lkml.org 
[lkml]   [1999]   [Aug]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Gates of Hell
On Thu, 12 Aug 1999, Jonathan Masters wrote:

> Yep. I took the same attitude with him as I did with barclays bank and
> threatened to sue him/her for discrimating between OSs in such a manner, I
> mean winblows is crap everyone knows, and OK, so MacOS is *better*, but since
> that microshark "loan" of millions to Apple, I will always view Apple and
> microshaft as being too close so I find this kind of discrimination very bad
> for everyone. BARCLAYS HAD THE NERVE to claim that
> LINUX IS ***LESS*** SECURE THAN WINDOWS 95/98/NT - what an utter sh*tload of
> crap. I mean, it made me laugh and I've still gotta decide if I'm gonna pursue
> the case with Barclays.... (I *used* to like them too).

Well, let's be less knee-jerk biased about this. As far as the network
is concerned, Win9X is nearly perfectly secure because they have an
outgoing-only sort of network. Can one crack a Win9X box on the
network? I doubt it -- even if one WANTS to login to it is impossible
because it is brain dead at the network level, because it has no shells,
and so forth. Macintoads are no better. So they're "secure" in that
only the person logged into the console can do anything and it is
difficult for a remote cracker to install a snooper or capture
keystrokes or the like.

WinNT is a more reasonable complaint; it has a real network and is
remote accessible and hence remote crackable. I'd guess that one can
crack a networked NT box and install a keystroke/mouse snooper (or
trapped version of Explorer) to trap that good old Barclay's password.

The difference is that linux has all source available, so all bugs are
very rapidly found and exploits published. This is good and bad -- good
in that if you religiously track the bugs and install patches you'll
stay at least even with the bad guys, bad in that if you are a newbie or
less conscientious, your system is probably approximately as secure as a
gazebo. Parts of our network here at Duke are being portscanned by
intruders literally daily; many of these are seeking well known services
(like NFS) on well known operating systems (like linux) to try well
known exploits that will slice into the attacked system as if its
security layer weren't even there. Historically, ALL unices have had
hole after hole uncovered in their daemons and services and binaries.
It was only a year or three ago that a bug in syslogd was uncovered that
gave open access to nearly every Unix system in the world, and sendmail
was legendary up into the mid 8.X's. I keep my home linux system secure
by simply turning off nearly all ports (and worrying about the two or
three I leave open!). Newbies, however, often bring up their system
with all sorts of daemons and services running and no idea how to manage
them. Indeed, they not infrequently don't even know that they are
running the services at all and don't even know what they do! They then
use telnet or rlogin to login to remote sites a few times and type their
passwd's in the clear on their LAN (which may be snooped) and the
destination LAN (which may be snooped). All of this is an invitation to
destruction.

In summary, is Barclay's being overconcerned? Possibly. At the very
least, you should be able to sign something absolving them of all
responsibility for an electronic theft from your accounts -- if you are
willing to do this. Are they completely crazy? Absolutely not! They
have no way of knowing if you are competent or incompetent as a systems
manager of your linux box. In the latter case you could share your box
with a dozen trolls and never know it. True, NT is little better, so
they are being discriminatory, but perhaps this is where they are being
foolish -- they probably shouldn't permit access from NT EITHER.

The question of how electronic commerce of all sorts will securely
proceed in the future is an interesting one. These days, any successful
cracker almost always has the opportunity (if they choose to use it) to
become a thief or blackmailer. Booby trap netscape and sooner or later
you'll get a credit card number. Perhaps you'll observe somebody
cruising a gay website. Maybe you'll intercept email to a secret lover.
Privacy is an important issue, and we assume our systems to be secure
when they almost never really are. Well, on THIS list they probably are
for the most part, but out there in userspace, especially now that linux
is in box sets in ordinary stores being installed by the ignorant, I'm
sure that they are not infrequently wide open.

rgb

Robert G. Brown http://www.phy.duke.edu/~rgb/
Duke University Dept. of Physics, Box 90305
Durham, N.C. 27708-0305
Phone: 1-919-660-2567 Fax: 919-660-2525 email:rgb@phy.duke.edu




-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:53    [W:0.083 / U:0.044 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site