The worm that didn't turn up (Guardian)

Posted Aug 22, 2005 7:41 UTC (Mon) by janpla (guest, #11093) [Link]

Yes, you can see why there are some that really don't want everybody to switch to a sensible OS; they would suddenly be without a job.

Posted Aug 22, 2005 14:47 UTC (Mon) by AnswerGuy (guest, #1256) [Link]

Many worms work just fine through a NAT or proxy (as some of them can
exploit bugs in the clients behind the firewall).

A Linux box is not inherently any more secure behind a NAT (network address translation) router than it was on a publicly routable address if you simply limit the open (listening) ports and the range of source addresses which are allowed to access specific services.

Yes there are many people who have had their Linux box "rooted." Often they haven't detected the compromise for a long time. However, I can say from long experience, that Linux has made significant improvements over the last few years. After the days of Ramen, Adore and Lion we've found that Linux worms and remotely exploitable arbitrary code and root vulnerabilities are getting to be far less common and somewhat more difficult to exploit.

As the mainstream distributions integrate more kernel hardening features (like SELinux, much as I detest its complexity; and systrace, the grsecurity patches, etc) then things should continue to improve.

Convincing the major distributors to further encourage better security with better defaults, guided installation and configuration dialogs, and some additional packages should also help.

All major distributions should ship with chkrootkit and/or rkhunter and bastille. They should default to installing and configuring them (or at least recommending them and requiring a user/admin to specifically reject them)

ssh continues to be one of the scariest vectors for possible vulnerabilities. It's ubiquitous and privileged. It would be vastly better for ssh to be more locked down by distributors' in their default configurations. I routinely configure sshd to limit the allowed source addresses (both using its own TCP wrappers entries in /etc/hosts.allow and using appropriate iptables rules). I also require that all connections have pre-shared host keys and that all users have keys (no passwords allowed). I sometimes set up specific gateways systems where I loosen these restrictions a bit; but the tighter configuration is the default.

Recently I've been seriously considering using a port-knocking configuration on systems that need to have a more open ssh daemon. This would allow any authorized user, from anywhere, just using a password --- but only after they sent the right combination of blind connection requests.

The idea of all these measures is to limit the visibility to port scanning and brute force while still permitting remote administration.

JimD

Posted Aug 22, 2005 19:14 UTC (Mon) by job (guest, #670) [Link]

Most MS Windows worms are spread via Active X or executing code on the
client using holes in Outlook, Internet Explorer or the Office programs.
Using NAT doesn't help one bit against that. It is also a false sense of
security to use NAT or firewalls to protect a larger network, since the
first infected laptop to enter the network will infect everyone else.
This is often the case with big corporate networks that may be very
locked down at the gateway but wide open inside.

Posted Aug 23, 2005 0:05 UTC (Tue) by xoddam (subscriber, #2322) [Link]

> using Linux or other Free software is no silver bullet.

True, but the fact that the free software ecosystem is inhabited
largely by security-conscious administrators and more secure
default configurations means that the chance of being compromised
will remain much smaller if you're running such a system. I
reckon this will continue to be true even as free software becomes
a preferred choice; population is significant but perhaps not the
most important variable.

It's like immunisation. As long as a large proportion of the
population is immunised against the old plagues, the incidence
is minuscule; a minority of parents can choose not to inoculate
their children and get away with it. But as the proportion of
unprotected children in schools and kindergartens approaches a
critical mass, epidemics become increasingly likely to recur.

Posted Aug 26, 2005 16:31 UTC (Fri) by giraffedata (subscriber, #1954) [Link]

The advantage that Linux does have (don't know about MacOS) is that the underlying system architecture has been designed with security in mind,

I know it's an open question why worms are less of a problem for Linux, but I think I have to rule out security-conscious design. It can't be that because it doesn't matter how many security holes there are; one is enough. And Linux does occasionally have them. We read in LWN all the time about Linux bugs that allow someone to take over virtually everybody's Linux system, but it never happens.

Another theory of Linux's superiority is that Linux users are more likely than Windows users to apply the fixes before someone can exploit them. One fact in support of that is that, regardless of how many security flaws there are in Windows, nearly all Windows worm infections wouldn't happen if all the Windows systems were up to date (i.e. the fix was available before the infection). That makes it look like a problem of applying fixes, not of existence of bugs that need to be fixed.