Hello Bryan,

Thursday, August 28, 2003, 3:46:20 PM, you wrote:

BP> Requires some hardware but this is doable.  Simply run a proxy
BP> server on a dedicated machine, in the router or ipchains using
BP> netfilter, allow only that  machine's IP to initiate http traffic
BP> on port 80 and then all the local  machines have to be configured
BP> to use the proxy server.  Now, local machines  can't surf at will,
BP> they must go through the proxy server and you can make  the port
BP> of that whatever you want.

If I understand you, each local machine would have to use a non-80
port to surf, with the translation done by the proxy. I'm then
assuming, say, Mozilla would have to be set up to use a non-80 port to
get to the proxy. Otherwise any app on the machine could use port 80.
You are, in effect, blocking port 80 from any local machine. Is this
correct?

Interesting idea - I'd like to make sure I understand it.

BP> Personally, I think that this level of security appears to be wildly 
BP> overrated.  It appears, to me, that someone is trying to solve a Windows 
BP> problem in Linux.

Windows users are giving us a glimpse of the future, should linux be
used by the masses. I'm just trying to get ready. :-))) Also, much of
the functionality is for privacy, not just security.

BP> First, if you are installing applications that you are unsure of,
BP> you have far  greater security issues than simply whether some
BP> malware is phoning home.

In general, agreed.

BP> Open Source apps make it very difficult to create little one off
BP> scumware applications, trojans too.

As linux gets more popular, some deviant will take an app, add some
malware, and create easy-to-get-and-use or otherwise attractive lures
to get people to load it. Apparently this has already been done for
some 'reputable' distribution apps in linux. Some folks are inherently
evil.

BP> Second, a lot of this debate is modified by the "kind" of threat
BP> that we want  to guard against.  The SoBig.F and other types of
BP> worms do not use port 80 to  communicate, in most cases they have
BP> built in smtp or IRC servers that can  broadcast.  You need some
BP> mechanism that can initiate its own connection and  traffic, not
BP> something that would be fighting with the browser to send
BP> packets.  In short, they run their own services so that they do
BP> not have to  depend on the user to initiate communication.

Agreed. Recent malware is increasingly using this technique -
unfortunately too easy to do in M$ virusware.

BP> Creating a new service, in the Linux environment,

BP> And, there are still many ways to guard against that

Agreed - it is comfortingly harder.

BP> If the application is a scumware (advertisement sort), it would inevitably be 
BP> installed as part of the browser, so a plugin for Mozilla, Netscape, etc.

That's why i don't like the idea of plugins - a foot in the door for
the let-anything-do-anything approach that causes so many problems
with M$. But it is not inevitable...

BP> It  won't be a standalone application because it needs to monitor
BP> http traffic so  that it can track usage for delivering ads.  That
BP> is its sole value.

Not necessarily. There is money to be made in selling information
about people. Even if logged on as just a user, I'd guess all your
personal is there - email, contact lists, on-line banking info,
history files of where you surfed, tax info, calendars, cookie files,
perhaps even some info about account names and passwords. Snoopware
might like to collect this and send it 'back home'. There's more than
just ads. Just putting a name and address onto an extensive cookie
history is worth a lot.

These are more like privacy issues rather than 'security'.  If you
want to address both, you should use different tools and techniques.
It is a different problem.

BP> If it is installed as a plugin, like most scumware in IE, then the
BP> app-aware firewall is useless because it would  already have
BP> permission to phone home as part of Mozilla or whatever browser
BP> it is part of.

True. Good ol Javascript is ready to snoop on you.

BP> So, if I were going to create something of this nature, I can't do it open 
BP> source because someone would rat me out almost immediately, provided I could 
BP> even get someone to install it, for even good applications it takes time to 
BP> build recognition in the Linux community.

Perhaps the scenario is to take the open source code and add some more
open source code for snooping, etc, and distribute the package. And,
no, the author of this malware is not likely to publish the code, open
source or not.

BP> with all of the different flavors of Linux and the fact that we
BP> still don't even have a  common installation package mechanism, I
BP> don't think it is very likely.

One of the most attractive ways to distribute malware is to package
supposedly known code for all these versions. "See how much trouble
I've saved you - it's ready to go in YOUR rpm." Looks attractive to
many, and they'll get it.

BP> If this type of thing was really easy, don't you think that some
BP> MS supporter  types would have done it ages ago?

Easy or not, I'll bet they have tried. Probably successful too, but
linux does not have critical mass to make these things wildly
successful.

>> Being a paranoid type, :-) I'm trying to understand why it is better.

<snip a VERY nice summary of linux advantages>

BP> with users that are guaranteed to be heads and  shoulders above
BP> the average Windows users and I think you have quite a challenge.

I'm imagining that linux is successful and that the competence of
these users is similar to the masses using M$ - low. This is a good
part of the problem. Smart Win users have very few problems, too. To
accurately compare the two, you should assume similar conditions.

BP> App-awareness probably needs to be much better under Windows

Perhaps, but I suspect it is also because it is easy to do in an
anything-can-do-anything environment.

BP> because they are trying to protect stupid users  against their own
BP> stupidity

Agreed - this is a good part of the problem, but very necessary if
the masses use your software. Perhaps the secret is to give a short
exam in order to log on. :-))) Oops - then relatively few would use
Win. Good security idea, bad marketing idea.

BP> under a wide open architecture, with closed  source applications,
BP> lots of bad guys, no internal security controls in place, and no
BP> interlocking lines of defense.  That is a fairly sizable task  and
BP> requires a lot of effort.

Agreed.

BP> Sorry for the long message, I get carried away sometimes.  ;-}

Hey - this is one of the best noes I have seen in a long time. Please
get carried away more often. :-))

-- 
Thank you,
 rikona                            mailto:[EMAIL PROTECTED]


Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com

Reply via email to