lkml.org 
[lkml]   [2001]   [Sep]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRE: [OT] New Anti-Terrorism Law makes "hacking" punishable by life in prison
Date
> -----Original Message-----
> From: linux-kernel-owner@vger.kernel.org
> [mailto:linux-kernel-owner@vger.kernel.org]On Behalf Of J Sloan
> Sent: Sunday, September 30, 2001 2:42 PM

[snip]

> OK, the obvious question:
>
> If apache is 60% of the market and IIS is 25%
> (and I have heard that apache on Linux is about
> 33% of the web server market) how do you see
> that as windows/iis being more popular than the
> linux/apache platform? and yet, windows/iis has
> the lions share of vulnerabilities - your arguments
> lie in tatters....

We need to distinguish between Linux/Apache and other-UNIX/Apache.
Specifically, there's at least Solaris, Tru64 and AIX besides Linux in this
market. It isn't just IIS; the Nimda beast exploited, IIRC, 18 separate
vulnerabilities in the Windows / IIS complex, including shared files.

I've actually heard of cases where *Linux* systems exporting filesystems
with Samba had Nimda code stuffed down their throats! If this code had been
Linux-executable rather than Windows-executable -- if the virus had been
smart enough to know it was dealing with a Samba rather than a Windows share
and had been able to differentiate between Windows executables and Linux
executables -- hmmm ... do you see what I'm getting at??? In other words,
UNIX systems of *all* stripes that export filesystems with Samba need to
track mods to executables just like a virus scanner does on a Windows
system. *That's* what I mean by vigilance.

[snip]

> I think Unix's long history of multiuser, networked
> operation gives it quite a bit more sophistication in
> areas of security, as opposed to windows, a single
> user system which has in the past few years
> become widely networked.

The security features are there in Windows if the users and sysadmins are
willing to implement them. Windows NT has had C2 available for quite some
time; they couldn't sell to DOD if they didn't. A good MSCE / security
specialist makes a lot of money. It's for the most part laziness on the part
of Windows users that allows malicious code to circulate, not any inherent
weakness in the Microsoft tool set. The technology exists.

> I'm not saying Linux/Unix users should rest on their
> laurels or be lulled into a sense of false security, but
> come on, let's at least be realistic about the very real
> advantages of Unix OSes over PC OSes in this area.

I don't see any such advantage. C2 is C2; crypto is crypto; authentication
is authentication; vigilance is vigilance.

Here, for your amusement, is a snippet of Perl code:

$stuff = `uname`;
if ($stuff =~ /is not recognized as an internal or external command,/ {
# execute malicious Windows code
}
else {
# look at the uname stuff and figure out what OS we're running
# then execute OS-specific malicious code
}

Do you see what I'm saying?
--
M. Edward (Ed) Borasky, Chief Scientist, Borasky Research
http://www.borasky-research.net http://www.aracnet.com/~znmeb
mailto:znmeb@borasky-research.net mailto:znmeb@aracnet.com

Q: How do you tell when a pineapple is ready to eat?
A: It picks up its knife and fork.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:03    [W:0.142 / U:0.988 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site