Mailinglist Archive: opensuse (3031 mails)

["Benji Weber" <b.weber@xxxxxxxxxxxxx>]

On 07/02/2008, Mike <mike@xxxxxxxxxxxxx> wrote:
> > The notion that malware on linux was technically not feasible is
> > highly irrational. I think experienced senior linux users shouldn't
> > keep on spreading this deceptive mantra. You should know better.
>
> Why is it irrational? I disagree with that statement. Unless you can of
> course show me an attachment that auto-executes under linux.
>
>
> > Malware is not entirely about root, remember? John Doe user accounts
> > with dsl pipes, privacy breaches, Apps-can-do-all etc. You know the
> > list.
>
> No, it's not all about root. But it is about doing something stupid.
> There's no other way to describe it. First it has to be
> downloaded/saved. Then it has to be made executable. Then it has to be
> run. If all three things are done, then yes, you have a problem. But
> it's a three step process.

This is not the case. A browser running as a user can do anything the
user is allowed to do. For example an exploit in the browser or image
viewing library which can be exploited through malicious javascript or
crafted image could potentially delete all your user files. It could
be used to launch a denial of service attack or spam from your machine
(no need for root for this). If combined with a local root exploit
(which are not uncommon) it could potentially even get root and have
full control over the system. Same applies to your mail client, irc
client, and other such applications.

This is why it is important to both keep the software up to date, and
still not run untrusted code. If you completely ignore security by
blindly visiting pages with possible malware on, or running all email
attachments etc, even on openSUSE/GNU/Linux you are vulnerable.

There are technologies which can help, like apparmor/selinux etc, but
these are not yet user friendly enough for desktop users to use.

If you have an ssh server listening on the internet and you watch your
logs I would be surprised if you have not noticed brute force attacks.
Precautions such as strong passwords and fail2ban are important even
for home machines if you run sshd.

GNU/Linux systems are no less exploitable than windows. In some
respects they are more exploitable due to the more powerful tools they
have installed. Windows tends to be fairly locked down by default now.

The only reason you have a false sense of security now is that you are
not a significant enough target for malware authors. When that changes
if too many people have the same attitude then there will be a
problem.

--
Benjamin Weber
-- 
To unsubscribe, e-mail: opensuse+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse+help@xxxxxxxxxxxx