Comment of the Day - October 12, 2005 Linux Viruses Exist

The "santy" worm may qualify as your "poly-platform worm". Written in Perl, it ran on Windows, Linux and Solaris at least. Looking in my home web server's access log, I did "xprobes" on the IP addresses, and Ofir Akin's xprobe identified at least that many different OSes.

The exploit amounted to a semantic version of a buffer overflow in a PHP bulletin board.

But to return to MESMERIC's point, yes, Unix worms predate almost all MS-DOS viruses, much less WIndows worms. I think this is another sterling example of the path that software takes through the market. Lots of stuff (Worms, viruses, web servers, web clients, PPP, DNS, TCP/IP, email) gets developed on some fringe platform, BSD Unix or TOPS-20, or NeXT (the original HTTP server and client ran on NeXTStep).

The Windows code monkeys grab it, mess it up, and the unwashed masses think that Bill Gates invented The Internet. Same with worms. The first real TCP-based worm, the November 1988 "Morris" worm was multi-platform (M68K-SunOS and VAX-BSD), a "blended" threat according to today's "AV" jargon (it exploited at least 2 vulnerabilities, plus the BSD r-suite, plus guessing passwords), and it did "topological searching" via /etc/hosts entries, or those Berkeley r-commands' .rhosts files.

That constitutes a level of sophistication not seen again until the Nimda worm came out.

But it's like that all over. MIT's X windowing system has a degree of network transparency not seen even now in Windows. The good stuff always starts out under something other than Windows or MS-DOS, and then Microsoft (or their henchmen) appropriate some twisted, low-rent version of it for their own.

IMESHO much more relevant than this.

While Linux and Unices in general also have layers of ancient cruft in them, the developers have generally been much more willing to tear up subsystems and start again from scratch.

It kind of reminds me of real-life viruses: because we clean out the 'fridge every so often -- simple sanitation -- we're much less susceptible to each version of the Black Plague as it comes through; there's hardly anything for it to grow on.

During the real Black Plague, many Jews were strung up and/or burnt on charges of being "in league with the devil" for going through the Plague largely unscathed. They did it sans demonic alliances by simply following a set of strict sanitation laws laid down for them several thousand years earlier. Rather than having to fight the Plague, they simply avoided getting it in the first place.

Linux follows, if you like, a similar set of laws. One of the valuable but seldom-recognised things which Linus does for Linux is stresses keeping things simple (sanitary), and being more than willing to rip up the floorboards and rebuild when necessary.

Bill Gates, OTOH, has been more than willing to let garbage pile onto cruft until MS-Windows became an unmanageably tangled mess drenched in complexities and exceptions, each of them practically begging to have a virus planted in it. Instead of extending MS-DOS one more time (the evil is not in the command-line, but in the absence of a handful of key features and the sweeping implications of that ignorance), it needs to be categorcially shot and replaced.

Wonder of wonders, that is actually being done. MS-Vista is significant not for big new features but for being a substantial rewrite. I think others in Microsoft (not Bill) saw the writing on the wall, and it said: "if you don't tear this cruft up and throw it away, your users will tear up and throw you away."

MS-Vista has been the third really big rewrite in Microsoft-land, and the first ever that didn't involve parasitising on the Digital Equipment Corporation.

The first two were the NT codebase (basically a VMS variant called MICA which they stole holus-bolus (it was "spelling-error compatible") and later paid fines for), and the big SQL Server rewrite. Without those two big injections of fresh conceptual blood, Microsoft would be insignificant today.

The two rewrites of big slabs of MSIE also deserve an honourable mention.

The massive re-engineering which has gone into Vista will take a long time to pay off, especially because they haven't yet done enough (partly because of the layers of cruft that they copied over for compatibility's sake, and partly because their mandate is burdened with heavy doses of DRM and other distractions which have nothing to do with core system strength), but it is finally a step in the right direction.

Pointing out the rare and anaemic viruses for Linux is really beside the point as long as we fair to draw the important lessons from it. These include but are not limited to:

monocultures are unhealthy

most users are not administrators, and shouldn't be

hiding stuff is bad

letting secondary considerations influence your core design is bad (I have a good example from the auto industry)

it's far better to bite the bullet before infection sets in than afterwards

some really good stuff is "not invented here"

"Pride goeth before destruction, and an haughty spirit before a fall" (I'd long wondered where that originated, and it turns out to be the bible, at Proverbs 16:18)