full-disclosure - Re: January 15 is Personal Firewall Day, help the cause

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200401162020.i0GKKBpa004849@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Re: January 15 is Personal Firewall Day, help the cause 

On Fri, 16 Jan 2004 13:31:36 EST, Exibar said:

>  Will any of these do?  Will you still think you don't need AV on Linux now?
> 
> here's a partial list..... don't choke too hard now!
> 
> Linux.Bliss.a Worm.Linux.Hijack Backdoor.Linux.Kbd

<relatively short by Microsoft standards list elided>

OK.. Sure.  They exist. Now, think about the following questions, while chanting
Schneier's "Security is a process":

1) How many of these achieved wide enough distribution so that you have a
*serious* worry of actually seeing one?  'Lion' had a good run, and had a
creditable threat to infect all vulnerable machines.  Most of these don't
qualify as a serious threat (although to be fair, the vast majority of the
100,000+ Windows viruses don't qualify either).

2) Are there enough samples to actually make sane templates for?  Or are you
looking at the same old "fight the next war with the last war's tactics" again?

3) Is an AV *really* the right solution, or is your time better spent deploying
a *real* security solution? For instance, "only blessed developer toolkit
programs such as /bin/ld are allowed to write to executable binaries" goes a
long way to closing the door to viruses that scribble into binaries.
Sandboxing it further with "and programs that talk to the net can't invoke the
toolchain as well" does even more.  If you disagree with that model, feel free
to brainstorm your own policy that doesn't care if the attacker is a virus or
some other attack vector (possibly even an actual live black hat)...

So let's see - I can "secure" myself against viruses by running AV software, or
I can *really* secure myself against viruses *AND* most other known attacks as
well by doing things like:

1) Staying up to date on patches
2) iptables
3) Hardening the system as per Center for Internet Security and/or other recommendations
4) tripwire (yes, I know this one is after-the-fact)
5) SElinux and/or similar systems.

Which of the above have worse stats for price/performance and TCO (on a
*continuing* basis) than your proposed AV solution?

And what's the incremental price/performance for your AV solution after
deploying each of the above (singly or in combination)?

In other words, is an AV solution for Linux *really* worth it, or are there
half a dozen things that provide more bang-for-buck, and once you deploy those
half-dozen, you're not doing very much additional good with an AV solution?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040116/5bb3c371/attachment.bin