Hello Bryan, Thursday, August 28, 2003, 3:46:20 PM, you wrote:
BP> Requires some hardware but this is doable. Simply run a proxy BP> server on a dedicated machine, in the router or ipchains using BP> netfilter, allow only that machine's IP to initiate http traffic BP> on port 80 and then all the local machines have to be configured BP> to use the proxy server. Now, local machines can't surf at will, BP> they must go through the proxy server and you can make the port BP> of that whatever you want. If I understand you, each local machine would have to use a non-80 port to surf, with the translation done by the proxy. I'm then assuming, say, Mozilla would have to be set up to use a non-80 port to get to the proxy. Otherwise any app on the machine could use port 80. You are, in effect, blocking port 80 from any local machine. Is this correct? Interesting idea - I'd like to make sure I understand it. BP> Personally, I think that this level of security appears to be wildly BP> overrated. It appears, to me, that someone is trying to solve a Windows BP> problem in Linux. Windows users are giving us a glimpse of the future, should linux be used by the masses. I'm just trying to get ready. :-))) Also, much of the functionality is for privacy, not just security. BP> First, if you are installing applications that you are unsure of, BP> you have far greater security issues than simply whether some BP> malware is phoning home. In general, agreed. BP> Open Source apps make it very difficult to create little one off BP> scumware applications, trojans too. As linux gets more popular, some deviant will take an app, add some malware, and create easy-to-get-and-use or otherwise attractive lures to get people to load it. Apparently this has already been done for some 'reputable' distribution apps in linux. Some folks are inherently evil. BP> Second, a lot of this debate is modified by the "kind" of threat BP> that we want to guard against. The SoBig.F and other types of BP> worms do not use port 80 to communicate, in most cases they have BP> built in smtp or IRC servers that can broadcast. You need some BP> mechanism that can initiate its own connection and traffic, not BP> something that would be fighting with the browser to send BP> packets. In short, they run their own services so that they do BP> not have to depend on the user to initiate communication. Agreed. Recent malware is increasingly using this technique - unfortunately too easy to do in M$ virusware. BP> Creating a new service, in the Linux environment, BP> And, there are still many ways to guard against that Agreed - it is comfortingly harder. BP> If the application is a scumware (advertisement sort), it would inevitably be BP> installed as part of the browser, so a plugin for Mozilla, Netscape, etc. That's why i don't like the idea of plugins - a foot in the door for the let-anything-do-anything approach that causes so many problems with M$. But it is not inevitable... BP> It won't be a standalone application because it needs to monitor BP> http traffic so that it can track usage for delivering ads. That BP> is its sole value. Not necessarily. There is money to be made in selling information about people. Even if logged on as just a user, I'd guess all your personal is there - email, contact lists, on-line banking info, history files of where you surfed, tax info, calendars, cookie files, perhaps even some info about account names and passwords. Snoopware might like to collect this and send it 'back home'. There's more than just ads. Just putting a name and address onto an extensive cookie history is worth a lot. These are more like privacy issues rather than 'security'. If you want to address both, you should use different tools and techniques. It is a different problem. BP> If it is installed as a plugin, like most scumware in IE, then the BP> app-aware firewall is useless because it would already have BP> permission to phone home as part of Mozilla or whatever browser BP> it is part of. True. Good ol Javascript is ready to snoop on you. BP> So, if I were going to create something of this nature, I can't do it open BP> source because someone would rat me out almost immediately, provided I could BP> even get someone to install it, for even good applications it takes time to BP> build recognition in the Linux community. Perhaps the scenario is to take the open source code and add some more open source code for snooping, etc, and distribute the package. And, no, the author of this malware is not likely to publish the code, open source or not. BP> with all of the different flavors of Linux and the fact that we BP> still don't even have a common installation package mechanism, I BP> don't think it is very likely. One of the most attractive ways to distribute malware is to package supposedly known code for all these versions. "See how much trouble I've saved you - it's ready to go in YOUR rpm." Looks attractive to many, and they'll get it. BP> If this type of thing was really easy, don't you think that some BP> MS supporter types would have done it ages ago? Easy or not, I'll bet they have tried. Probably successful too, but linux does not have critical mass to make these things wildly successful. >> Being a paranoid type, :-) I'm trying to understand why it is better. <snip a VERY nice summary of linux advantages> BP> with users that are guaranteed to be heads and shoulders above BP> the average Windows users and I think you have quite a challenge. I'm imagining that linux is successful and that the competence of these users is similar to the masses using M$ - low. This is a good part of the problem. Smart Win users have very few problems, too. To accurately compare the two, you should assume similar conditions. BP> App-awareness probably needs to be much better under Windows Perhaps, but I suspect it is also because it is easy to do in an anything-can-do-anything environment. BP> because they are trying to protect stupid users against their own BP> stupidity Agreed - this is a good part of the problem, but very necessary if the masses use your software. Perhaps the secret is to give a short exam in order to log on. :-))) Oops - then relatively few would use Win. Good security idea, bad marketing idea. BP> under a wide open architecture, with closed source applications, BP> lots of bad guys, no internal security controls in place, and no BP> interlocking lines of defense. That is a fairly sizable task and BP> requires a lot of effort. Agreed. BP> Sorry for the long message, I get carried away sometimes. ;-} Hey - this is one of the best noes I have seen in a long time. Please get carried away more often. :-)) -- Thank you, rikona mailto:[EMAIL PROTECTED]
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
