Security Stuffz...

[Booty]

This thread title really needs to be changed... I almost went right past this thread, assuming it would be another "why should I try linux?" post. Glad I read it... lots of good information.

This is all stuff that I really want to get into... thanks to n0cmonkey, drag, bbwf, and all the other gurus for sharing their expertise and insight.

 

[Bloodstein]

Sorry guyz, my bad....I meant to add stuff to the topic before posting....but forgot 'bout it .

 

[drag]

Just another thing to remember about windows worms.

If your server got nailed with a worm, then think about how easy it would of been for a cracker. A worm attacking security vunerabilities is just like a brain dead script kiddie running the same attack on windows machine over and over again.

A worm just replicates the steps that a cracker would use to gain control over a computer. Instead of doing it manually they took a generic attack and stuck it in a program and used that instead.

And don't forget that there are several versions of worms out their. Most of them can just as easily carry a trojan to install a backdoor, and then delete themselves. Unless your virus program knows about these threats before hand then it can't protect you, a one-off worm is more then likely immune to most scanners.

Plus for windows machines they have become sophisticated enough that they are beginning to be vunerable to sophisticated cracker attacks like root kits, which was pointless for older win9x and NT stuff. Unfortunately most windows admins lack the tools built into the OS to detect these sort of things.

here is a article about root kits for windows and how much fun they can be.

Now things like Mydoom and such turn your servers into spam relays and bases for DOS attacks, but they could just as easily of installed anything on your computer.

 

[pitupepito2000]

nice linkies all of you. This is quite a fun thread. Just a question for the gurus such as n0ckmoney, drag, BBWF, and others, how do you train yourself and how do you do it to learn all what you already know about linux and unix? What would you recommend me a student in university. How did you guys get started?

Thanks,
pitupepito

 

[Barnaby W. Füi]

Just use it full time, sit on the computer a lot, and mess with things a lot. I remember it took probably almost a year before I truely felt confident with debian. Now the only thing that really scares me is hardware problems.

 

[n0cmonkey]

Originally posted by: pitupepito2000
nice linkies all of you. This is quite a fun thread. Just a question for the gurus such as n0ckmoney, drag, BBWF, and others, how do you train yourself and how do you do it to learn all what you already know about linux and unix? What would you recommend me a student in university. How did you guys get started?

Thanks,
pitupepito

:beer:, lots of :beer:.

And what BBWF said. Make it fun. I use some of this stuff at work, and that helps. But mostly, I find this stuff interesting. So instead of going out and interacting with other people, I'll sit at home and do this. Or go out, get thoroughly pissed, and mess with it when I get home (and fix it when I wake up).

 

[drag]

Originally posted by: BingBongWongFooey
Just use it full time, sit on the computer a lot, and mess with things a lot. I remember it took probably almost a year before I truely felt confident with debian. Now the only thing that really scares me is hardware problems.

Ditto for me (although I am definately not in guru status. Give me 3-5 more years and then I may qualify, but I am not anywere near it yet)


I like to learn how things work and I used to be a big gamer. I've taken apart cars, (and actually got them back together and working on occasion), made artwork, learned some rudementary enginneering etc etc.

I've taken a lot of networking computer classes. Windows did not provide me with the capabilities that I wanted and I don't have the ability or desire to spend 1000's of dollars on software to get them. Linux has networkability in abundance, it coincides with my own personal concepts and desires on freedom, and is cheap. So I started learning Linux.

Now it's like a game for me. A sort of role playing game, but in real life. My experiance points are the personal knowledge (not just about linux either. Learning linux has taught me more about windows then years of using it as a desktop). This knowledge equals power and thus I increase "levels". The rewards are actual US currency and the goal is personal satisfaction and a comfortable lifestyle as a fringe benefit. (you have to work for a living, don't you? It's either computers/starving artist or seven-eleven/starving artist for me. I have no desire to be a corporate drone.)

I figure that beats becomming leathermaker 7+ in some horrific online game anyday.

 

[n0cmonkey]

Originally posted by: drag

Originally posted by: BingBongWongFooey
Just use it full time, sit on the computer a lot, and mess with things a lot. I remember it took probably almost a year before I truely felt confident with debian. Now the only thing that really scares me is hardware problems.

Ditto for me (although I am definately not in guru status. Give me 3-5 more years and then I may qualify, but I am not anywere near it yet)

I'm not either, but don't show humility around the newbies.

Now it's like a game for me. A sort of role playing game, but in real life. My experiance points are the personal knowledge (not just about linux either. Learning linux has taught me more about windows then years of using it as a desktop). This knowledge equals power and thus I increase "levels". The rewards are actual US currency and the goal is personal satisfaction and a comfortable lifestyle as a fringe benefit. (you have to work for a living, don't you? It's either computers/starving artist or seven-eleven/starving artist for me. I have no desire to be a corporate drone.)

I figure that beats becomming leathermaker 7+ in some horrific online game anyday.

Ok, you just took geek to a whole new level...

 

[drag]

Ok, you just took geek to a whole new level...

Probably, but it makes work a hell of a lot funner then it would be otherwise.

 

[drag]

duplicate

 

[n0cmonkey]

Originally posted by: drag

Ok, you just took geek to a whole new level...

Probably, but it makes work a hell of a lot funner then it would be otherwise.

Nothing wrong with that. :clock:

I've never seen someone use the :clock: before, that's all

 

[Sunner]

Originally posted by: n0cmonkey

Originally posted by: drag

Originally posted by: BingBongWongFooey
Just use it full time, sit on the computer a lot, and mess with things a lot. I remember it took probably almost a year before I truely felt confident with debian. Now the only thing that really scares me is hardware problems.

Ditto for me (although I am definately not in guru status. Give me 3-5 more years and then I may qualify, but I am not anywere near it yet)

I'm not either, but don't show humility around the newbies.

Now it's like a game for me. A sort of role playing game, but in real life. My experiance points are the personal knowledge (not just about linux either. Learning linux has taught me more about windows then years of using it as a desktop). This knowledge equals power and thus I increase "levels". The rewards are actual US currency and the goal is personal satisfaction and a comfortable lifestyle as a fringe benefit. (you have to work for a living, don't you? It's either computers/starving artist or seven-eleven/starving artist for me. I have no desire to be a corporate drone.)

I figure that beats becomming leathermaker 7+ in some horrific online game anyday.

Ok, you just took geek to a whole new level...

Damn, indeed.

 

[Farfrael]

Originally posted by: drag I figure that beats becomming leathermaker 7+ in some horrific online game anyday.

Good one Ever tried geek code ?
Stopped playing D2 for the same reason : why waste hundreds of hours on something totally virtual with no "real world" benefits ?

 

[chsh1ca]

Originally posted by: n0cmonkey
I think this is becoming less and less true all of the time. Plenty of morons decide to install Linux for one reason or another. And plenty of technically savvy people (me , Bill Joy, etc) are picking up Macs.

Plenty of technically savvy people get lobotomies too, does that make it a good thing?
Kidding aside, while it's all well and good that more people are buying macs, are said "technically savvy" people buying Macs JUST to run OSX, and as their only computer? Gotta remember, even the "morons who decide to install Linux" generally have access to one or two computers, not seven or eight.
At any rate, my point was that you can't go by a technical forum's listing for the number of machines that are Macs. It would be like going to a graphics design forum and doing a survey of who uses Linux. The numbers would probably be pretty well the same in the reverse proportions -- with Macs coming out ahead of PCs running Windows, with PCs running Linux dead last with maybe 1% of the entire amount.

As a broad generalization your statement is true, I guess, but I try not to deal in generalizations and stereotypes

Trouble with that idea is that to a certain extent generalizations and stereotypes apply. Not in every case, certainly, perhaps not even in the majority of cases, but it does apply just enough to keep the stereotypes alive.

 

[drag]

Trouble with that idea is that to a certain extent generalizations and stereotypes apply. Not in every case, certainly, perhaps not even in the majority of cases, but it does apply just enough to keep the stereotypes alive.

Yep. I look at people's behavior a lot like a drop of water running down a window. Each individual is like a molecule, it's completely impossible to determine that individual's path. It acts according to the rules of brownian motion. It could evaperate, zoom around, sit their, soak into the glass, whatever.

But when you get a few hundred million or so molecules in a single mass, say in a single drop of rain, then you can predict their movement pretty accurately.

Security will be a issue for linux users. To a certian extent it already is, older Redhat distros did the same mistakes that MS did with w2k., which is make it default to install everything under the sun. You had ftp servers, telnet, http servers etc etc etc. So anybody tooling around with those distros that haven't bother to upgrade are practicly script kiddie playgrounds. In windows you have to be carefull, because as a cracker you don't have a clue how the system will react. Windows has a lot of black magic mojo (from the perspective of a attacker) going on so it's easy as your doing your cracking to crash and generally screw up a windows install. But in Redhat 7.2 it's easy to understand what is going on and know what not to do to attract attention.

That's why good package managers are critical. Continously upgrading is something that people realy need to do, and sticking the update in a cron job will be easy to set up for even my Mom.

Moving away from numbered releases and big sweeping upgrade cycles imbetween long periods of stagnetation is not cool. The Debian model of "stable", "testing" and "unstable" is realy cool and plays off of the strengths of linux in a major way.

 

[n0cmonkey]

There is an article or something linked on deadly.org about how Microsoft is going with a "secure by default" theme for their next release

 

[drag]

Originally posted by: n0cmonkey
There is an article or something linked on deadly.org about how Microsoft is going with a "secure by default" theme for their next release

I read it. Gave me a headache, a lot of saying-alot-without-realy-saying-anything. As if the length of the reply = the amount of effort MS realy is putting into securing their software.

Then you have some interesting Bill-ism quotes, like:

The unfortunate fact is that as there is that dialogue, as that gets public, people who have malicious intent take the information. It's very rare that the malicious person actually comes up with the exploit. But they take that information and use it, particularly in an environment where we haven't been able to keep the systems up to date in a very broad scale way. I'll talk about that, because making progress on that is one of the key elements to bringing these threats down.

"It's very rare that the malicious person actually comes up with the exploit.".

Right....

<sarcasm>
Because we all know that ALL crackers are stupid stereotypical 13 year old loners with no life and little real technical skills. I mean that black hat crackers have no ability to figure out computers or software at all. If it wasn't for all these people trying to outdo each other by finding exploits and publishing them in a vain attempt at getting their 15 minutes of fame we would never have anything like Mydoom or Sobig.
</sarcasm>

Well hopefully MS realy is working on improving security. Being the company with the OS that has the worst track record in history is something that I find amusing, but it realy makes life hard for everybody in the industry.

I'd rather have life much harder for script kiddies.