2
And then open do a VNC to localhost::5901 and localhost::5902
And remote desktop over ssh:
ssh -N -C -L 3390:windowsmachine1:3389 yourname@somesshserver
ssh -N -C -L 3391:windowsmachine2:3389 yourname@somesshserver
And then open a remote desktop to localhost:3390 and localhost:3391
I guess you mean the kind of security by obscurity which consists of hiding the system files in the windows explorer ?
Making the OS idiot-proof is not true security anyways...
Maybe, but this does nothing against viruses, spyware and the like...
It's still not proven that a virus can work on Linux or BSDs, so they have a long time to go before they can claim to be the most secure OS...
Microsoft has been condemned by a court in the UK for deceptive advertising...
Well, it may also depend how we count the percentage...
Most Firefox users also have IE installed.
So I would almost agree with the 99% figure if we assume that the total market share is above 100%...
But my point is: a market share of 82% doesn't mean necessarily that 82% of the web pages are downloaded with IE. Why ? Because, from my point of view, IE users are typically not intensive internet users.
It's not specifically Bush's fault... The NSA was spying on US citizens and the rest of the world since a very long time... That was also the case with Clinton and many others...
Ok, let's admit that this is legitimate for the govnerment to have a right to solve crimes by installing spyware on a computer...
But what kind of crimes could be solved by installing trojan on the computer of someone ??
- murders ?
- rapes ?
- car thefts ?
None of these... Are the people really so naive to think that a murderer will list the victims and all the details in an Excel sheet, to be then conviniently found by the police ?
And what about the financial crimes ? In this case, it would be more appropriate to cease the servers of a company instead of people personal computers...
This looks just like a new way to invade the privacy of people without good reasons...
Is this trojan really made to solve crimes or to plant evidence ?
You're perfectly right...
So called anti-spyware vendors are cowards. Simply remember the Sony rootkit story. They perfectly knew about it but did nothing to remove the rootkit. Even Microsoft apparently didn't care that Sony was corrupting the Windows install of millions of users.
By the way, these stories are a supplementary reason not to use Windows.
If you need Skype, download the statically linked binaries and run it into a chroot jail. The authorities will be able to spy on your communications, but at least not on your personal files.
There is a big difference between market share (number of people using a particular browser) and web usage (how many hits by a particular browser). When someone says that market share of IE is 82%, it should IMHO mean that 82% of users are using IE. But IE users tend to use the web a lot less than Firefox users. Why ? Huge amounts of pop-ups, no tabs (lots of Windows saturating the task-bar, security holes). IE users are, from my point of view, mostly occasional users of the Web. They simply use what is installed as default. Advanced web users will be rapidly pissed off by the pop-ups and other annoyances... and switch to something else...
So some DVDs won't be playable on PCs using some operating system...
Will it be effective ? Absolutely not...
The fact that files will be tagged as 0-byte in length may cause DVD players to refuse to play it, but that doesn't prevent anyone to make a raw copy of it...
Like:
# dd if=/dev/hdc of=dvd.iso
# cdrecord-prodvd dvd.iso
# rm dvd.iso