--
--
Avi Greenbury
http://aviswebsite.co.uk
http://aviswebsite.co.uk/asking-questions
--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
02-16-2009, 03:41 PM
Ron Johnson
security (malware) issues in Linux bases OSes
On 02/15/2009 11:39 PM, T o n g wrote:
On Sun, 15 Feb 2009 15:48:37 -0600, Ron Johnson wrote:
Anyway, twice in the past few years, Debian servers have been
compromised. One time it was thru a weak DD user password,
You implication seems to be "Debian is not secure enough",
"Debian" can be made just as insecure as Windows. Anyway...
No, you are wrong. I was replying to your inference that package
signing makes everything ok.
but my conclusion
from above incident is quite the opposite from yours -- Debian is *amazingly*
secure.
If a Windoze PC is taken over by someone or some new malware that no
existing anti-virus software can detect, how soon can a normal Windows user
notice it? how soon can a experienced Windows admin, who is not working on
the box notice it? Make a rough guess and read the aforementioned intrusion
incident in Debian again. I don't know about you, but I was totally amazed
that two Debian admins in two different corners of the world noticed the
sign of intrusion at the first moment!
Sure, admins watching an important server. But how many of us run
IDS on our home boxes? Certainly not I...
--
Ron Johnson, Jr.
Jefferson LA USA
Supporting World Peace Through Nuclear Pacification
--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
02-16-2009, 03:42 PM
Dave Ewart
security (malware) issues in Linux bases OSes
On Monday, 16.02.2009 at 16:37 +0000, Avi Greenbury wrote:
> Ron Johnson wrote:
>>
>> I don't believe it. Show us!
>>
>
> In the interests of satisfying my curiosity:
>
> vm-linux2:/# rm -rf /
> rm: cannot remove root directory `/'
> vm-linux2:/#
That's rather annoying. If I want to shoot myself in the foot, it
should let me. It's a bug that it doesn't :-)
Dave.
--
Dave Ewart
davee@ceu.ox.ac.uk
Computing Manager, Cancer Epidemiology Unit
University of Oxford / Cancer Research UK
PGP: CC70 1883 BD92 E665 B840 118B 6E94 2CFD 694D E370
Get key from http://www.ceu.ox.ac.uk/~davee/davee-ceu-ox-ac-uk.asc
N 51.7516, W 1.2152
02-16-2009, 05:30 PM
David Jardine
security (malware) issues in Linux bases OSes
On Mon, Feb 16, 2009 at 04:42:18PM +0000, Dave Ewart wrote:
> On Monday, 16.02.2009 at 16:37 +0000, Avi Greenbury wrote:
>
> > In the interests of satisfying my curiosity:
> >
> > vm-linux2:/# rm -rf /
> > rm: cannot remove root directory `/'
> > vm-linux2:/#
>
> That's rather annoying. If I want to shoot myself in the foot, it
> should let me. It's a bug that it doesn't :-)
Perhaps rm -rf /* would do more or less what you want
--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
02-16-2009, 05:40 PM
"H.S."
security (malware) issues in Linux bases OSes
Ron Johnson wrote:
> On 02/16/2009 04:30 AM, Dave Sherohman wrote:
>> On Sun, Feb 15, 2009 at 04:22:37PM -0300, Eduardo M KALINOWSKI wrote:
>>> But neither of these help in case a stupid user receives an e-mail
>>> saying:
>>>
>>> Run 'sudo dpkg -i FreePornPics.deb to see <insert celebrity name here>'s
>>> secret sex tape'.
>>
>> No, but it still wouldn't get far because, unlike all the major Windows
>> malware threats, this requires the user to do actual *typing* (eww!
>> yuck!) instead of just going clicky-clicky or auto-running as soon as
>> the message is previewed.
>>
>
> You have a point. However...
>
> Hooking file-roller into gksu and dpkg wouldn't be that hard.
>
> In fact, I wouldn't be surprised if that weren't already the case.
>
I think Ubuntu does it. You download a deb to your desktop, double click
on it and the GUI leads you through the installation after asking for
the sudo password. So, yes, you need to be an admin for this.
What I haven't seen yet is a deb which does not need even sudo
privileges so that the package is installed in the user's own home
directory. If this were practical, wouldn't be hard to envision a key
logger being installed to record the user's login names and passwords.
Is this something that is feasible?
--
Please reply to this list only. I read this list on its corresponding
newsgroup on gmane.org. Replies sent to my email address are just
filtered to a folder in my mailbox and get periodically deleted without
ever having been read.
--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
02-16-2009, 07:02 PM
Dotan Cohen
security (malware) issues in Linux bases OSes
> In the interests of satisfying my curiosity:
>
> vm-linux2:/# rm -rf /
On Sun, Feb 15, 2009 at 04:22:37PM -0300, Eduardo M KALINOWSKI wrote:
But neither of these help in case a stupid user receives an e-mail
saying:
Run 'sudo dpkg -i FreePornPics.deb to see <insert celebrity name here>'s
secret sex tape'.
No, but it still wouldn't get far because, unlike all the major Windows
malware threats, this requires the user to do actual *typing* (eww!
yuck!) instead of just going clicky-clicky or auto-running as soon as
the message is previewed.
You have a point. However...
Hooking file-roller into gksu and dpkg wouldn't be that hard.
In fact, I wouldn't be surprised if that weren't already the case.
I think Ubuntu does it.
Why am I *not* surprised?
You download a deb to your desktop, double click
on it and the GUI leads you through the installation after asking for
the sudo password. So, yes, you need to be an admin for this.
>
What I haven't seen yet is a deb which does not need even sudo
privileges so that the package is installed in the user's own home
directory. If this were practical, wouldn't be hard to envision a key
logger being installed to record the user's login names and passwords.
Is this something that is feasible?
Sure. The keylogger would have to add itself to the "autostart
folder", but that's no mean feat.
--
Ron Johnson, Jr.
Jefferson LA USA
Supporting World Peace Through Nuclear Pacification
--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
02-16-2009, 08:55 PM
"H.S."
security (malware) issues in Linux bases OSes
Ron Johnson wrote:
>
> Sure. The keylogger would have to add itself to the "autostart folder",
> but that's no mean feat.
>
I am sorry, what is an auto start folder in relation to Debian or Ubuntu?
I would expect it to put a line in .bashrc to start automatically when
user logs in or perhaps put in a crobtab entry for the user.
--
Please reply to this list only. I read this list on its corresponding
newsgroup on gmane.org. Replies sent to my email address are just
filtered to a folder in my mailbox and get periodically deleted without
ever having been read.
--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
02-16-2009, 09:05 PM
Ron Johnson
security (malware) issues in Linux bases OSes
On 02/16/2009 03:55 PM, H.S. wrote:
Ron Johnson wrote:
Sure. The keylogger would have to add itself to the "autostart folder",
but that's no mean feat.
I am sorry, what is an auto start folder in relation to Debian or Ubuntu?
The same people who would install NakedBrittany.deb are the same
ones who log in thru gdm, probably without even a password.
I would expect it to put a line in .bashrc to start automatically when
user logs in or perhaps put in a crobtab entry for the user.
Does .bashrc execute from within gdm, or only when you open a
terminal window?
--
Ron Johnson, Jr.
Jefferson LA USA
Supporting World Peace Through Nuclear Pacification
--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
security (malware) issues in Linux bases OSes
