Messages in this thread | | | From | Jörg Ostertag <> | Subject | Re: [malware-list] Threat model for Unix Computers | Date | Fri, 8 Aug 2008 12:48:55 +0200 |
| |
Am Mittwoch, 6. August 2008 03:44 schrieb Theodore Tso: > On Tue, Aug 05, 2008 at 08:46:00PM -0400, Rik van Riel wrote:
...
I'm trying to fill in some other thread models, not all directly related to virus-scanning, but if we want to get a complete anti-threat model for linux, we should take them into account too. In addition I'll add some usage scenarios for later extracting some threat scenarios ...
Desktop-Users: ---------------------- > The Linux Desktop (where clueless users may be tricked into > running malware).
I would add the chance of users exporting there locally stored Files via CIFS, SMB, http, ... for accessing them with there beloveled streaming clients.
Speaking of exporting Files from a Desktop PC we should also take in account File-Sharing clients.
Some more examples of a Desktop Users desire would be: - copying Files to/from there PDA (BT,USB,WLAN) - sharing internet connection with there PDA (BT,USB,WLAN)
Another threads would be: - giving access to the Desktop-PC to guest-users for "just let me look up something in the internet" and the guest-user on the Desktop not informing about the (in his point of view) urgent installation of there beloved Browser-malware^H^H^H^H^H -adware ^H^H^H^H^H -extention
For all the Files stored on the Desktop PC we should also take in account, that the paranoid Desktop user would store them inside a crypted device/container. Some examples would be: truecrypt-container/-partition, External crypted Harddrive, ...
... speaking of storing Files I would expect even Desktop Homeusers to store there Files on a local mini Fileserver (like a Fritz-Box, NSLU2, ...) to share them with other devices like Multimedia players, ...
Notebook-Users: ------------------------ And then we have the Linux Notebook users. I separate these from the Desktop users, because they will have most of the Scenarios for Desktop users plus some additional treats. - Connecting to random accesspoints (Airports, Hotels, ...) - Exporting there Wireless (BT,WLAN,UMTS, ...) to random people. Sometimes willingly, sometimes unwillingly - leaving there Notebooks unattended - without Bios password - without HDD-encrytion - without Boot-Manager Password - without screenlock - ...
Linux Desktops in public places: -------------------------------------------- I'm thinking of Linux Desktop PCs in places like Internet-Cafe, Public-Library, School, ... These would be similar to the Standard Linux Desktop but adding some additional threats. - willingly trying to attack the PC with physical access to - CD-Rom - USB-Devices USB-Stick Card Reader - Network cable - Floppy drive (if still existing) - Reset Button
> The Linux File Server (where it is *highly* unlikely to have > active running malware, since there are no clueless > users running on said file server), but where malware > may be stored and read over CIFS, NFS, etc.
Maybe it "was" unlikely, but you can see more and more (Now-)Unix-administrators originally used to other operating systems and with a different view to security. So it would be nice if we would be able to protect these users/admins/installations too.
Mail-Proxy: -------------- > The Linux Mail server is really a restricted case of the Linux > Fileserver; where the only way in is SMTP, and the > only protocol out is IMAP/POP.
I would add SMTP for the outgoing channel too.
Web-Proxy: ---------------- Only to complete the list: The Linux Web Proxy is another example of a Linux Server. The way in would be http traffic (mostly over port 80 and 443) and the way out will be either over a shared proxy port or offered transparent if the Linux machine is used as router.
In my opinion all good webproxies with scanner already provide a pretty good solution here.
-- Jörg Ostertag - Manager UNIX SW Development - Avira GmbH Phone: +49 (0) 7542/500-500 Fax: +49 (0) 7542/500-576 Lindauer Str. 21, D-88069 Tettnang, Germany, http://www.avira.com PGP Key-ID: 0x46BDEF37
Geschäftsführender Gesellschafter: Tjark Auerbach Sitz der Gesellschaft: Tettnang Handelsregister: Amtsgericht Ulm, HRB 630992
ALLGEMEINE GESCHÄFTSBEDINGUNGEN Es gelten unsere Allgemeinen Geschäftsbedingungen (AGB). Sie finden sie in der jeweils gültigen Fassung im Internet unter http://www.avira.de/agb *************************************************** -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |