Damn Vulnerable Linux — Most Vulnerable Linux Ever 227
An anonymous reader writes "Usually, when installing a new operating system, the hope is that it's as up-to-date as possible. After installation there's bound to be a few updates required, but no more than a few megabytes. Damn Vulnerable Linux is different; it's shipped in as vulnerable a state as possible. As the DVL website explains: 'Damn Vulnerable Linux (DVL) is everything a good Linux distribution isn't. Its developers have spent hours stuffing it with broken, ill-configured, outdated, and exploitable software that makes it vulnerable to attacks. DVL isn't built to run on your desktop – it's a learning tool for security students.'"
Wait, so I shouldn't have used that at work? (Score:5, Funny)
Don't tell my boss.
Re:Wait, so I shouldn't have used that at work? (Score:5, Funny)
Don't worry, it's still safer than the Windows servers you run.
Re: (Score:2, Insightful)
Yes the random poke at Microsoft...
Lets stay blind dumb and happy with our Linux.
Linux isn't any more secure then Windows is. However Linux users like to get bragging rights because they release fixes to security glitches fixes (a good thing) much faster then Windows does. However security patches isn't the only thing...
Usually the reason for most Vulnerabilities in Windows is due to stupid Administration. Being that windows is easier to maintain by the average joe, means that a lot of Windows Server Net
Re: (Score:3, Interesting)
Pretending you are secure using DSL is just stupid.
Your PC will be owned in 24h or less(how many rootkits are installed by default?). My web and ssh servers get attacks searching for common vulnerabilities constantly since the day I started them and they aren't even live yet. If they had been running any vintage version of Linux it would have been automatic pwnage.
I wonder if streaming a Tb or two of good quality PRNG data into a bot or a "security researcher"'s computer would get me into any problems. They
Re: (Score:2)
Come now, Microsoft has enough market share and billions of dollars that they don't really need you defending them. And as for security, the reason Linux is more secure than Windows has to do with the security model more than the actual software. Linux IS more secure than Windows, there is no doubt. People like to say it is because "People don't write viruses for Linux, just Windows" not realizing that it is much more difficult to write viruses/trojans for any Unix type system as it has security built in
Re: (Score:2)
1. It isn't defending Microsoft it is trying to make sure the Linux Users are aware of the security to prevent them from being blind sided.
2. Is it really that difficult to write a virus/trojan for linux... No not really... Most Linux distributions have a huge of scripts/python/perl code for a lot of the apps, at least to get them to start.
So you make a script say a Python or Bash Script. That searches for files using find and grep that have the same interpreter you are using. Inject the Source for this sc
Re: (Score:3, Insightful)
Being that windows is easier to maintain by the average joe
Obviously it is not. It is easier to fuck up. That's a different thing altogether.
Re: (Score:3, Interesting)
A few years ago, around 2006/7, I worked in a (UK) school doing IT support. One of the guys in the science department was some kind of Linux geek. He had a Red Hat server running on the school network for some reason or other, I forget what, and he had requested and been given an external IP address on the network so that he could get in from home and do... whatever.
So, one day the big talk is that the local education authority, who provided the Internet connection, have been getting calls from the US Dep
Re: (Score:2)
Re: (Score:2)
Re:Wait, so I shouldn't have used that at work? (Score:5, Funny)
Such as?
The ability to run the Malware he writes for fun and profit. Ok... mostly profit...
Re: (Score:2)
Or I guess I could just say "woosh".
Re:Wait, so I shouldn't have used that at work? (Score:5, Funny)
Re: (Score:2)
I bet they run in Wine!
Re: (Score:2)
I bet they run in Wine
Heh ok.... I'll take that bet...
Or (Score:5, Funny)
Re:Or (Score:5, Funny)
Ebola or AIDS. Choices!
Re: (Score:2)
Ebola. You're either dead or cured within two weeks. With AIDS, you linger and die slowly for years, as well as spread the damn thing.
In computer terms, a crash right away is better than a buffer overflow resulting in memory corruption and malware infection which makes your macine a part of a zombie network that keeps selling people illegal Viagra and spreading the infection. This is why managed environments are superior and should be used whenever possible.
Ebola is better than AIDS,
Re:Or (Score:5, Interesting)
Re:Or (Score:4, Insightful)
To be fair, if you download run random stuff from the web, your Linux computer isn't too secure either.
Re:Or (Score:5, Insightful)
To be fair..
most malware available for download on the web is designed to be run on windows
It doesn't do anything much less run in linux
Windows is such an easy target for exploit and success, it's everywhere and run by every bone-head idiot on the planet
Linux on the other hand is most used by advanced individuals and can be very difficult to exploit making it a waste of time for the black hats, it can be done, but rarely successful
Re:Or (Score:5, Insightful)
That's not the point. The point is that even if OS security were perfect, there would still be machines which were completely fucked. No amount of OS security will stop the user from wanting free kitten screen savers.
This doesn't excuse vulnerabilities that do exist in operating systems, but since Co0Ps specifically mentioned that he/she was actively agreeing to download certain pieces of malware, it bears mentioning.
Re:Or (Score:5, Insightful)
You know, I'm going to get flamed to hell and back for this, but if you download (ie, buy a free app of) free kitten screensavers in iOS, you will likely have no security impact to your device... some (lots of) folks just can't be trusted outside walled gardens, and that's why Apple is doing so well.
Re: (Score:2)
ChromeOS takes that route too, by allowing only webapps.
Re:Or (Score:4, Insightful)
Re: (Score:2)
any OS thats usable is going to have susceptible to PBKAC. If the user is able to make and run executable, send and receive over the network, create and delete files, then malware is also going to have that ability. Yeah malware won't be able to mess with stuff in /usr/bin or /etc, but if can send out spam, delete all the files in your home directory, screw with your video settings, etc.
Yeah, sure your linux system will reliably boot up no matter what a user does. But is anything going to work after the use
Re: (Score:2, Interesting)
That's not the point. The point is that if you actively download and run random stuff from the web, it doesn't tell much about the security of the OS if you get lots of malware.
However, I can imagine that the first sort of widespread malware on Linux will be cross-platform Firefox extensions. It shouldn't be too hard to write an extension that does something users want, but also contain some malicious code. That code would have full access to anything you browse, including your banking site and all password
Re:Or (Score:5, Informative)
Re: (Score:2)
Or at the very least, from behind a hardware firewall/router.
Re: (Score:2)
NAT has only been the standard for about the last 10 years or so. Prior to that, a LOT of desktop PCs were connected directly to the Internet with publicly routable IPs and no firewall.
Re: (Score:3, Informative)
I saw this happen with a 3 KB/sec dial-up connection too! It was nuts. My friend was wondering why his new XP Pro. downloads were so slow.
Re: (Score:2)
I'm no fanboy but a $20 Netgear Router also would have prevented that.
Re: (Score:2)
viruses please. And octopuses, platypuses etc.
Re: (Score:2)
yeah but you sound like a douche when you use octopi or octopodes.
if you use "virii", you not only sound like a douche, you're also wrong. "virii" is not a valid plural of virus.
Re: (Score:2)
Have you ever used IE? You do not need to accept anything, it all installs automatically. Plug and Play so to say, the way MS intended it.
P.S. Hint: in XP, IE has ActiveX on by default. IOW it would happily run any legit-looking binary code code off net without even telling the user.
Re: (Score:2)
Or use a fresh install of XP.
Yeah but this is a learning distribution for security students. "Download this script-kiddie tool and point it at the XP machine's IP address" doesn't allow for much learning and understanding...
Big deal (Score:4, Funny)
So it's like Fedora then.
Re:Big deal (Score:5, Insightful)
Re:Big deal (Score:5, Funny)
Why is the OP - who is denigrating a Linux distro - modded a Troll, whereas the poster above him - denigrating Windows - modded as Funny?
You must be new here.
Re:Big deal (Score:5, Insightful)
Don't be obtuse, he raises a good point. Linux is not infallible and shouldn't be treated as such even in light of it's advantages and the personal support we all have for it. Criticism breeds improvement. Keep that in mind, mods.
Re: (Score:2)
Constructive criticism said sans doucheiness breeds improvement.
Criticism said to build oneself up breeds contempt.
Re: (Score:2)
A lack of exposure to criticisms breeds preciousness and a thin skin. Mods should also keep that in mind before sending a comment to -1 hell.
Re:Big deal (Score:5, Funny)
Re:Big deal (Score:5, Funny)
Only if you hold it right.
Re: (Score:2)
Ok, that comment made my day. I'm no OS hater, rather I prefer when people are open-minded.
Re:Big deal (Score:5, Insightful)
Did it occur to you that the more experienced/advanced/technical users who tend to gravitate towards Linux are very much aware of this, that they administer their systems accordingly, and that this is in fact a big reason why successful malware "in the wild" is all but unheard-of on this platform? Compare to "buy the next version of Windows, it's easier and more secure than ever!" that carries the strong implication of "oh, security is someone else's problem". Not noticing or appreciating that difference would also be obtuse.
What I am getting at is that there are both technical and cultural differences between the two platforms.
Re: (Score:2)
Did it occur to you that the more experienced/advanced/technical users who tend to gravitate towards Linux
The proportion of naive users has grown a lot over the last few years, but the amount of malware has not (at least not in proportion)
Re: (Score:2)
1. Linux is still vulnerable through software the user runs. Vulnerabilities in popular browsers are still exploitable (Chromium, Firefox, Opera) etc. This doesn't give you low level access to the users system, but there is a helluva lot you can do once you've taken over a browser's running instance. (But Chrome has done a lot of work around sandboxing to address this).
2. It's not necessary to have root to do a lot of damage - anything the us
Re: (Score:2)
6) Stopped for me when I changed the port from the default.
Re: (Score:2)
But compared to Windows, it actually looks infallible. It’s like multiplying a very large number stored as floating point with a very small number. It won’t change the very small number because the small one is to small and it can’t compute. ^^
Re: (Score:2)
Re:Big deal (Score:5, Insightful)
Criticism, even if inaccurate?
You can still run a multiple-year-old and barely-updated Linux distro on a public network and not fear being exploited. Sure, it can happen, but I'll be honest in saying the only times I've seen a Linux machine exploited was when it was horribly out of date (2.0 kernel in the early 2.6 kernel days) and was running samba... on a public network. That said, the exploit employed was over 6 months old at the time when the machine got exploited.
Unless you're running a PHP based CMS or the like, it's pretty uncommon for a Linux machine to get exploited. PHP = bad.
Re: (Score:2)
You're right, it's not infallible. If a (l)user falls prey to the Dancing Bears Problem, their machine is going to be just as r00ted as the Windows box sitting next to it.
What Linux has is (relative) obscurity and a decent security model. Want to change a system setting? Root password pls. Want to install software in /usr or /opt? Root password pls. You get the picture.
The issue is that Windows makes it impossible to get any real work done (besides word-processing and that sort of thing) on a standard User
Re: (Score:3, Informative)
Re: (Score:2)
Well, to be fair, the statements about Windows and Fedora weren't really criticism, they were jokes playing to the common meme of Windows being insecure and the far less common meme of Fedora being insecure (that's why the Fedora joke got modded troll until someone came along and yelled at the mods).
Re: (Score:2)
Because Fedora is no laughing matter.
Re: (Score:2)
that's what she said.
Re: (Score:3, Insightful)
Why is the OP - who is denigrating a Linux distro - modded a Troll, whereas the poster above him - denigrating Windows - modded as Funny?
That has since been modded some more and now sits at +4 Funny at the time of this post.
Had he denigrated Apple or its products, it would have gone down to -1 and remained there.
Re: (Score:2)
Re: (Score:2)
Because a fresh Fedora install is orders of magnitude safer than a fresh Windows install.
Re: (Score:3, Informative)
Re: (Score:2)
No, not too far. Just about 10 years.
Re: (Score:2)
Great Learning Tool (Score:5, Informative)
Security study DVL (Score:5, Funny)
A notable team of security researches are suggesting windows users migrate to a platform known as DVL. "DVL is a mess. It is vulnerable to a variety of attacks, but it is still more secure than the average windows install". Another researched pointed "Windows users must migrate to DVL immediately, in order to protect their computers".
While several independent research groups are considering DVL as a valuable alternative to windows, Microsoft didn't stay behind, and promised to use DVL as the base of Windows 8, the upcoming version of windows. A spokesperson for Microsoft notified that microsoft decided to use DVL after thoroughly analyzing it, "It provides a great building block for the next release of our greatest product, DVL certainly fits like a glove within our strict security and QA policies".
Windows 8: DVL Edition, the most secure windows version ever released, is scheduled to hit the shelves next summer.
Re: (Score:3, Interesting)
Heheh, previous story says:
"More than a year after Microsoft issue a patch to cover privilege escalation issues that could lead to complete system takeover, a security researcher plans to use the Black Hat conference spotlight to expose new design mistakes and security issues that can be exploited to elevate privileges on all Windows versions including the brand new Windows 2008 R2 and Windows 7."
Re: (Score:2)
Re: your sig...Try reading this one, instead...
Structured Procrastination [structured...nation.com]
Re: (Score:2)
Very interesting. Thanks for the link.
I am an awful procrastinator, but I do get things done, usually in a very similar fashion to the one explained in the link, many times even staying on-project. I usually split up projects into its parts, and when I get bored and try to avoid writing complex functions, I do interface work, or write a generic library to do $task, and generally procrastinate within a project by doing other parts that are not the major work that I had pending at the moment. This proves even
How long ? (Score:5, Funny)
till Microsoft uses it in get the facts comparisons?
Re: (Score:2)
Re: (Score:3, Interesting)
A while back, IIRC, there was a story about the different ways that vulnerabilities are counted in Linux vs. Windows. There have been various MS-sponsored "studies" which sum the total number of vulnerabilities for all distros, so that if, for instance, the same vulnerability exists in Debian and Fedora, it's counted twice. (Likely much more than twice, since if it's in Debian, it's probably in all the Ubuntus too.) Meanwhile, of course, Windows vulnerabilities only get counted once. So don't be at all
what about a weird-arch linux? (Score:5, Interesting)
Like something with 16bit chars and ints, non-0 NULLs... Perhaps running under an emulated invented weird architecture with strange byte order (non-LSB/MSB) and weird alignment issues.
I wonder how many software would break.
Re:what about a weird-arch linux? (Score:5, Interesting)
architecture with strange byte order (non-LSB/MSB)
You mean like the PDP-11 [wikipedia.org]?
0x11223344 was stored in memory as 0x33 0x44 0x11 0x22
I did it all for the NUXI (Score:2)
0x11223344 was stored in memory as 0x33 0x44 0x11 0x22
I did it all for the NUXI [catb.org] (come on) the NUXI (come on) [wikipedia.org]
So you can take that cookie and stick it up your (yeah) [collegehumor.com].
Re:what about a weird-arch linux? (Score:4, Informative)
And the PDP-10 had bytes in any size from 1 to 36 bits [wikipedia.org].
Re: (Score:2)
> Something philosophically similar
Maybe, but for me "weird arch" Linux equals security through obfuscation. I know it doesn't qualify as real security but "security through obfuscation" has saved our asses a few times against zero-day exploit or more like "less than 1 day exploits" I should say. In our case, "obfuscation" is just using custom configurations, chrooting things, using reverse proxies and limiting reachable URL. etc.
Just changing the default admin username on things like MySql, FreePBX, Joo
Re: (Score:2)
> Something philosophically similar
Maybe, but for me "weird arch" Linux equals security through obfuscation.
The grandparent was not discussing security at all, but rather a distro "for code debugging purposes". I know you just learned about security by obscurity and how to modify /etc/passwd from reading a blog today and can't wait to use this new knowledge, but your multi-paragraph was kind of silly.
Re:what about a weird-arch linux? (Score:4, Interesting)
If you are feeling really insane, some UNIX operating systems can dispense with root altogether, even past having it disabled for logins (like how OS X has it present but not usable until explicitly turned on). AIX 6.x has the ability to completely chuck root (where stuff running as UID 0 is essentially running as nobody with no privs whatsoever), and what would have been handled by the superuser is handed off to other users as roles. Of course, if a critical role isn't defined before root gets stripped of its mantle of rulership, well, have fun rebooting to install media or to a NIM server and fixing that.
Some UNIX variants don't care a bit if the user root is renamed. Others will choke and give up the ghost. Ideally it would be nice to rename the root user (and put a dummy user named root just for kicks, similar to how Windows admins worth their salt have a bogus Administrator user with insane amounts of logging enabled), but it is hard to tell which UNIX variants don't care, and which will be really unhappy.
Maybe the best of all worlds is to have SELinux-like ACL policies be made into an easier pill to swallow. For example, a Web browser should not have access to a user's .xinitrc, .profile, .bashrc, or other files. If a policy enforces this, even if a Web browser is completely compromised, there is no way a blackhat can install software running in the browser's context that would start on a login, nor even with a valid su or sudo password, would ever get to a "#" prompt. By focusing on isolating applications, a system can be partially compromised, but not completely taken over, unless the security problem lies in a critical subsystem like ssh/sshd where it really can't be put into a fenced in playground.
As for obfuscation, it does work against script kiddies, but a blackhat worth his salt will eventually go through the IP range and find that one randomly named server is listening on port 80 and 443, and communicating with some other box via some ports that are usually for Oracle. Security through obscurity is not a good solution in the long run.
Re: (Score:2)
Re: (Score:2)
Well, POSIX requires CHAR_BIT to be 8, so if you change that it's normal if it breaks.
But otherwise to test portability this seems interesting, although it would be most interesting if it could detect when something isn't done right.
Most importantly though, you'd need a compiler to target this architecture.
For instance, NULL being 0 is usually not part of the computer architecture itself; 0 is addressable on x86, causing this bug:
http://lwn.net/Articles/341773/ [lwn.net]
Re: (Score:2)
Your imagination is weak! How about...
Honey Pot Module coming up next week. (Score:5, Informative)
We are working on a honey pot module for Damn Vulnerable Linux, it should be coming out soon ;-)
Basically log all activity to a network server while hiding the fact that we are doing it. Just refresh from a fresh image once in a while. Once an intruder is noticed, we can give him as many rights as we want in real time, especially with regards to network connectivity, which is done at the firewall level. It is a nice way to get a good grip of what is running in the wilderness of the internet. If you are lucky enough, you can even learn about unpublished exploits although I would use a up to date distro to specifically discover these.
Re: (Score:3, Funny)
Chances are the user will even get Chinese lessons free of charge. ;)
The Year of Linux (Score:2)
This will bring Linux to the desktop!
Re: (Score:2)
so if one were to do this with bsd... (Score:3, Funny)
would it be ClosedBSD?
Re: (Score:2)
Are the reviews in? (Score:2)
Microsoft's Linux vulnerability stats (Score:4, Insightful)
You just know MS is going to count the vulnerabilities in this distro against Linux just like how they count one vulnerability which affects 10 distros as 10 vulnerabilities because 10 warnings get sent out.
Semi-dupe (Score:5, Insightful)
This was in the list of "most interesting linux distros" posted here maybe two weeks ago. Sigh.
Re: (Score:2)
Not to mention DVL has been out roughly forever in computer terms anyway.
And Redmond rejoices! (Score:2, Funny)
Now they have something they can favorably compare themselves against!
"This Linux has all these bugs in it and they haven't repaired ANY of them!"
Not just for students (Score:2, Insightful)
At my last job, the "boss" was too cheap to purchase a descent VPN solution (I later convinced him to buy a Cisco ASA5520), so I deployed a series of IPCop servers... one as a firewall and one as a VPN server. Between the firewall and VPN Server I had fronted an old Pentium 2 based Windows 2000 server in the DMZ to give the appearance that an attacker, had they gotten through, would have figured they hit the "honeypot". I ran this configuration for almost a year and had one attacker get through because I ha
Re: (Score:2)
Re: (Score:2)
A good rule of thumb is that you know you packed too much if your retinue for carrying your luggage needs more food per meal than one person can carry alone.
Re: (Score:2)
Basic knowledge for whom?
I'm not the most technical guy around, but I try to keep up on things (certainly WRT Linux, as it's my main OS), and I'd never heard of it. Of course, I'm not in school studying security concepts either, so there ya go.
Re: (Score:2)
DVL is mentioned quite regularly when the topic of securing Linux or webservers in general comes up or in topics discussing specialized distributions.
IIRC he last Slashdot article where it was explicitly mentioned was less than 3 weeks ago.
And I develop web applications for a living. Certainly not a Linux security expert but one has to have at least some knowledge of the tools of one's trade. ;)
Re: (Score:2)
Apple will *always* have its fans to prop the company up, at least marginally.
Back during the Scully era I had a co-worker that worked on a Quadra, and no matter how many times a day we'd all hear the "
Re: (Score:2)
I was thinking it might be fun to make a linux distro like this. I would have called it "OpenLinux - Opening your Systems to the World!"
The possible logos just draw themselves.
Goatse.. (Score:2)
Enough said, I think. It'll take a while to get rid of that image.. :)