Varying definition of virus, non-immunity.

Posted Aug 5, 2004 23:32 UTC (Thu) by rickmoen (subscriber, #6943) [Link]

Mantra "there are no Linux viruses in the wild" is thing of the past - drop it before it become just embarassment for yourself.

I'll be glad to amend that to "There are Linux viruses in the wild only for extremely contrived values of 'in the wild'." Your two examples of that genre (posted elsewhere in this thread) were enlightening, and so are useful in clearing up confusion on the subject. To review:

1. An ELF infector, plausibly claimable as existing "in the wild" solely because intruders who've rooted systems through other means entirely tend to set it loose (in conjunction with the Suckit rootkit) in order to maintain their backdoor access.

2. An automated worm attack against a particular configuration within Apache of a specific obsolete version of OpenSSL — that was fixed July 2, 2002, over two years ago and 2 1/2 months before the worm appeared.

So, lessons:

1. Keep your system up to date. That's what the updating tools are for. Among other things, that makes any malware you do stupidly execute less likely to be able to escalate privilege.

2. Don't run network daemons exposed to public networks, unless/until you're willing to be responsible for patching vulnerabilities as they are found, or shut them down instead.

3. If you've already suffered root compromise, after that has already happened, don't be surprised if there are ELF-infector viruses and much worse things. Read the friendly FAQ.

4. Take with a huge grain of salt people's claims about malware "in the wild", especially when the claimant cannot answer the obvious question, asked by 'utidjian' but never properly answered, about "how the virus gets on the system". (The reply to 'utidjian' by 'evgeny' was enlightening: "security holes". If you have unpatched, significant security holes, then you have much bigger problems than malware, don't you?)

5. Pay attention to your system's treatment of "active content" such as any form of document that has macro capability. Read your mailcap files, to see how attachments are treated. Take considerable comfort (in that area) from the fact that many others have already done so, which is why, e.g., calls to PostScript viewers use the "-safer" option to disable PS file access, and why PDF lacks those file functions entirely. (Had a sudden revelation that emacs or TeX viruses might be possible? Gosh, you're only about a decade or two behind the curve. Go ahead and write one — then find out how and why it's completely impractical to make your self-infected system spread it to elsewhere.)

6. Realise that dual-boot and similar (e.g., WINE) setups can be indirectly affected by non-Linux malware problems.

7. Understand that fast, widespread, automated leveraging of a surprise remote root exploit against your network stack(s), particular network daemons not previously known to be vulnerable, etc. could happen at any time. (Got backups? Got a rebuild plan?) Understand, that notwithstanding, that at least the record of giving people advance warning of these on Linux/BSD, even on bugware like wuftpd and Berkeley lpd/lprng, BIND8, and NFS/portmapper, has been so far excellent.

8. Having done all of that, feel comfortable in dismissing "Guys, wake up! Linux is in no way immune against viruses and time come when it's not just theory but hard fact of life" postings — that don't recognise those matters of context and perspective — as pretty much content-free humbuggery.

Rick Moen
rick@linuxmafia.com