Linux: security through obscurity?

Our security is insufficient, and, eventually, somebody is going to demonstrate that to the world.

I don't know about you, but I think it unlikely that we're going to see a "big bang", a sudden appearance of a brand-new threat. It hasn't happened that way in the past: the scum have tried a new approach, if they're lucky it's sort-of worked, then they refine it.

But we get to see the new approaches, and craft our responses at the same time. At the moment, the community seems to be moving fast enough to keep up with the scum, and often to cut off complete approaches for attack.

As the author hinted, the big potential problem is users with root (which home users do need) but without a clue. I suspect that a lot of the security engineering is going to have to be usability engineering: making the easy way the safe way, and the safe way the easy way.

James

Where one attack on one version of Windows may hit the vast majority of installed Windows systems, the same cannot be said of Linux. While an attack may work on say Red Hat 7.3 or some specific version, it usually doesn't work on Red Hat 8 or 9, much less any version of Mandrake or Debian or any other distro.

The reasons for this are many and varied: different libc versions, different installed applications, different defaults, etc. And each one of these differences makes it all that much harder for an attacker to write a single attack on Linux systems.

This diversity drastically limits the amount of damage any single attack can do to the "Linux" community.

1. There is no easy way of executing an attatchment within any MUA I
am aware of those. At least 99% of the people that can bypass this
problem are smart enough not to do it.

2. My normal user identity, which is all a email worm is likely to get,
does not have write permission to the system binaries, boot scripts
and other things commonly targeted by windows virii and worms.

Similar remarks apply to web browsers, which simply lack priledge and
the misdesign of IE, for malware to apply. Multiuser systems in general
are not plagued by worms for similar reasons. although NT is getting some
attention because enough people routinely use administator (the windows
NT superuser).

Just for context and perspective:

1. Those include DoS attacks (certainly not a good thing, but should not be confused with system compromise), and a huge number of speculative, possible, theoretical vulnerabilities for which no exploit is available and maybe never will be. 2. And many of those would be exploitable only in improbable system configurations, or involve software rarely installed or seldom enabled. 3. And almost all of those turn out to be vulnerabilities at an access level lacking system privilege. 4. And, the way Linux/BSD systems have tended to be maintained over the last few years (apt-get, urpmi, cvsup for BSD ports skeleton update, up2date, etc.), the time-windows of vulnerability have tended to either be incredibly narrow or (more typically) nonexistent.

And you know what? The next time someone unleashes an unexpected, impossible-to-plan-for global attack on a popular Linux/BSD system daemon (and, mind you, even the Morris worm involved a known hole in sendmail configuration) — or on a Web browser, or on a mail client — it'll be a two-day wonder: After OS-reloading where necessary (obviously not required unless there's been root compromise), people would just switch to one of the alternatives to that daemon or userland app not sharing the same failure mode, while waiting for a patched version of the affected one — because, unlike some communities, we seldom either get trapped by non-modular, inflexible systems or make ourselves dependent on Hobson's Choice take-it-or-leave-it system-wide "security packs".

And yes, stupid behaviour like installing untrustworthy apps from dubious sources with root authority (or ditto "security fixes" like the "Red Hat security update phishing attempt") will always subvert and defeat the measures we've implemented to make it difficult for the hapless to hurt themselves.

About that "phishing attempt": I've listed almost much all of the innumerable reasons why only someone both mindbogglingly gullible and also extremely adept with building and installing software with root authority could have fallen for it.

Meanwhile, if you want to be constructively paranoid about something, keep looking over those mailcap entries — and install/configure a proper IDS.

Best Regards,
Rick Moen
rick@linuxmafia.com

From an epidemiological point of view, if a certain fraction of the
individuals (computers) within a population (the Internet) are suceptible
to infection (a Linux virus), then the success of that infection will
depend critically on what that fraction is, in addition to how infectious
the virus is.

For example, many virus use email and addressbooks - if only 1 in 100
contacts are other Linux machines, then the virus will spread much more
slowly (and be much less succcessful) than a similar Windows virus.

Of course, this doesn't quite apply if Linux users group together in
cliques; then they form monoculture populations which are more susceptible
to infection. Although, as has been pointed out, diversity in the gene
pool (i.e. different distributions) provides infection resistance to the
whole population.