• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Security Stuffz...

Bloodstein

Senior member
I'm just curious as to why there are far fewer linux viruses than windows ones. I'm sure linux is not very much more "less vulnerable" than windows....I'm thinking it might have something to do with the fact that most people use Windows, hence writing Windows viruses would affect far more computers than linux computers. Just like to hear what you guys have to say 'bout this.
 
Windows is far more common on desktops.
Windows users are usually less tech savvy.
Windows security model is rather weak by default.
 
There is always the argument that viruses will be most common on the most used operating system and there is definitely some truth to this. More people understand Windows, more people code for it as a job, and more people know how to exploit it.

That said, with Linux there are tons of security vulnerabilities for possible applications that a linux box may be running. Even though it is used on far fewer machines than all the Windows OSes, you see far fewer "major" viruses/worms out there on linux than Windows and I think it's due, at least in part, to the fact that it's harder on Linux for users to accidentally launch an executable file (or extract a file that then automagically executes itself). There was the SQL slammer worm and Blaster worm in recent memory that did not require user interaction for infection but many of the recent ones all come in to a computer in some way that requires that a user execute the file in order for infection to occur. Programs like tar, bzip, gzip, just aren't built to automatically execute their contens upon extraction. Windows loves to "help" users do things like that in many cases.

I feel that Windows is more common than any Linux distribution (or all of them combined). Windows boxes are more likely to be set up by clueless people than Linux boxes simply by the fact that to install Linux and get useful services up and turned on will usually require more configuration. Finally, up until recently, Microsoft has never shown any real interest in the security of their products. They've focused on features and ease of use at the expense of security...IE and Outlook are 2 major programs that almost every Windows based business or school will be using and especially Outlook is a major vector of virus distribution. But even with that, more and more businesses are using it because of its killer features <cough> and lack of interoperability with standard clients for calendaring/scheduling.

Now of course, oftentimes the user is the one that opens that attachment, or clicks yes to install that spyware so you can make the argument that Windows users, taken as a whole, are more likely to infect themselves over Linux users as a whole. Something like that is a big generalization and can't really be proven or disproven easily (though my support experience tells me another story 🙂).

Even with all that, it is possible to have a Windows based network where it is relatively uncommon to get major virus/worm outbreaks. With firewalls, centralized and desktop virus protection, NO administrative access for users of the Windows machines (minus IT), reasonable group policy security settings, and automatic patching for critical updates it is somewhat possible to run a smooth Windows network.

Gaidin
 
Originally posted by: BloodsteinI'm sure linux is not very much more "less vulnerable" than windows....

If you are so sure of it why bother asking ?
And thanks for the nice descriptive title you gave to that thread, it will really help when searching for something on the forum.

 
A better question would be:

Why is windows the only OS that gets continously inflicted by all these viruses and worms.

Rather then Windows vs Linux, it's Windows vs most every other operating system in existance.
 
It would make much more sense to write viruses/worms for windows. Windows is used the most commonly used OS in the world. Releasing a worm or virus would deal more damage because there are just so many windows users. Why try to infect Linux or Mac users? There aren't that many people that use Mac or Linux. For example, system rig statistics show over 17,000 people using windows, and just over 1000 using Linux, and a little over 100 using mac. Wouldn't infecting and damaging over 17,000 computers sound more appealing than damaging 1000 computers?
 
that's just for desktops. In realworld numbers they figure something like 6 percent of all desktops run linux or Mac (each hover around 3 percent of the desktops people use) vs the 93 percent or so that are Windows machines.

However 75% of internet servers are not Windows, so if you would want to create as much damage as possible you would aim for Linux or other Unix variants for targets for worms, but it's the windows servers that sustain the most damage from such attacks.

The security model for Windows and Linux is just different.

By it's nature Linux is resistant to massive automated attacks. The large number of variations helps a lot, plus infecting a user with a virus isn't going to infect the entire computer. Everything is much more isolated in Linux vs Windows. If I can't do something as a user, then none of the programs I use can either, including viruses.

It's not very hard to create a Linux virus. In fact right now I could build a program that would use up your resources and cause near-lockups pretty f-ing easy, which would require a reboot, but having it spread is a big issue.

The bad thing you have to watch out for while using linux is crackers.

Directed attacks by a individual. This is because as a hacker a Linux machine has much more capabilities then any Windows machine. (for example🙂 Developement tools and source code is commonly included with most computers, so if you can crack a machine you can use it as a base to build and compile more tools to attack other machines with much easier then you can with windows. Also linux, in general, has much more powerfull networking capabilities then your average windows install.

So the average linux install is a much jucier target, and with most hobbiests, people tend to install everything under the sun and run a ftp server or apache server for sh!ts and giggles and then forget about it.
 
Well, let me first put some definitions on the table:
Virsus A program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes. Viruses can also replicate themselves. All computer viruses are manmade. A simple virus that can make a copy of itself over and over again is relatively easy to produce. Even such a simple virus is dangerous because it will quickly use all available memory and bring the system to a halt. An even more dangerous type of virus is one capable of transmitting itself across networks and bypassing security systems.

Worm A program or algorithm that replicates itself over a computer network and usually performs malicious actions, such as using up the computer's resources and possibly shutting the system down.

syscalls The system call is the fundamental interface between an application and the Linux kernel. As of Linux 2.4.17, there are 1100 system calls listed in /usr/src/linux/include/asm-*/unistd.h.

Well now that we have the definitions let's go at it. Windows and Linux are two different operating system, with two different audiences for them. Windows is easier to install. It comes preloaded in many computers, that's how gradnma/pa where able to get email. They didn't have to learn how to install the operating system, they just got a something that worked out of the box. For jimmy the computer savvy of the house, that's only interested in computer games, he doesn't want to fiddle in learning the internals of the OS, so he is pretty happy with just having to put in the Windows CD and following the instructions on the screen. On the other hand, for most linux users, the OS didn't come preloaded in their computers, they were interested in learning something new including the internals of their OS. They have to do a lot of reading and figuring out on their own. Because of it and the nature of linux they are more involved in the decisions that the operating system makes for them during the install and after the install (of course it varies depending on the linux distribution).

Because of the difference in audience that windows and linux has, windows has made a lot of assumptions for the user, at the expense of security. Windows enables a lot of services by default, and has a not always very secure configuration. In linux, you may be able to easily able to install and set up a program, but often times depending on the application that you are setting up you have more involment and decision making to do.

The linux security approach is very strongly tied to the unix multiuser, multitasking nature. For example in earlier versions of Windows, multiusers were a joke, and anybody had rights to do anything within the different directories in the hard drive. In *NIX, you have this thing called multiusers, which forces you to create more than one account to make things more secure. In *NIX you have something called "root" user which is the superuser, and it is the only one allowed to run certain processes and programs, and has access to the whole partition. The regular Joe, has rights to very few directories, thus if Joe were to get a virus he could only spread it to himself and the things to which he has permissions. Actually there are websites to write your own linux viruses, which are harmless. In Windows it is completely different, it is so easy for Joe to click on an attachment and infect the whole hard drive.

Another way of a computer getting compromised are exploits, which are through system calls that directly interact with the kernel, and that is what the base of the big vulnerabilities in Linux such as the problem that they had in kernel.org with the sources of the kernel that had been modified a little in order to create a vulnerability in the kernel. Another way to compromised is through vulnerability in the different applications that you have installed. But at the same time you have thousands of programmers around the world working to make this applications better. Thus on a daily basis you get updates that closes different application vulnerabilities in linux, thus making it more robust.

In Windows, you don't have to get as fancy to crack the computer, it is more widely used, and it is easy to try to look at the different services that the computer is running (look into nmap). Windows machines are more easily cracked because of all the services that are not locked down which is running.

Linkies:
http://www.insecure.org/nmap/
http://www.snort.org/
http://www.lwfug.org/~abartoli/virus-writing-HOWTO/_html/
http://www.sfu.ca/~siegert/linux-security/msg00179.html
 
so drag what would you suggest to do to watch out and make a linux box more secure agains crackers. I personally like to use that word instead of hackers because hackers by definitions are people who are nerds interesting in learning and trying new things.

thanks,
pitupepito
 
Originally posted by: wizard5233
It would make much more sense to write viruses/worms for windows. Windows is used the most commonly used OS in the world. Releasing a worm or virus would deal more damage because there are just so many windows users. Why try to infect Linux or Mac users? There aren't that many people that use Mac or Linux. For example, system rig statistics show over 17,000 people using windows, and just over 1000 using Linux, and a little over 100 using mac. Wouldn't infecting and damaging over 17,000 computers sound more appealing than damaging 1000 computers?

The big fault with those numbers is that linux users are much more likely to be technically minded than Mac users.
 
Originally posted by: pitupepito2000
so drag what would you suggest to do to watch out and make a linux box more secure agains crackers. I personally like to use that word instead of hackers because hackers by definitions are people who are nerds interesting in learning and trying new things.

thanks,
pitupepito

How deep do you want to get? 😉

I'll try to go in an order of increasing complexity (although I may deviate a bit):

  • Use tougher passwords.
  • Turning off unnecessary services is a simple one.
  • Keep up to date on all security and reliability patches.
  • Use SSH instead of r*, ftp, and telnet
  • Don't use software that has a less than stellar security history (apache, sendmail, bind, wu-ftpd, etc).
  • Make sure you understand how to properly configure each and every piece of software on your machine, especially software that interacts with other machines.
  • Install a firewall and keep an eye on the logs.
  • Use an encrypted file system
  • Use technologies like tcpwrappers.
  • Use aide, tripwire, mtree, or something similar to make sure executables have not been modified.

From here it gets a lot tougher, IMO. A lot more knowledge is needed to use some of the following suggestions. I would bet that Nothinman, drag, BingBongWongFooey, and myself combined would have trouble understanding all of the components. These are also harder to categorize into what is tougher than the others, so the order is less important here than above. 😉

  • Use chroots or jails to create sandboxes.
  • Install an IDS and keep an eye on the logs.
  • Use tools like systrace to further lock down services and applications.
  • Use memory protection techniques to help protect against memory attacks (W^X, PaX, non-exec heap, non-exec stack, etc).
  • Use tools like LIDS (Linux), Cops (Linux), TPE (OpenBSD -Stephanie), or NetBSD's protected executables feature (can't remember what it is called, but it is pretty neat, requires a hash of each executable to make sure it has not been modified).
 
Originally posted by: pitupepito2000
thanks n0cmonkey for all those suggestions. I see my 1-week spring break possible projects building by themselves 😉

Some of those will take your more than a week. Some of them might not fit the usability to security ratio you are looking for. But it should be fun playing with them 😉

Some of those options (PaX and similar kernel patches) have more of a chance to screw up your system (ID10T, chair to keyboard inteface, and pebcak errors abound), but others have less of a chance of screwing everything up. Use at your own risk 😉

I forgot to mention SELinux. Gentoo's hardened system seems pretty neat, and when I get a chance, some motivation, and an extra machine I plan on playing with it quite a bit.
 
Originally posted by: chsh1ca
Originally posted by: wizard5233
It would make much more sense to write viruses/worms for windows. Windows is used the most commonly used OS in the world. Releasing a worm or virus would deal more damage because there are just so many windows users. Why try to infect Linux or Mac users? There aren't that many people that use Mac or Linux. For example, system rig statistics show over 17,000 people using windows, and just over 1000 using Linux, and a little over 100 using mac. Wouldn't infecting and damaging over 17,000 computers sound more appealing than damaging 1000 computers?

The big fault with those numbers is that linux users are much more likely to be technically minded than Mac users.

I think this is becoming less and less true all of the time. Plenty of morons decide to install Linux for one reason or another. And plenty of technically savvy people (me 😀, Bill Joy, etc) are picking up Macs. As a broad generalization your statement is true, I guess, but I try not to deal in generalizations and stereotypes 😉
 
I can see linux having huge security issues in the future. It's just the way things are going. It's easy to get complacent when your watching the windows world fall to peices thru spam/worms/and viruses, but Linux has had it's share of security issues in the past.

In order to keep everything secure in a normal linux distrubution you have to keep everything updated. It's critical, but distros are not pushing it enough.

A good package manager is very usefull for this. If people can be reminded to use a package manager and keep everything updated then you more then likely never have to worry about anything. It's easy, cheap, and then you get the newest versions of programs.

There are some distros specificly configured for security. Most distros don't go the extra mile when it comes to security, because 1. it makes everything a pain in the butt, 2. It's a proccess and your expected to take care of yourself to a certian extent.

There are several security concious linux distros out there you can check out:
here is owl which seems to follow the OpenBSD ideals of good programming and code review to protect yourself

Another approach is Immunix. This is interesting thing I found today, it uses patches and extensions to the gcc compiler to protect from buffer overflows attack. That it's "stackguard" feature, it has RaceGuard to prevent race conditions, it has SubDomain to set up seperate enviroments for risky services at the kernel level, and a bunch of other stuff.

here is a interesting website dedicated to Linux security

They have a bunch of other links to "hardened" linux distros and information there.

Then you have the ultimate in current linux security setups thru NSA's modification to the linux kernel, security-enhanced linux. Redhat and Gentoo are 2 places that are working on distros that use this.

From what I understand if you keep things up to date, run a seperate firewall/router, only run services that you need and understand your going to be immune to 95% of attackers. Unless you have something special to protect (like atm transactions or medical records) that should be enough.

Also #1 thing is passwords. No matter how wonderfull your setup the weak link will be humans.

If you are using "elvis" or "P@ssw0rd" or "1forg3t" for passwords your just asking for it. It's probably the most missunderstood part of good security.

You want at least 8 letters, probably more. You want numbers/capitolizations, and those extra characters.

Nothing based off of english words, no short passwords, no 1337 speak (dictionary = D1cT01na]ry)

I like to base them off of a phrase. Like "I am watching cartoon planet"

turns into:
1@N\'watc1nG"0np%1la3t^*

That way it's completely scrambled and something that's possible to remember. After using it for a while then it will be habit to type it out quickly. I write them down, then after practicing I put it somewhere secure or simply distroy it. Resetting a lost password is easier then uninstalling a kernel module-based trojan.
 
I've worked at a Data Center for awhile, working on both Linux/BSD and Windows servers on a daily basis. Here's what I've noticed...

Windows servers tend to get bombed with viruses/worms, but the damage they cause is usually pretty easy to repair. In the case of Linux, however... we may only have 1 Linux server crash due to a virus during a shift, but that one issue will usually take a lot longer to repair than 20 Windows issues.

as far as desktop viruses go, I'd chalk it up to a) windows is far more popular than any other operating system, and b) because it's less popular, it has a significantly highly portion of users who are not tech savy.
 
Originally posted by: loki8481
I've worked at a Data Center for awhile, working on both Linux/BSD and Windows servers on a daily basis. Here's what I've noticed...

Windows servers tend to get bombed with viruses/worms, but the damage they cause is usually pretty easy to repair.

Having worked in small departments in large organizations, I can say that this is not always the case. Various worms have caused too much havoc on networks for me to consider it an easy cleanup. Of course, every organization is different 😉
 
Originally posted by: n0cmonkey
Originally posted by: loki8481
I've worked at a Data Center for awhile, working on both Linux/BSD and Windows servers on a daily basis. Here's what I've noticed...

Windows servers tend to get bombed with viruses/worms, but the damage they cause is usually pretty easy to repair.

Having worked in small departments in large organizations, I can say that this is not always the case. Various worms have caused too much havoc on networks for me to consider it an easy cleanup. Of course, every organization is different 😉

I'll agree with worm clean-up being a pain in the arse, but I'd rather clean out a mail server than repair a unix server where someone cracked the root account and deleted the boot directory. heh.
 
Originally posted by: loki8481
Originally posted by: n0cmonkey
Originally posted by: loki8481
I've worked at a Data Center for awhile, working on both Linux/BSD and Windows servers on a daily basis. Here's what I've noticed...

Windows servers tend to get bombed with viruses/worms, but the damage they cause is usually pretty easy to repair.

Having worked in small departments in large organizations, I can say that this is not always the case. Various worms have caused too much havoc on networks for me to consider it an easy cleanup. Of course, every organization is different 😉

I'll agree with worm clean-up being a pain in the arse, but I'd rather clean out a mail server than repair a unix server where someone cracked the root account and deleted the boot directory. heh.

Cleaning up Code Red, Blaster, and various other worms is just as bad. It's tough to tell sometimes if someone has been using your machine for bad things.
 
If a machine ever gets compromised, I try to avoid cleaning things up if at all possible.
A reinstall is the way to go for a tainted box IMO.
 
Originally posted by: Sunner
If a machine ever gets compromised, I try to avoid cleaning things up if at all possible.
A reinstall is the way to go for a tainted box IMO.

Technically that's the thing to do. Practically it isn't always possible.
 
Originally posted by: n0cmonkey
Originally posted by: Sunner
If a machine ever gets compromised, I try to avoid cleaning things up if at all possible.
A reinstall is the way to go for a tainted box IMO.

Technically that's the thing to do. Practically it isn't always possible.

I know, that's why I said "if at all possible" 😉
 
Originally posted by: Sunner
Originally posted by: n0cmonkey
Originally posted by: Sunner
If a machine ever gets compromised, I try to avoid cleaning things up if at all possible.
A reinstall is the way to go for a tainted box IMO.

Technically that's the thing to do. Practically it isn't always possible.

I know, that's why I said "if at all possible" 😉

stupid clients and their need to keep their data intact 😛
 
Originally posted by: loki8481
Originally posted by: Sunner
Originally posted by: n0cmonkey
Originally posted by: Sunner
If a machine ever gets compromised, I try to avoid cleaning things up if at all possible.
A reinstall is the way to go for a tainted box IMO.

Technically that's the thing to do. Practically it isn't always possible.

I know, that's why I said "if at all possible" 😉

stupid clients and their need to keep their data intact 😛

If they were serious about keeping data intact they would try harder not to get hacked. Also, backups rock.
 
Back
Top