[SuSE Linux] Back Orifice style attacks possible in Linux??
Hi, Check out the following link regarding Back Orifice. <A HREF="http://www.wired.com/news/news/technology/story/16310.html"><A HREF="http://www.wired.com/news/news/technology/story/16310.html</A">http://www.wired.com/news/news/technology/story/16310.html</A</A>> It talks about the complete lack of security in the windows operating system. My question is: Are these types of attacks possible against Linux systems? Is it possible to inadvertently install a trojan, by installing an RPM as root ? Is it possible to have a process running under Linux that dosn't show up with a ps -aux? Or show up as a seemingly safe process, only to be hiding a secret trojan? Would the tripwire package detect an attempt to alter some linux executable? What I'm thinking is that during an install of some package, as root, a binary edit might be done on an existing executable. Do you need to do regular checksums of all your executables to see if they've been changed? Am I paranoid, or should we start worrying about this? - To get out of this list, please send email to majordomo@suse.com with this text in its body: unsubscribe suse-linux-e
yo ! i downloaded WvDial as a .deb.gz file and now i can't unzip it .. how da hell do ya unzip .deb.gz files !!! - To get out of this list, please send email to majordomo@suse.com with this text in its body: unsubscribe suse-linux-e
Someone asked a question here, as follows:
Am I paranoid, or should we start worrying about this?
Yes, and yes. ;-)) What I mean by that, is simply that from what I have heard about the Back Orifice thing, I suspect that the BO virus/trojan is too specialized to be a risk to Linux systems. _BUT_ we should keep on the alert, since we never know who will try something that might be a real threat. So, judicious use of Superuser accounts, su programs / scripts, tripwire systems, and frequent backups are ideas we should not only preach, but actually practice. (Now, ain't _THAT_ a revolutionary idea?!? ;-)) (Besides, as we all know, even if you are paranoid, they could still be after you ... ;-) Back to the questions:
Would the tripwire package detect an attempt to alter some linux executable?
As I understand it, tripwire is an "after-the-fact" detector. In other words, tripwire can be used to check whether an executable file has been changed, but it will not catch an alteration as it happens. For that to be possible, would, among other things, require that tripwire was constantly operating in the system, possibly as a daemon, and also it would need access to all attempts to open files or accessing filesystems. It would probably be too much of a system hog, even if one could get it to operate correctly. Besides, how would it distinguish an illegal binary edit from an "official" one ? Another question asked:
Is it possible to inadvertently install a trojan, by installing an RPM as root ?
Yes. So one should be careful about such things, and not do more than is absolutely necessary when logged in as root. (And, of course, one should make sure that the only programs/scripts allowed to run as su programs, are those that actually _need_ to be su programs.) (For the record: When i wrote the above, I had _not_ read the web page referred to, and my answers are those of a learning Linux user/admin: I am not (yet...) a guru!) -akr - To get out of this list, please send email to majordomo@suse.com with this text in its body: unsubscribe suse-linux-e
Arne Knut Roev wrote:
Someone asked a question here, as follows:
Am I paranoid, or should we start worrying about this?
Yes, and yes.
Thats rite apparently there is already a Unix version see <A HREF="http://www.cultdeadcow.com/tools/"><A HREF="http://www.cultdeadcow.com/tools/</A">http://www.cultdeadcow.com/tools/</A</A>> apparently this is for the *controller* to use unix rather than be on another windows machine Ive wonderd this myself and Id venture for starters is to use common sense and dl from only trusted sites as removal of questionable/offensive programs could be difficult to the average user. Neverthe less their site is loaded with info... good info.Fortunatly these guys seem to be on *our* side :-) for the more adventerous/experienced user the thing must be pretty cool.Id love to have the time to experiment in an *enclosed envioriment ieLAN* but Ive got enough problems rite now thank you very much. I was wondering about this topic and ventured an uneducated guess that the linux community may be similar to the Mac community whereas the trojans or viruses for macs are virtually nonexistent because the communnity is so tightly knit.Ive heard they chase / find the perputraters untill caught and quelled my 2cts rob Bookmarks <A HREF="http://www.connix.com/~dizzy73/LBM.htm"><A HREF="http://www.connix.com/~dizzy73/LBM.htm</A">http://www.connix.com/~dizzy73/LBM.htm</A</A>> "The ability of the OSS process to collect and harness the collective IQ of thousands of individuals across the Internet is simply amazing. More importantly, OSS evangelization scales with the size of the Internet much faster than our own evangelization efforts appear to scale." Vinod Valloppillil Aug 11, 1998 -- v1.00 Microsoft Confidential Halloween I -- 1.9 <A HREF="http://www.opensource.org/halloween1.html"><A HREF="http://www.opensource.org/halloween1.html</A">http://www.opensource.org/halloween1.html</A</A>> - To get out of this list, please send email to majordomo@suse.com with this text in its body: unsubscribe suse-linux-e
dizzy wrote:
Thats rite apparently there is already a Unix version see <A HREF="http://www.cultdeadcow.com/tools/"><A HREF="http://www.cultdeadcow.com/tools/</A">http://www.cultdeadcow.com/tools/</A</A>> apparently this is for the *controller* to use unix rather than be on another windows machine <snip> for the more adventerous/experienced user the thing must be pretty cool.Id love to have the time to experiment in an *enclosed envioriment ieLAN*
Yes, this tool (I use it as such) is great. On our network we have a cheesey windows app that everyone uses. This app is a sort of database client that locks the database while being used. The problem is that the database must be updated each night, and if someone goes home having left their database client open it can't be updated. The cure is back-orifice running on the Linux Samba server. A cron job script can poll each windoze box (after hours) to see if someone left their database client running...and kill it if they did. Then the database can be updated without problems. Everyone in my office uses windoze, but Linux rules my network. :) -- Ben Messinger Linux user #79,342 (Better late than never!) - To get out of this list, please send email to majordomo@suse.com with this text in its body: unsubscribe suse-linux-e
Hi all, Well, after reading a mail on this mail-list, I figured that I needed to change my X-Server from S3V to SVGA, at least for the installation of StarOffice (SVGA is a TOO SLOW server). After the installation is completed, I changed it back to my S3V X-Server, but...the machine still freezes. So...I'll have to keep working with this LAME SVGA server...that have refreshes that really sucks...:( Meanwhile...have seen no solution from Star Division to this S3V X-Server problem! Everyone that have an S3V chip, will have to use the SVGA server, or will there be a solution to this problem? Anyone knows something about it? Regards, Lubelio Fernandes - To get out of this list, please send email to majordomo@suse.com with this text in its body: unsubscribe suse-linux-e
Lubelio Fernandes <lfernandes@ip.pt> writes:
Hi all,
Well, after reading a mail on this mail-list, I figured that I needed to change my X-Server from S3V to SVGA, at least for the installation
[...]
Meanwhile...have seen no solution from Star Division to this S3V X-Server problem! Everyone that have an S3V chip, will have to use the SVGA server, or will there be a solution to this problem? Anyone knows something about it?
There is a patch that supposedly fixes the S3V freeze problem. I got it from <A HREF="http://www.stardivision.com/download/support/"><A HREF="http://www.stardivision.com/download/support/</A">http://www.stardivision.com/download/support/</A</A>>, but haven't installed it yet. HTH -- Bud Rogers <budr@sirinet.net> <A HREF="http://www.sirinet.net/~budr/zamm.html"><A HREF="http://www.sirinet.net/~budr/zamm.html</A">http://www.sirinet.net/~budr/zamm.html</A</A>> - To get out of this list, please send email to majordomo@suse.com with this text in its body: unsubscribe suse-linux-e
Arne Knut Roev wrote:
Someone asked a question here, as follows:
Am I paranoid, or should we start worrying about this?
Yes, and yes.
;-))
(Besides, as we all know, even if you are paranoid, they could still be after you ... ;-)
I think they got to me last night. I forgot to deadbolt the door, and I woke up groggy. My mind's a blank, and I don't know what you are talking about. ;-) - To get out of this list, please send email to majordomo@suse.com with this text in its body: unsubscribe suse-linux-e
zentara wrote:
Hi,
Check out the following link regarding Back Orifice.
<A HREF="http://www.wired.com/news/news/technology/story/16310.html"><A HREF="http://www.wired.com/news/news/technology/story/16310.html</A">http://www.wired.com/news/news/technology/story/16310.html</A</A>>
It talks about the complete lack of security in the windows operating system.
Hi, I didn't post this question a second time. Why is it being sent out again? Is there a bug in the mailing list majordomo? - To get out of this list, please send email to majordomo@suse.com with this text in its body: unsubscribe suse-linux-e
participants (7)
-
akroev＠online.no -
bmessin＠3-cities.com -
budr＠sirinet.net -
chrillee＠hem2.passagen.se -
dizzy73＠connix.com -
lfernandes＠ip.pt -
zentara＠mindspring.com