Hi David, Am Fre, den 16.01.2004 schrieb David F. Skoll um 19:58: ... > There are no self-propagating Linux e-mail viruses. The only Linux > e-mail viruses are proof-of-concept programs that have never actually > infected machines other than lab machines designed to test the > proof-of-concept.
Sorry, David. But Ramen did score quite well when it was active and there were many infected Unix/Linux machines with Ramen. Though I have to agree with you that there probably aren't any viruses in the wild at the moment that could infect and compromise a patched Linux system if it's properly setup. It's different with Linux machines running lousy software such as PHPNuke or PostNuke or something like that, which frequently is subject to PHP/SQL injection exploits. When the system features an unpatched or even uncharted local exploit such as the do_brk() bug which has been in the kernel since the 2.2 series(!!!!! That's a damn long time !!!!!!) in addition to such lousy software then the first system compromise with some rootkit is unavoidable. But of course I am comparing squares to circles here since no sane MS Windows end user would run a webserver on his home machine. When running Linux you seriously should consider to run chkrootkir from a safe location (like a CD) and use file integrity checking of some sort. Anything else is just asking for trouble the hard way. I only have to remind you of the Debian hack. Hadn't Debian used AIDE to detect the modifications in their systems, we'd never had known about that do_brk() vulnerability until major damage occurred. kind regards, Tobias W. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
