- Site menu:
- Latest Discussions
- Latest Newswire
- Archives
- Submit Story
- Story HOWTO
- Syndicate
- E-mail Alerts
The truth about viruses
I am a strong proponent of Open Source. And, I tend to agree that there are more security holes than actual functionality in Microsoft's OSes, browsers, etc. This is a sad consequence of how these systems evolved. |
|
Comments (25)
5 earlier comments in the full thread.
Sander, he is correct, but it sounds like he is ignoring the fact that Windows is trivially easy to exploit. Also, Linux code is wide-open and Windows code is closed, so common sense might assume that open code would present an easier target. But the richest software company on the planet can't implement security worth a darn, while all those unwashed FOSS hippies are very good at it.
I believe, if I remember correctly, that the biggest holes in FOSS-land these days are dynamic web sites. They're complex, and there is an awful lot of bad scripting, plus known vulnerabilities that don't get patched even when fixes are available. But that's all the goo on top of Apache and Linux, which are very strong. Which is the opposite of Windows, which is an integral part of a giant vertical stack that's porous no matter where you poke at it. And there is nothing in Windows-land analogous to SELinux or AppArmor, which are able to mitigate even bad scripting and unknown security holes.
I'll agree that greater popularity = presenting a more attractive target. But if Windows and Linux/Unix were magically equal overnight, Windows would still be the undisputed malware king by a factor of thousands, simply because it is so weak.
I believe, if I remember correctly, that the biggest holes in FOSS-land these days are dynamic web sites. They're complex, and there is an awful lot of bad scripting, plus known vulnerabilities that don't get patched even when fixes are available. But that's all the goo on top of Apache and Linux, which are very strong. Which is the opposite of Windows, which is an integral part of a giant vertical stack that's porous no matter where you poke at it. And there is nothing in Windows-land analogous to SELinux or AppArmor, which are able to mitigate even bad scripting and unknown security holes.
I'll agree that greater popularity = presenting a more attractive target. But if Windows and Linux/Unix were magically equal overnight, Windows would still be the undisputed malware king by a factor of thousands, simply because it is so weak.
Quoting:So, his point is that it's not the market share of the OS that counts, but the (potential) marketshare of the virus. For Windows servers that is much higher, even though the marketshare of the OS is lower.
I'd say he's effectively argued that Linux is less susceptible to malware.
Quoting:I'll agree that greater popularity = presenting a more attractive target. But if Windows and Linux/Unix were magically equal overnight, Windows would still be the undisputed malware king by a factor of thousands, simply because it is so weak.
EXACTLY!!
The popularity premise is a severely flawed one, but easy to for the "unwashed masses" to fit in their heads. It is one of those arguments that "sounds" like it makes sense, until you really think about it. Which is why it's believed so easily.
As Carla points out, How can a bunch of "unwashed FOSS hippies" do security better than the multi-billion dollar Microsoft Corporation can? Its because MS is not concerned about computer security, their concerned about corporate security.
Nudge nudge, wink wink, know what I mean?
> Comments?
Sure. Who cares?
There are a lot of Windows viruses. There are no widespread Linux viruses. End of discussion.
Let's imagine you are having a different discussion with a potential Linux user. Potential user: "I'd really like to switch to Linux, but there's no native iTunes for Linux." You: "That's because iTunes is closed and Apple won't port to Linux." Potential user: "Oh, wonderful, now that you've explained why there's no iTunes, I will switch to Linux." This won't happen, because the why doesn't matter. It doesn't change the fact that there's no iTunes.
You can have philosophical discussions about why Windows has so many security problems. It would be just that - philosophy. If you are making a choice about which OS to use, you look at the things that are important to you. If you need iTunes, don't use Linux. If you want to avoid viruses, don't use Windows. It doesn't matter why Windows has more, it just does. There are more today and there will be more five years from now. Paris Hilton will not be interested in me even if I explain why I have a large belly, and I will not be interested in Windows even if someone can explain why it is so insecure.
Sure. Who cares?
There are a lot of Windows viruses. There are no widespread Linux viruses. End of discussion.
Let's imagine you are having a different discussion with a potential Linux user. Potential user: "I'd really like to switch to Linux, but there's no native iTunes for Linux." You: "That's because iTunes is closed and Apple won't port to Linux." Potential user: "Oh, wonderful, now that you've explained why there's no iTunes, I will switch to Linux." This won't happen, because the why doesn't matter. It doesn't change the fact that there's no iTunes.
You can have philosophical discussions about why Windows has so many security problems. It would be just that - philosophy. If you are making a choice about which OS to use, you look at the things that are important to you. If you need iTunes, don't use Linux. If you want to avoid viruses, don't use Windows. It doesn't matter why Windows has more, it just does. There are more today and there will be more five years from now. Paris Hilton will not be interested in me even if I explain why I have a large belly, and I will not be interested in Windows even if someone can explain why it is so insecure.
Of course, we don't want to mention root kits...
> Of course, we don't want to mention root kits...
The most widespread root kit I know of was the one distributed by Sony on their CD's. It was Windows specific. I believe the recent Linux root kit used to distribute javascript attacks pales in comparison.
The most widespread root kit I know of was the one distributed by Sony on their CD's. It was Windows specific. I believe the recent Linux root kit used to distribute javascript attacks pales in comparison.
>The most widespread root kit I
So?
So?
> So?
Your comment made it sound like you thought Windows would compare favorably with Linux wrt root kits.
Your comment made it sound like you thought Windows would compare favorably with Linux wrt root kits.
No, but even you should see that the Sony CDs were a special case.
Sony wasn't all that special a case, there have been several incidents of big companies installing sneaky rootkits in the name of protecting their ohsospecial eye pee. They just got the most attention.
Another significant advantage in the linux/unix world are SELinux and AppArmor, which are effective protections against rootkits. Rootkits are over-emphasized anyway- plenty of damage can be done from unprivileged user's accounts: data theft, spam spewing, proud member of the worldwide botnet, hosting warez, and so forth. You don't need root to do significant damage.
Another significant advantage in the linux/unix world are SELinux and AppArmor, which are effective protections against rootkits. Rootkits are over-emphasized anyway- plenty of damage can be done from unprivileged user's accounts: data theft, spam spewing, proud member of the worldwide botnet, hosting warez, and so forth. You don't need root to do significant damage.
> No, but even you should see that the Sony CDs were a special case.
Only moderately so. There were more CD's released with the root kit than any other equivalent infection I know of, but media/hardware being released with malware already installed is a common story now. Even FOSS isn't immune.
Only moderately so. There were more CD's released with the root kit than any other equivalent infection I know of, but media/hardware being released with malware already installed is a common story now. Even FOSS isn't immune.
Two things haven't happened yet. The promissed virus problem for Linux hasn't materialized - and - a secure version of Windows hasn't been released.
I'm not holding my breath for either to happen anytime soon.
I'm not holding my breath for either to happen anytime soon.
> The promissed virus problem for Linux hasn't materialized...
There is a current active root kit problem with Linux servers, which has been discussed here in the recent past. The means of compromise is still unknown at this time, though it may be the recently patched overflow hole in the kernel.
There is a current active root kit problem with Linux servers, which has been discussed here in the recent past. The means of compromise is still unknown at this time, though it may be the recently patched overflow hole in the kernel.
Quoting:The means of compromise is still unknown at this time
I thought that the consensus on that was that the attacker had social engineered his way to a list of root passwords. That meshes well with the observation that virtually all the compromised machines with that rootkit were from the same hosting company.
Root Kits
Can some one put up a link on root kit detection?
> I thought that the consensus on that was that the attacker had social engineered his way to a list of root passwords.
Possible, but I haven't heard anything definitive. If you do, please pass it on. I'm sure others besides me would be interested.
Possible, but I haven't heard anything definitive. If you do, please pass it on. I'm sure others besides me would be interested.
> Can some one put up a link on root kit detection?
Joe Barr had a recent review of three alternatives on linux.com which was linked to by LXer: It's pretty good:
http://www.linux.com/feature/128450
Joe Barr had a recent review of three alternatives on linux.com which was linked to by LXer: It's pretty good:
http://www.linux.com/feature/128450
@jdixon: What I read wasn't definitive either, but it's the gist of the various threads I read over at webhostingtalk.
@ColonelPanik: I use Rootkit Hunter and DenyHosts (with central synchronisation) on all my (server) machines:
http://rootkit.nl/projects/rootkit_hunter.html http://denyhosts.sourceforge.net/
@ColonelPanik: I use Rootkit Hunter and DenyHosts (with central synchronisation) on all my (server) machines:
http://rootkit.nl/projects/rootkit_hunter.html http://denyhosts.sourceforge.net/
A salute for those links! /°_°
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
Sign up and post (it is free) or Log in and post
I've been having an interesting discussion about that with a co-worker of mine. He trolled out the argument that Windows has more virusses because it's more popular and I came with the Linux/Apache defense. We then ended up discussing the differences between desktop and server OS's. End users are a lot easier to trick then sysadmins. My counter argument was that there are also a lot more virusses targetting Windows servers specifically (IIS, SQL-Server) than Linux servers.
Our discussion then shifted to the technical differences between Linux and Windows. How Linux has all these permissions and security stuff built in. And that breaking into one Linux machine doesn't mean you get into all of them. After all, they're all different. Different distros. Different software. Different configuration. Different security mechanisms (SELinux, AppArmour, etcetera). He then made a very good point that I haven't been able to counter (yet): It's about market share after all. Write a virus for Windows and you can grab potentially up to 25% of the servers. Write a Linux virus and you'll capture at most 1%-2% of the Linux servers. (1) because they're all different and (2) because the exploit gets patched so fast it stops your virus in it's tracks.
So, his point is that it's not the market share of the OS that counts, but the (potential) marketshare of the virus. For Windows servers that is much higher, even though the marketshare of the OS is lower.
Comments?