On Sat, Dec 04, 2004 at 12:07:54AM +0100, Conrad Newton wrote: > While it is clear that it is *much easier* to write viruses for Windows, > it does not seem altogether *impossible* that it could be done for > Linux, too. Unfortunately, "much easier" is not easy to quantify, and > therefore open to dispute!
Yes, I've heard (roumors) about viruses that will attach Linux. But lets start the other way around. Lets start with personal experience: - The Spring of 2001 I inherited an RH installation that was installed by RH specialists (they even train people for certification on RH). Problem was that the customer did not want to pay to much, so they did not buy a Support/Maintnance Agreement for the firewall, but only for the main production server. Well, some bad choices were made and they, left a running bind-server on the firewall, open to the world. Then add 6-8 months, and suddenly the firewall starts sending a lots of packages. I've had 1 or 2 weeks, and wanting to upgrade some of the machines. well, there had been some strange behaviour from the firewall before that, and we never could get "ps" to work. strange. I was quick to reinstall that firewall, and to check the other servers. Guess what - a fix for the bind security hole had been around for about 5 or 4 months. :) - Then move ahead 2 years, to the spring of 2003. I was in the process of reinstalling several servers, some old installations of RH, and some newer with Slackware. I knew there hed come a new release of openssl, and that I should upgrade one of the slackware-boxes, but the box was about to be reinstalled with Debian anyway, but I needed a day with my family. That day the machine was comprimised, and when I checked in on it, I found that someone was in. The server was shut down for some hours, and then reinstalled with Debian later that day. Lesson learned: - Dont run services you dont need availible from the outside. - Security patch as soon as the patch is availible. Set your servers to check for patches at least once a day. Okay, what about if I dont have anything open to the outside - then I'm safe ? - Well, you have the users on the inside. They may comprimise your system, for not so long ago there was a bug that would cause the kernel to lock up 100% of the kernel. BTW I think debian-edu/Skoleinux was one of the first "distros" to patch this - The webbrowser could have a bug in the way it handle some pictures that could make it possible to execute an app and start a hole/backdoor Still here the cure is Update with the latest security patch as soon as it's availible. Okay, is this worse with Open Source Software than with Closed Source Software. Well, I dont trust black boxes. you never know what they are running. -- Finn-Arne Johansen [EMAIL PROTECTED] http://bzz.no/
