Oh my, read this; http://www.omgubuntu.co.uk/2009/12/malware-found-in-screensaver-for-ubuntu.html
Of course this is just the beginning, I saw this in the early days of windows, popularity means people want flashy yet lame screensavers so they go a hunting, see a banner ad that is flashing epileptically at the user that tells them their search is over, they click it and install a new theme for their cursor (I hate these), a day of the month screen saver, or a fancy toolbar which will let you know who is browsing your MyFaceTwitLinked page at any given time, and also automatically installs thousands of other applications you may like, hiding in these are some nice little bots. Of course on install it asks them for their password as it has to make system changes, it then puts a helper in roots cron and makes a new init.d daemon to keep it memory resident and its privledges elevated, heck maybe it even recompiles some binary that is used frequently with elevated privledges that checks all that other stuff is still good to go, something like the logserver or init
Then we Linux will have reached the popularity of windows, the weakest link will again be the user.
So in my humourous little story above I am trying to point out just cause it is safe now won't mean it will be forever. Windows is less and less about Worms that automatically get in without user intervention. Conficker was the last big one and MS had a patch out before it hit, so it was only slow patching that really let it spread. The rest of the viruses that are seen are delivered along with innocuous looking software, or at worst a drive by download that means a page is running something in the background that takes advantage of a hole in internet explorer to install something, these drive by downloads won't happen. But have a look at the top 15 http://www.net-security.org/secworld.php?id=8597 most common attacks and you will see Linux and Macs are susceptable to the lot, through misconfiguration or user error.
Don't get me wrong I am a big Linux fan-boi. If I had it my way Windows would be the struggling niche, Linux would have 96% market share, BSD 2% and macs wouldn't exist :P I think the ideal behind linux is very admirrable and scientific. Linux builds on what has come before it (usually) and because what has come before is open and readable this is fairly easy. "If I have seen further, it is by standing on the shoulders of giants." Sir Isaac Newton. To not build on what has come before is to repeat your predecessors mistakes.
There will always be flaws, till we write code that can write its own code it may eventually create something almost flawless, or one of its children will.
I think Linux allows for greater security, but also greater insecurity. Security is not where open sources power lies, it is its flexability.
2 comments:
Linux is far from secure, every NX stack implmentation has been broken time and time again. Most distro installs allow root logins rather than ship with instructions to use sudo. SSH allowed root login. Not to mention the recent space of null dereference exploits, that allowed SELinux to be switched off; how is that secure.
If it wasnt for theo de ratt and his openbsd work, most security conerns in linux would still exist. Take a look at the amount off remote vulns for linux apps and kernel. Compare it to windows 2003 or windows 2008. It actually has tipped the scales. Linux is very insucure and the myth needs to die.
I Completely agree rioter, Linux CAN be secure, so can Windows. A server is only as good as it's admin, my main like for Linux is its flexability and with flexability comes vulnerability.
Post a Comment