USB Autorun Attacks Against Linux 274
Orome1 writes "Many people think that Linux is immune to the type of Autorun attacks that have plagued Windows systems with malware over the years. However, there have been many advances in the usability of Linux as a desktop OS — including the addition of features that can allow Autorun attacks. This Shmoocon presentation by Jon Larimer from IBM X-Force starts off with a definition of autorun vulnerabilities and some examples from Windows, then jumps straight into the Linux side of things. Larimer explains how attackers can abuse these features to gain access to a live system by using a USB flash drive. He also shows how USB as an exploitation platform can allow for easy bypass of protection mechanisms like ASLR and how these attacks can provide a level of access that other physical attack methods do not." I've attached the video if you are curious. Skip the first 2 minutes if you don't care where the lost and found is.
Stop copying Windows please! (Score:5, Insightful)
Autorun as a concept just sucks.
Copying whatever Windows does, warts and all, into Linux, just sucks.
When is this insanity going to end?
Re:Stop copying Windows please! (Score:3, Insightful)
Yeah, having a computer automatically react to a piece of media... What a stupid idea. Next thing you know they'll be using computers to compute things, and then we've just gone straight to hell.
Re:Oh boy (Score:2, Insightful)
Has there really ever been anyone responsible for Linux making claims of "the year of Linux"? Or has it just been some random users that once made a reference?
Re:Stop copying Windows please! (Score:5, Insightful)
It really depends how you do it. It's one thing to go the UAC route and have the computer notify the user that something has been inserted and request authorization to do something, and quite another to make that decision for the user. Certain actions really shouldn't be allowed to be completed completely on their own, autorun is definitely a candidate for that.
Re:Stop copying Windows please! (Score:5, Insightful)
87.3% of all the biggest forehead-whapping Windows security bugs have come from Microsoft's (really Bill Gates) love of whizzo features that look really cool in a developers conference keynote but don't survive the first three minutes of critical thought or exposure to the real world.
I'm specifically referring to things like where IE or Windows Explorer execute code of unknown provenance to provide "previews". Windows Explorer once had a bug which could execute arbitrary code via JPEG preview. Of course, the Outlook preview exploits are LEGION, but we can also include VB macros included in Word and Excel "data" (hahaha) files. Only a sick love of flashy features, consequences be damned can account for this.
Re:The price of easy and automatic (Score:4, Insightful)
Shoot him.
Exactly (Score:2, Insightful)
MS *tried* to fight it (in part) by effectively adding a GUI sudo prompt into Windows Vista. A million people -- including Linux users posting on Slashdot -- immediately flew into fits of nerd rage about how annoying it was to have a GUI sudo prompt. (I never saw an issue with it myself, actually. Seemed no more irritating than going sudo on Linux or OSX's own authentication prompt. Unlike many, I actually really quite liked Vista, although I use OSX most of the time.) MS listened to their users and allowed them to scale it back in Windows 7, creating a million new security holes and causing a million people -- including Linux users posting on Slashdot, although not necessarily the same ones -- to complain about security flaws in Windows.
MS have made many stupid mistakes over their history and not least due to the ancient and creaking XP (and, even worse, the immediately-owned ME) have a history of shit security. Thing is they tried to patch it up in an easy way and people bitched and puled enough that they had to make it less secure again.
That, of course, ignores the other few million security flaws riddling the kernel. I'm just talking about the UAC here.
Flawed Linux security model (Score:2, Insightful)
Linux still has the antiquated "user, group, everyone" security model from the 1970s. By now, we know that outside data can't be given all the privileges of the user. But Linux's legacy security model is so deeply embedded in the UNIX/Linux world that it's almost impossible to get beyond that.
Yes, there's SELinux. But there isn't a whole distribution with a full range of applications which can run under a mandatory security model.
Re:Stop copying Windows please! (Score:4, Insightful)
The presenter in TFV says that because autorun always prompts the user, it's not a big security risk. He spends much more time talking about exploiting bugs in various software layers, including kernel, root-running userspace, and normal user processes.
I'm not sure that I agree that always asking permission to autorun something is safe enough, but it is far less onerous than how Windows used to work.
Looks like WTFV is harder than RTFA (Score:4, Insightful)
Unless we're all conflating "autorun" with "automount & show the media in a file-manager" now?
Re:Exactly (Score:4, Insightful)
If you are referring to UAC, it is hardly a "GUI sudo prompt." sudo requires you to prove that you are an authentic user by providing your password each time you open a shell to perform an administrative task (and every fifteen minutes after), and you also have to be a member of the sudo group (which only the first account created at install time is by default).
All UAC does is basically confirm with whomever is currently sitting at the computer (authorized or not) that they initiated some arbitrary action. This is also useful, in that it prevents some web site from installing a piece of malicious software without the user's knowledge, but it is far from a "GUI sudo prompt."
This is the reason it was met with derision by Slashdotters (and I don't recall many "fits of nerd rage," although a few might have snorted Code Red through their noses when they realized how impotent - and easily disabled - this new Microsoft "security feature" was).