Forgot your password?
typodupeerror
Security Debian Linux

Malware Found Hidden In Screensaver On Gnome-Look 611

Posted by timothy
from the sudo-you-know-what-you're-sudoing dept.
AndGodSed writes "OMG! UBUNTU! Reports the following: 'Malware has been found hidden inside an innocuous 'waterfall' screensaver .deb file made available on popular artwork sharing site Gnome-Look.org. The .deb file installs a script with elevated privileges designed to perform a DDoS attack as well as keep itself updated via downloads. The dodgy screensaver in question has since been removed from gnome-look, and this incident was a very basic, if potentially successful, attempt.'" A similar report at Digitizor.com says that similar malware was also found in a theme called Ninja Black. For those affected, both sites also provide instruction on cleansing your system.
This discussion has been archived. No new comments can be posted.

Malware Found Hidden In Screensaver On Gnome-Look

Comments Filter:
  • Not more safe (Score:3, Insightful)

    by sopssa (1498795) * <sopssa@email.com> on Wednesday December 09, 2009 @06:39PM (#30382128) Journal

    It's been told to all the linux zealots so many times that Linux itself isn't really more secure against malware than Windows. It's only so because it's marketshare is like 0.5%, if even that, and it makes much more sense to make malware where the (non-geeky) users are.

    This just shows that if ever linux did gain marketshare with casual people enough, the malware problem will be there too. Repositories won't help with that, because people want 3rd party programs and games.

    The funny thing about this is the same that as with Mac OS X users. All of the zealots yelling that Linux/Mac OSX are secure about malware, which results in normal people thinking they can run whatever downloaded "because my OS is secure!".

    And before everyone jumps on the "but you can't get infected by just browsing on porn sites on linux!", why not? What was the last time you got infected by Windows vulnerability? Those attacks are usually against 3rd party programs like PDF or Flash. And guess what, those apps are on Linux too and are just as well exploitable.

    The only reason malware problems are smaller on Linux than Windows is because of the almost-non-existing desktop marketshare and that those who use it on desktop are usually more tech savvy.

    This just shows that if Linux had 95% marketshare on desktop, and Windows 0.5%, it would be the same thing but just turned around.

    • Re:Not more safe (Score:5, Insightful)

      by nschubach (922175) on Wednesday December 09, 2009 @06:43PM (#30382196) Journal

      The idea behind it is so that someone will put out a patch for said vulnerability without having to wait for parent company to do so...

      It's not more secure because of it's market share, it's more secure because anyone can fix it.

      • Re:Not more safe (Score:5, Insightful)

        by sopssa (1498795) * <sopssa@email.com> on Wednesday December 09, 2009 @06:46PM (#30382240) Journal

        But that still requires distros to inspect and validate the patches before they go live to repositories. The big part isn't really fixing the code, it's to test that it surely works and doesn't cause problems for users.

        And even so, if the vulnerability is in lets say flash, just anyone or distros can't fix that closed source application.

        • Re:Not more safe (Score:5, Insightful)

          by nschubach (922175) on Wednesday December 09, 2009 @06:53PM (#30382304) Journal

          The Flash player isn't open source. The Compiler is, the player is not. As I said, the idea behind open source being more secure is that you could have potentially thousands of different solutions to prevent this thing in the future. The best one is chosen and patched into the main tree. If you have the source, you can do this in a few minutes (or put in your own temporary patch) with the proper skill and be back up and more secure than someone waiting for "Patch Tuesday." Even if a patch comes in that resolves that problem, it could have been the first solution to said problem and might have problems itself that will need to be fixed later.

          It's really the potential quantity of solutions to the problem.

          I could argue with you that this vulnerability might have been fixed sooner with more market share.

          • Re:Not more safe (Score:5, Informative)

            by sopssa (1498795) * <sopssa@email.com> on Wednesday December 09, 2009 @06:57PM (#30382350) Journal

            But this is not really about vulnerabilities. This is a screensaver that user downloads from a website. Open source or not, you can't fix that unless the whole system is totally locked down like iPhone. And that doesn't really sound good.

            • Re:Not more safe (Score:4, Insightful)

              by nschubach (922175) on Wednesday December 09, 2009 @07:07PM (#30382484) Journal

              You are arguing about ignorance of users, not the security of the OS...

              • Re:Not more safe (Score:4, Insightful)

                by Anonymous Coward on Wednesday December 09, 2009 @07:41PM (#30382830)
                The reason most Windows-based PCs are infected is also due to the ignorance of users. I haven't had a virus or malware attack in years because I keep my antivirus program up to date, I don't visit sites that are prone to malware, and I use safe searching habits. The people who are constantly asking me to fix their computers are the ones who don't follow these strategies.
                • Re:Not more safe (Score:5, Insightful)

                  by nschubach (922175) on Wednesday December 09, 2009 @08:03PM (#30383048) Journal

                  I have a Windows machine which has been running just fine for years, but that doesn't mean that it's just as secure. If I do get a virus on that machine, there's a greater chance I will be rebuilding it opposed to my Linux machine.

                  • Re: (Score:3, Informative)

                    by thejynxed (831517)

                    In this day and age, if your machine gets compromised by a virus, trojan, or rootkit, the only sensible thing to do is wipe and reinstall from a known clean backup. It doesn't matter what OS it is. There's no telling what other little friends they brought along that your chosen methods of detection didn't find. It's not really an option anymore to keep on going with a system that was compromised.

                    There's also been some evidence of malware that triggers AV software on purpose, and acts as a distraction while

                    • Re:Not more safe (Score:5, Insightful)

                      by Thinboy00 (1190815) <thinboy00@noSpaM.gmail.com> on Wednesday December 09, 2009 @09:14PM (#30383736) Journal

                      There's also been some evidence of malware that triggers AV software on purpose, and acts as a distraction while the real dirty payload gets delivered silently elsewhere in your system. You are now fooled into thinking your system is clean because your AV caught the distraction virus, completely missing the real one that was also installed.

                      AVs don't get "distracted" -- either the real payload is detectable by the AV, in which case the distraction won't be successful since both will be found and removed, or else the real payload is undetectable, in which case you don't need the distraction at all, and as a matter of fact it hurts you by making user more security-conscious.

                  • Re: (Score:3, Interesting)

                    by timeOday (582209)
                    The registry alone makes Windows impossible to clean. Who knows what is in there? It's a bunch of gibberish. Please nobody claim it's the same as /etc, because it isn't. At best the registry is /etc's evil twin.
                    • Re: (Score:3, Interesting)

                      by Zardus (464755)

                      /etc might not be the same as the Windows registry (I agree with this statement, /etc is much more manageable), but the gconf registry is looking more and more like it every month. You can say gnome isn't an integral part of Linux, but it's installed on the majority of end-users systems nowadays so for these purposes, it pretty much is...

                • Re:Not more safe (Score:5, Interesting)

                  by Thinboy00 (1190815) <thinboy00@noSpaM.gmail.com> on Wednesday December 09, 2009 @09:11PM (#30383714) Journal

                  My mother managed to get some nearly-impossible-to-remove scareware on her (Windows) netbook. She swears up and down that she never visited any sketchy sites, had AV (but no anti-malware), etc. She was basically using it for several things:
                  1) Visiting various newspapers' websites
                  2) Webmail (a dedicated server for her business)
                  3) Word processing (OpenOffice.org)
                  4) Spider Solitaire
                  5) A few online games (jigsaw puzzles, sudoku, presumably flash-based) she found on Google. I think this is the most likely vector, but she uses the same websites all the time.
                  6) Visiting certain reputable, ad-free (AFAIK) sites.
                  She is smart enough to never download/run/open suspicious programs/files/etc and she was using Firefox 3.5. This thing was able to prevent itself from being uninstalled easily. On Linux, she could have simply killed any offending processes (O.K. that's nontrivial, but no root permissions needed in theory) and check the (graphical, so-easy-to-use-a-caveman^H^Hgrandma-could-do-it) Gnome startup programs tool for suspicious entries. On Windows, we eventually had to use "System restore" (an OS feature) -- which the program could potentially have disabled had the malware author thought to do so (it was totally rooted -- the malware was preventing the installation of some anti-malware programs) and then download the anti-malware program that had previously failed to install. Windows Vista/7 are probably more secure than XP which she has, but I'm still reluctant to blame all Windows security issues on user stupidity. Now I have her running Firefox+NoScript so that it (hopefully) won't happen again, but that's mostly because she refuses to switch to Linux. Most users would be running IE7 or so... not Firefox+NoScript. This is clearly not just "user stupidity" -- it's a windows genuine advantage^H^Hbug.

                  • Re: (Score:3, Informative)

                    by bendodge (998616)

                    Disclaimer: I'm a tech at a work a computer repair shop.

                    Let me guess: she was running as root. This scareware deleted mbam.exe as soon as the installer unpacked it, and/or had a little icon by the clock that popped a notification balloon every time you started a process saying that it (even taskman) was infected with $SCARY_VIRUS_NAME and killed the process.

                    Since the middle of October, we've had a wave of clients with this stuff, many whom are running the best AV's (we sell NOD32) and have no idea how they

            • Re:Not more safe (Score:5, Interesting)

              by mjwx (966435) on Thursday December 10, 2009 @01:25AM (#30385204)

              Open source or not, you can't fix that unless the whole system is totally locked down like iPhone

              No, even the iphone has vulnerabilities. Locking down a system does not fix vulnerabilities, it only hides them from public view. An open system is more secure as everyone know when a vulnerability is discovered and syadmin's can make work arounds (or even pull the system down) until a patch is developed. With a closed system there is less chance of an exploited vulnerability being discovered by the people who want to fix it or are affected by it.

          • Re:Not more safe (Score:4, Insightful)

            by Voulnet (1630793) on Wednesday December 09, 2009 @07:43PM (#30382848)

            If you have the source, you can do this in a few minutes (or put in your own temporary patch) with the proper skill and be back up and more secure than someone waiting for "Patch Tuesday."

            If you want Linux to grow and reach more people, as opposed to being a geek niche, then you should forget about requiring people to have the skills necessary to patch the source. Emergence of malware means only one thing: Linux is growing in popularity. Now, if we wish for its popularity to prosper then we should use the normal user's perspective a little bit; you know, people who can't patch the source and compile it by themselves.

            • Re:Not more safe (Score:5, Insightful)

              by phantomfive (622387) on Wednesday December 09, 2009 @11:52PM (#30384760) Journal

              If you want Linux to grow and reach more people, as opposed to being a geek niche,

              I don't.

              For me, Linux is the perfect operating system for a programmer. I'd like it to stay that way. If it becomes popular, that's fine; but if it becomes something other than a programmer's operating system, I will switch to BSD or something.

            • Re:Not more safe (Score:5, Insightful)

              by StuartHankins (1020819) on Thursday December 10, 2009 @01:28AM (#30385216)
              Personally I don't care if Linux is ever employed by the "average person". I'm not one of those people and the work I do requires people who know what's going on. Linux gives me the fine control to get in there and tweak things that Windows will probably never have.

              You can make a machine smarter, but people keep getting dumber all the time. At some point you just have to say to those people forget it, you're not going to learn, you're not worth trying to explain it to. Here's your Etch-a-Sketch.
      • Re:Not more safe (Score:5, Insightful)

        by sbeckstead (555647) on Wednesday December 09, 2009 @06:47PM (#30382258) Homepage Journal
        Wrong, anyone can not fix it. Any one MAY fix it.

        Only the tech savvy programmer types that care enough to fix can fix it.
      • Re:Not more safe (Score:5, Insightful)

        by _merlin (160982) on Wednesday December 09, 2009 @06:49PM (#30382278) Homepage Journal

        Malware doesn't need to exploit vulnerabilities in the software: it only needs vulnerable users. There is no way to patch that.

        • Re: (Score:3, Insightful)

          by nschubach (922175)

          But there is a way to minimize the impact, correct? Take this vulnerability for example. It might have had an effect on just the one user, but it wasn't going to be able to infect the system folder...

          Windows is getting better with this, but a Windows user still has more potential system destructive powers than an equivalent Linux user.

          • But there is a way to minimize the impact, correct? Take this vulnerability for example. It might have had an effect on just the one user, but it wasn't going to be able to infect the system folder...

            Not true. It affects the system as a whole because packages need root privileges to install.

          • Re:Not more safe (Score:5, Informative)

            by sopssa (1498795) * <sopssa@email.com> on Wednesday December 09, 2009 @07:03PM (#30382432) Journal

            But so what if it only gets access to one user? Malware doesn't really need root access. Stealing user data and sending spam is just as possible from user base. In history malware tried to just fuck over the computer which would had required root access, but now its just about sending spam or stealing data.

          • by Goaway (82658)

            And how many desktop Linux machines even have more than one user?

        • Re:Not more safe (Score:5, Insightful)

          by LordLimecat (1103839) on Wednesday December 09, 2009 @08:49PM (#30383494)
          If gnome-look is hosting .debs and not reviewing them, it seems to me like theyre inviting disaster.
      • by Suiggy (1544213)
        Yes, but clueless users aren't going to be knowledgeable enough to download and install the patch. Hell, they probably won't even notice they're infected until months later.
      • Re:Not more safe (Score:5, Insightful)

        by kai_hiwatari (1642285) on Wednesday December 09, 2009 @06:54PM (#30382322) Homepage Journal
        This particular malware is not because of a security problem with the OS. It is more of a social engineering thing - trying to trick unsuspecting users to install a malicious script by hiding it as a theme or screensaver.
        • by nschubach (922175)

          Yeah, but now that the malware was created, it shouldn't be long before for someone prevents another screensaver from doing this again... that's what I was getting at.

          Even if it isn't patched immediately, a Linux screensaver has lower potential of screwing up the entire system folder with it's payload.

        • Re:Not more safe (Score:4, Insightful)

          by Anonymous Coward on Wednesday December 09, 2009 @07:29PM (#30382702)

          This particular malware is not because of a security problem with the OS.

          Except that if this was a Windows screensaver you can bet it would be blamed on the OS and not on the fact that it was a social engineering attack.

          • Re:Not more safe (Score:4, Informative)

            by phantomfive (622387) on Wednesday December 09, 2009 @08:14PM (#30383184) Journal
            Not by anyone intelligent. The difference between Windows and Linux is how easy it is to remove stuff like this on Linux. It's easy on Linux. Sometimes practically impossible on windows.
            • Re: (Score:3, Insightful)

              by oatworm (969674)
              Except if the screensaver happens to have some other program attached to the installation package, it'll be installed with root privileges without you knowing about it. Once that happens, you're done - it can rename system files, replace existing system files with its own 'dirty' files, or do anything else that root can do (i.e. practically anything), including preventing you from ever uninstalling it. They don't call it a "rootkit" because it first came out on Windows.
      • Re:Not more safe (Score:5, Insightful)

        by Intron (870560) on Wednesday December 09, 2009 @11:28PM (#30384634)

        The idea behind it is so that someone will put out a patch for said vulnerability without having to wait for parent company to do so....

        It turns out that I have patched a serious vulnerability in Linux. Please download and install my patch as root on your system.

        Sincerely,
        Someone

    • Re:Not more safe (Score:4, Insightful)

      by phantomcircuit (938963) on Wednesday December 09, 2009 @06:45PM (#30382212) Homepage

      This just shows that if ever linux did gain marketshare with casual people enough, the malware problem will be there too. Repositories won't help with that, because people want 3rd party programs and games.

      Well that's why the goal is to get as much of the third party software into the repository as possible.

      • Re: (Score:3, Interesting)

        by Goaway (82658)

        And thus you raise the threshold for entry for new third-party software.

    • Re:Not more safe (Score:5, Insightful)

      by Anonymous Coward on Wednesday December 09, 2009 @06:45PM (#30382220)

      All it shows is that Linux is vulnerable to trojan horses. ALL operating systems are vulnerable to trojan horses. When you show me a Linux or OS X computer that's vulnerable to something like the slammer worm, get back to me.

      • Re: (Score:3, Interesting)

        by sopssa (1498795) *

        Any (good) linux sysadmin knows that there has been many Linux worms in the history. Yes, history. You're also referencing to a 2003 Windows worm here.

        Conficker aside, such worms are pretty much in history. Most malware now a days comes via trojans, and any OS can't protect against that unless it's totally locked down (like iPhone)

        • Re: (Score:3, Interesting)

          by DragonWriter (970822)

          Most malware now a days comes via trojans, and any OS can't protect against that unless it's totally locked down (like iPhone)

          There's a middle ground that can maximize protection against trojans (of course, nothing can protect against completely unwary users), and that's using something a model where untrusted apps are (whether by running through app-specific accounts or otherwise) required to be given fairly finely grained permissions on installation before accessing resources.

          While Linux distros provided

          • Re:Not more safe (Score:5, Interesting)

            by digitalunity (19107) <digitalunity.yahoo@com> on Wednesday December 09, 2009 @07:33PM (#30382738) Homepage

            Here's an idea. Feel free to agree, disagree, tear it apart, whatever...

            Why not have a kernel network access logging module with a userland process that periodically reports to users which programs are accessing the TCP/IP network? Say once a week or once a month or something. The number of programs that do this for many users is quite low. Probably Firefox, Thunderbird, Opera, uTorrent, a short list of other programs. Users then have an opportunity to ignore those programs on future reports. Users now have a good idea if there are changes to their system that might affect security.

            There would still be opportunity for malware to access the internet, but users would either 1) notice it or 2) it would make the malware work in very complicated, noticeable ways(like uploading data to a website using a URL).

      • Re:Not more safe (Score:4, Insightful)

        by Fractal Dice (696349) on Wednesday December 09, 2009 @11:05PM (#30384496) Journal

        That's not the lesson I see. To me it says that a user-based security model are insufficient - apps are too free to call/use each other - the threat has moved from "rooting a box" but rather to "rooting a user". OSes (and users) need to start looking at the user as a system administrator of many threads of personal data.

        Web browsers have already discovered much of this - different tabs on your web browser are like different apps and just as a sysadmin cannot trust all the users to play nice with each others' data, users can't trust different apps with full access to all other apps.

    • Re: (Score:2, Insightful)

      by Suiggy (1544213)
      I agree. The best software in the world can't protect itself from clueless ignorant users who don't know any better. The more clueless, ignorant users using the software, the higher the rate of occurrence of exploitation. If Linux were to become as popular as Windows, I guarantee it would have just as many problems as Windows users currently suffer from.
      • Re:Not more safe (Score:5, Interesting)

        by nurb432 (527695) on Wednesday December 09, 2009 @07:07PM (#30382476) Homepage Journal

        Except one would hope that you could trust what you get from a site like this. Not everyone can scour the source/binary of every app they get from a 'trusted' site.

        And if you cant trust the 'trusted' sites for the free stuff, then the entire FreeOS movement is dead in its tracks.

    • Re:Not more safe (Score:5, Interesting)

      by _merlin (160982) on Wednesday December 09, 2009 @06:47PM (#30382248) Homepage Journal

      It looks like it's following the same pattern as Windows malware, too: make a cool screensaver, post it to sharing sites, hope people tell their friends about it. That was a common malware vector for Windows in the early part of this decade. Next there'll be dodgy "codecs" on pr0n sites, and once people start using malware scanners for Linux, they'll make dodgy fake antivirus software to con gullible users. Netbooks may be great for attracting attention to Linux, but we have to remember that this will include the kind of attention that no-one wants.

      • The difference is that there isn't a common software repository for windows like there is for Linux. If you want a screensaver for Linux, you can get tons with xscreensaver. For windows, the software ecosystem is much more confusing.

        Google's netbook won't even have the capability to install software.

        • Re: (Score:3, Insightful)

          by sopssa (1498795) *

          The software ecosystem is "much more confusing" because it's an OS with 95% marketshare and theres millions of 3rd party programs and games for users. And they really want and need those.

          Actually it would really suck if Windows had just one Microsoft verified "app store" where everything is controlled like with iPhone.

          • Re:Not more safe (Score:4, Interesting)

            by isorox (205688) on Wednesday December 09, 2009 @07:38PM (#30382794) Homepage Journal

            Actually it would really suck if Windows had just one Microsoft verified "app store" where everything is controlled like with iPhone.

            Yes it would, and in this would I would add the google repository, and perhaps the apple repository. Anyone could set up a repository (same as you can with debian), and sign their packages, but if they got compromised, or let crap in, then I'd be wary of using them in the future.

            The problem with the iphone appstore is there's only one. You cant add a competitors.

    • Re:Not more safe (Score:5, Interesting)

      by Anonymous Coward on Wednesday December 09, 2009 @06:49PM (#30382268)

      You kind of have a point, but the fact is, you need root privileges to install a .deb, and I have quite successfully installed gtk/gtk2 themes/icons/etc without admin privileges. If I downloaded a .deb from a random site and then installed it, it would be just like running a .exe on windows, but for most things I need to do on linux, I don't actually have to take that risk, while on Windows it seems everything is a .exe. Not sure about screensavers, but it seems this was, like 90% of viruses for any platform, a hack relying on stupid users elevating the virus to root authority themselves.

      Repositories are getting a lot better too, I don't use ubuntu any more but when I left the PPA was in ascendancy, which seemed to allow a much better enforcement of security while still letting 3rd party stuff in.

      • Re:Not more safe (Score:5, Insightful)

        by NoobixCube (1133473) on Wednesday December 09, 2009 @07:04PM (#30382442) Journal

        Mod parent up. I know he's AC, but the point he makes is still good: There is no amount of security that can protect your machine from a clueless user.

        When you install a theme the normal way, you just drag the archive file - that is to say, no executeable parts, or any way to make the parts executeable - into the theme manager, and presto, it's installed and it asks if you want to apply it. This doesn't require root privilages because it installs to the user's personal themes folder within their home folder. When they do this, there's no way to sneak in a cron job (that's a scheduled task) or any other nasty automatically executing files. Installing from a .deb is usually unneccessary, and as this story proves, exposes your install to risk if you don't pay attention to what you're installing. In my opinion, Ubuntu, being the most newbie-visible Linux distro at the moment, has a responsibility to educate users on things like this. A PDF in their home folder, or a slide show that takes like ten minutes to go through, telling new users how Linux is different to Windows would work wonders, and take up virtually no space on the install disc. There's no excuse for there not being one.

        • Re:Not more safe (Score:4, Insightful)

          by Jon.Laslow (809215) on Wednesday December 09, 2009 @08:28PM (#30383298) Homepage Journal
          "...or a slide show that takes like ten minutes to go through..."

          Did you just seriously suggest that Ubuntu include a ten minute presentation for users to watch? As in, no sarcasm there? Do you honestly expect anyone to actually sit through that? Most people don't have the attention span to sit through the multilingual Welcome video OS X shows on first-boot without trying to skip it, let alone something that talks about security for ten minutes. Remember, if you can't make the user care enough to look in the address bar to see if the 'PayPal' link sent to them in an email is actually legit, you aren't going to make them care enough to sit through ten minutes of tedium after their install is done.
    • Re: (Score:2, Troll)

      by danomac (1032160)
      There would definitely be more, but I seriously doubt as much as Windows. Most of the drive-by exploits require root privileges to do anything serious to the machine. Almost everything is used without root privileges and so those types of attacks plain don't work. (I'm referring to Windows computers being infected just by being plugged into the internet.) I can't remember the last time I heard of something like this happening with linux.

      Voluntarily installed malware by using social tactics and the like w
      • by sopssa (1498795) *

        But the thing is, most malware doesn't even need root access to do it's job. Stealing users data and sending spam works just as well from user base.

        Requiring root access is mostly for those who want control over that exact machine, like hackers.

    • Re:Not more safe (Score:5, Insightful)

      by amasiancrasian (1132031) on Wednesday December 09, 2009 @06:51PM (#30382292)

      I've been telling many the same thing, but with one exception; Mac and *nix have started out with a better permissions system and therefore users who have downloaded an app from the Internet have been trained to be doubly sure about whatever it is that requires sudo power (e.g, the Mac sudo GUI prompt). Microsoft UAC, on the other hand, has had to deal with transitioning software developers to not write in "Program Files" and other public areas and to save data to personal home folders.

      While I'll agree with you that Mac/*nix are not any more secure than Windows, the Mac/*nix users have been taught to take a sudo prompt seriously, while in the early stages and growing pains of UAC, Windows users were easily annoyed by UAC prompts and therefore took the UAC prompts less seriously, because UAC prompted were being triggered by transitioning software developers that did not save data in the user's home folder.

      In the end, the security of any system relies on the ability for the user to authenticate and verify software downloaded. But making it more difficult, such as requiring an administrator password to be entered for elevated privileges, makes users more cautious of software requiring a sudo prompt. And while that's not inherently any more secure, at least users think twice before entering their password.

    • by davek (18465)

      This just shows that if Linux had 95% marketshare on desktop, and Windows 0.5%, it would be the same thing but just turned around.

      Absolutely FALSE! The numbers would be closer, but not equal. By definition, you cannot know all the vulnerabilities in "secret source" software, because they are simply not disclosed. This number is surely more than zero. Therefore, all other things being equal. open source will always prevail because the "secret" vulnerabilities will be fixed on OSS, while they still exist in secret source software.

    • by jedidiah (1196)

      > And before everyone jumps on the "but you can't get infected by just browsing on porn sites on linux!", why not?

      Linux doesn't go out of it's way to do stupid things for a dubious gain in "convenience".

      Linux never bought into this idea of blurring the line between data and programs. Linux never encouraged executing random executables from unknown and untrusted sources.

      Neither did MacOS, or FreeBSD, or any of the commercial Unixen.

      In that regard, merely avoiding Microsoft apps while running their OS can

    • by Kjella (173770)

      Linux can't cure idiocy. But the repositories are a pretty solid base of tools before they start wanting to shoot themselves in the foot. How many people are infected by the time they're done warezing up their computer with "basic" tools like Windows itself, MS Office etc? Quite many. How many people block or are blocked from patches because they're not a "genuine" install? It would help.

      P.S. PDF is quite safe, Adobe PDF Reader on the other hand is not but luckily us Linux users in general don't use it. Sam

    • by gandhi_2 (1108023)

      Which is a great argument against monoculture, something the "linux zealots" have been warning us about for years.

    • Re:Not more safe (Score:5, Insightful)

      by at_slashdot (674436) on Wednesday December 09, 2009 @07:05PM (#30382452)

      You have a poor understanding of what "malware" is or what Linux/Mac zealots claim.

      Malware is piece of code, all OSes run code, therefore all OSes are vulnerable to malware. What Mac and Linux "zealots" claim is that it's not likely to get malware in Linux/Mac just by browsing a site, opening an e-mail, or just by keeping the computer on and connected to the network -- that hasn't changed.

      "Repositories won't help with that, because people want 3rd party programs and games."

      I am happy with 25,000+ programs available in Debian repository, I never install random package from the Internet. At least the basic packages should be available from the repos so the risk is at least reduced if not eliminated (depending on the behavior of the user)

      In my experience people who use the word "zealot" lack arguments.

    • Re:Not more safe (Score:5, Insightful)

      by vadim_t (324782) on Wednesday December 09, 2009 @07:27PM (#30382686) Homepage

      Sorry, this line of argument is stupid.

      You're basically arguing that you can't be more secure than Windows -- Windows' security is as good as things will ever get, and everything else only gets less viruses because it has less marketshare.

      But if so, why all the security advancements in the latests Windows versions? Why isn't it still using Win95 era security? Why did MS bother coding support for NX, UAC and so on? Well, because turns out, it's possible to do better. Current Windows versions are vastly more locked down than Win95, because some design choices turned out to be stupid and vulnerable.

      Linux doesn't follow some common Windows security pitfalls, like having ActiveX and having the browser execute binaries from the net. It also doesn't have autorun. Just that closes several ways of compromising the system, therefore at least in that respect it's more secure. Of course it's not 100% impenetrable, but evidently there exist features and implementation details which make it easier or harder to compromise the system, so not all OSes are equally [in]secure, it depends on how they're implemented.

      • Re: (Score:3, Informative)

        by Dog-Cow (21281)

        WIndows NT 3.5 existed at the same time as Windows 3.1 and had most of the same security features as Windows 7. The NX bit had not been implemented by Intel, so it couldn't support that, and the UAC stuff is not really needed for security. It's just a shortcut for getting admin privs without logging in as admin.

        Really the recent changes in Windows security has been in guiding the user to more secure practices, such as not logging in as admin.

  • by binarylarry (1338699) on Wednesday December 09, 2009 @06:46PM (#30382238)

    It's the YEAR OF THE LINUX desktop! It's official! /Happy Ubuntu User

  • by Xerp (768138) on Wednesday December 09, 2009 @06:49PM (#30382266) Journal
    "sudo rm -f /usr/bin/Auto.bash /usr/bin/run.bash /etc/profile.d/gnome.sh index.php run.bash && sudo dpkg -r app5552" Man. I'm going to have to get me some anti-malware software...
  • This is why you only install packages from the repositories.

  • auto-update (Score:4, Insightful)

    by TheSHAD0W (258774) on Wednesday December 09, 2009 @07:01PM (#30382404) Homepage

    Okay, this scares me.

    1. What happens when a publisher includes auto-updating code, but not specific attack code, like the DDoS software in the mentioned examples? If discovered it will appear to be a security risk, but not specifically malicious...

    2. What happens when a software developer produces some completely innocuous software, gets into the repositories - and then months down the road, produces an update with DDoS capability, and has the update pushed into the repositories and automatically distributed?

  • Before trolls start yelling about how "OMGZ LINUX ISN'T SECURE HAHAHA" and things like that, let me tell you something: because GNU/Linux is so open and configurable, malware like this can be very easily removed. All you have to do is run a few commands in a terminal to remove this. On Windows and the like, things are so complicated that Anti-virus software is almost required to remove some of their malware. I am glad to use an OS that doesn't restrict me like that. :)

    • by PeanutButterBreath (1224570) on Wednesday December 09, 2009 @07:18PM (#30382600)

      Before trolls start yelling about how "OMGZ LINUX ISN'T SECURE HAHAHA" and things like that, let me tell you something: because GNU/Linux is so open and configurable, malware like this can be very easily removed. All you have to do is run a few commands in a terminal to remove this.

      Before trolls start yelling about how "OMGZ WINDOZE AV SOFTWARE IS COMPLICATED HAHAHA" and things like that, let me tell you something: because Windows is so accessible, AV software like this can be very easily deployed. All you have to do is click a few icons in the Start Menu to remove this. Blah, blah, blah

      On Linux and the like, everything is simple if you already know what you want to do. Otherwise, you have to trust unaccountable internet entities to provide you abstruse commands to run and hope they aren't trying to trick you into doing even more damage to your system. It should be obvious why that is a no way to combat malware.

      • Re: (Score:3, Informative)

        by armanox (826486)
        Which is why we have anti-virus and such on Linux as well. A healthy dose of paranoia...
    • by Drakin020 (980931) on Wednesday December 09, 2009 @08:32PM (#30383330)

      Ah but here is the problem.

      To you, removing a virus from Linux is easy, because you are obviously an intelligent Linux user.

      (Someone posted above the removal instructions)

      For you to write out: sudo rm -f /usr/bin/Auto.bash /usr/bin/run.bash /etc/profile.d/gnome.sh index.php run.bash && sudo dpkg -r app5552

      seems like nothing at all, but what about the average computer user? Do you think they know what sudo is? Hell I don't use Linux and I have no idea what the shit any of that stuff means. So no, that would only work with someone who really knows what they are doing with Linux.

      Now on the flip side, you say...

      "On Windows and the like, things are so complicated that Anti-virus software is almost required to remove some of their malware"

      Ah, but this is going off the assumption that we are dealing with an average Windows user, not an expert user (Such as your self with Linux)

      An expert Windows user like myself would say "Removing Malware is easy, just go into the registry's run section, remove what looks suspicious, delete temp files, prefetch, and search for the malware running process (Example: virus.exe) in the registry, and delete it"

      Ah see that to me is easy, I've done things like that all the time, and it's just cake.

      So I guess the point I'm trying to make is that...To you, removing a virus like this from Linux can be really simple...to someone who knows Linux, but the same can be said to a Windows user...who knows about Windows.

      • Re: (Score:3, Interesting)

        by maugle (1369813)
        To bolster your point: How did they find the name of the package? Only someone knowledgeable in Linux could've found that out, or the various locations it installed itself to

        To refute your point: Malware can get its hooks into Windows in a variety of different ways, and removal often requires specialized tools. For example, I had to remove one of those hideous fake-antivirus programs from a neighbor's computer. Real antivirus was no help. MalwareBytes Anti-malware couldn't get rid of it. Going into S
    • Re: (Score:3, Insightful)

      by DiegoBravo (324012)

      This kind of problem is not about Linux or Windows but about distro that added malware in some crap application. In order to avoid that:

      1) The typical crap software should not be allowed the same privileges as a typical user (why an screensaver should open sockets? remove files?) There are capabilities and several security options that nobody takes seriously

      2) The package system should allow only a predefined set of actions in the installation process. Currently it runs as root any package' script; that's t

    • by FreelanceWizard (889712) on Wednesday December 09, 2009 @10:10PM (#30384128) Homepage

      I'm afraid not. The reason this malware is easy to remove is because it doesn't do anything truly wretched, like patch libc and other applications, install a rootkit kernel module, and the like.

      Having dealt with Linux boxes that have been hit by automatic exploitation tools that go well out of their way to hide their presence, I can tell you that no matter what the operating system, the standard advice holds: once the machine is infected, the only sure way to get it back to a known state is to restore from a backup made prior to the exploitation or to wipe it completely and start over. I should also point out that these machines were rooted through the exploitation of previously-patched vulnerabilities in setuid services -- which is the exact same vector many Windows worms use, including Slammer and Conficker.

      The only difference between the tools I've run into and a full-on worm is that they run at the command of a cracker and scan IP address ranges of his choice. With a bare amount of automation, they could become very successful Linux worms, breaking into all those machines that, say, have old OpenSSH binaries that haven't been patched against its known remotely exploitable vulnerabilities.

  • by AlgorithMan (937244) on Wednesday December 09, 2009 @07:08PM (#30382502) Homepage
    What the summary didn't mention: the screensaver has been there less than 24 hours.
    see pro-linux.de [pro-linux.de] (german)
  • by ghostis (165022) on Wednesday December 09, 2009 @07:10PM (#30382516) Homepage

    The Gnome team is working with several university neurology departments to develop a patch for human nature that fixes this problem. It will be included in Gnome 4.

    • Re: (Score:3, Funny)

      by refactored (260886)
      The Gnome team is working with several university neurology departments to develop a patch for human nature that fixes this problem. It will be included in Gnome 4.

      Don't you mean "Genome 4"?

    • Gnome team is working [...]] to develop a patch for human nature that fixes this problem.

      I suspect they've decided that a free will is unusable and will replace it with sane defaults ;)

  • by Lost Race (681080) on Wednesday December 09, 2009 @08:40PM (#30383400)

    For those affected, both sites also provide instruction on cleansing your system.

    There's only one way to "cleanse" your system of malware once it's infected:

    1. Boot from known-good media (i.e. pressed CD from OS distributor)
    2. Block-erase hard drive(s)
    3. Re-install OS
    4. Restore documents from backup

    Any malware that can auto-update itself can potentially install anything at all. It could, for example, set up a file-sharing node which caches illegal data files [slashdot.org] on your system.

    • Re: (Score:3, Insightful)

      by istartedi (132515)

      You forgot to verify the BIOS checksum.

      Although most malware probably doesn't go that far, it seems like if I really wanted to "pwn yur box", I'd at least patch rm to not delete my executable and instead simply fool the user into thinking it was gone. Patch ps to not display the process.... and general other rootkit mischief. I'm not terribly familiar with that kind of thing, but I assume there are people who have made it their life's work to hide executables on Linux, whereas I KNOW there are people who'

  • by argent (18001) <peter@slashdot.2 ... m ['nga' in gap]> on Wednesday December 09, 2009 @08:49PM (#30383502) Homepage Journal

    Security is like sex. Once you're penetrated you're ****ed.

    When you install software, you're having unsafe sex.

    Don't do it lightly.

  • by TractorBarry (788340) on Thursday December 10, 2009 @06:29AM (#30386378) Homepage

    > keep itself updated via downloads

    I keep boring people with this point and I'm going to keep doing so until the Linux peeps get it. Linux needs a program that performs the same function as Zone Alarm. In other words no program on a desktop system should be allowed to connect to the internet before the user has okayed it.

    One of the first things I do when a non tehcnical friend asks me to help with their Windows PC is to install Zone Alarm simply because it will prompt you before a programm cann connect to the network or internet. I then explain that if they don't know what a program is, or why it's trying to connect to the internet, don't let it. You can always change your mind later and you can always google it, or ask me, to find out what the program is and what it does.

    This has stopped numerous malware infestation getting serious (i.e. downloading their real payload) I believe there's very little real malware nowadays that doesn't require 'net access to do it's work (reporting personal information such as credit card details, being a node in a botnet etc.) so having a gatekeeper between programs and the network should be a primary design consideration of all desktop systems.

    Without this functionality it's just a matter of time before the first serious auto updating Linux virus problem occurs. It might well be harder to get a root infestation on a Linux box but does this matter ? A userland program can steal information, participate in a botnet etc. quite adequately for most purposes. If it's well written and consumes little in the way of resources a user probably wouldn''t even notice either.

    On Windows Zone Alarm acts like a nightclub bouncer for 'net access. Meanwhile on Linux any old program gets full internet access without the user knowing a thing.

    • Re: (Score:3, Informative)

      by Bent Mind (853241)

      Linux needs a program that performs the same function as Zone Alarm

      It is called Netfilter [netfilter.org] and it is built into the kernel. For low-level configuration, take a look at the iptables command. Several hundred programs offer "simpler" configuration tools, from command line to GUI. Take a look at the L7-filter for application layer packet classification.

Are we running light with overbyte?

Working...