full-disclosure - Re: January 15 is Personal Firewall Day, help the cause

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1074285294.9897.82.camel@coruscant.weisserth.net>
From: tobias at weisserth.de (Tobias Weisserth)
Subject: Re: January 15 is Personal Firewall Day,
	help the cause

Hi David,

Am Fre, den 16.01.2004 schrieb David F. Skoll um 19:58:
...
> There are no self-propagating Linux e-mail viruses.  The only Linux
> e-mail viruses are proof-of-concept programs that have never actually
> infected machines other than lab machines designed to test the
> proof-of-concept.

Sorry, David. But Ramen did score quite well when it was active and
there were many infected Unix/Linux machines with Ramen.

Though I have to agree with you that there probably aren't any viruses
in the wild at the moment that could infect and compromise a patched
Linux system if it's properly setup.

It's different with Linux machines running lousy software such as
PHPNuke or PostNuke or something like that, which frequently is subject
to PHP/SQL injection exploits. When the system features an unpatched or
even uncharted local exploit such as the do_brk() bug which has been in
the kernel since the 2.2 series(!!!!! That's a damn long time !!!!!!) in
addition to such lousy software then the first system compromise with
some rootkit is unavoidable.

But of course I am comparing squares to circles here since no sane MS
Windows end user would run a webserver on his home machine.

When running Linux you seriously should consider to run chkrootkir from
a safe location (like a CD) and use file integrity checking of some
sort. Anything else is just asking for trouble the hard way. I only have
to remind you of the Debian hack. Hadn't Debian used AIDE to detect the
modifications in their systems, we'd never had known about that do_brk()
vulnerability until major damage occurred.

kind regards,
Tobias W.