Malware Found Hidden In Screensaver On Gnome-Look 611
AndGodSed writes "OMG! UBUNTU! Reports the following: 'Malware has been found hidden inside an innocuous 'waterfall' screensaver .deb file made available on popular artwork sharing site Gnome-Look.org. The .deb file installs a script with elevated privileges designed to perform a DDoS attack as well as keep itself updated via downloads. The dodgy screensaver in question has since been removed from gnome-look, and this incident was a very basic, if potentially successful, attempt.'" A similar report at Digitizor.com says that similar malware was also found in a theme called Ninja Black. For those affected, both sites also provide instruction on cleansing your system.
Not more safe (Score:3, Insightful)
It's been told to all the linux zealots so many times that Linux itself isn't really more secure against malware than Windows. It's only so because it's marketshare is like 0.5%, if even that, and it makes much more sense to make malware where the (non-geeky) users are.
This just shows that if ever linux did gain marketshare with casual people enough, the malware problem will be there too. Repositories won't help with that, because people want 3rd party programs and games.
The funny thing about this is the same that as with Mac OS X users. All of the zealots yelling that Linux/Mac OSX are secure about malware, which results in normal people thinking they can run whatever downloaded "because my OS is secure!".
And before everyone jumps on the "but you can't get infected by just browsing on porn sites on linux!", why not? What was the last time you got infected by Windows vulnerability? Those attacks are usually against 3rd party programs like PDF or Flash. And guess what, those apps are on Linux too and are just as well exploitable.
The only reason malware problems are smaller on Linux than Windows is because of the almost-non-existing desktop marketshare and that those who use it on desktop are usually more tech savvy.
This just shows that if Linux had 95% marketshare on desktop, and Windows 0.5%, it would be the same thing but just turned around.
Re:Not more safe (Score:5, Insightful)
The idea behind it is so that someone will put out a patch for said vulnerability without having to wait for parent company to do so...
It's not more secure because of it's market share, it's more secure because anyone can fix it.
Re:Not more safe (Score:5, Insightful)
But that still requires distros to inspect and validate the patches before they go live to repositories. The big part isn't really fixing the code, it's to test that it surely works and doesn't cause problems for users.
And even so, if the vulnerability is in lets say flash, just anyone or distros can't fix that closed source application.
Re:Not more safe (Score:5, Insightful)
The Flash player isn't open source. The Compiler is, the player is not. As I said, the idea behind open source being more secure is that you could have potentially thousands of different solutions to prevent this thing in the future. The best one is chosen and patched into the main tree. If you have the source, you can do this in a few minutes (or put in your own temporary patch) with the proper skill and be back up and more secure than someone waiting for "Patch Tuesday." Even if a patch comes in that resolves that problem, it could have been the first solution to said problem and might have problems itself that will need to be fixed later.
It's really the potential quantity of solutions to the problem.
I could argue with you that this vulnerability might have been fixed sooner with more market share.
Re:Not more safe (Score:5, Informative)
But this is not really about vulnerabilities. This is a screensaver that user downloads from a website. Open source or not, you can't fix that unless the whole system is totally locked down like iPhone. And that doesn't really sound good.
Re:Not more safe (Score:4, Insightful)
You are arguing about ignorance of users, not the security of the OS...
Re:Not more safe (Score:4, Insightful)
Re:Not more safe (Score:5, Insightful)
I have a Windows machine which has been running just fine for years, but that doesn't mean that it's just as secure. If I do get a virus on that machine, there's a greater chance I will be rebuilding it opposed to my Linux machine.
Re: (Score:3, Informative)
In this day and age, if your machine gets compromised by a virus, trojan, or rootkit, the only sensible thing to do is wipe and reinstall from a known clean backup. It doesn't matter what OS it is. There's no telling what other little friends they brought along that your chosen methods of detection didn't find. It's not really an option anymore to keep on going with a system that was compromised.
There's also been some evidence of malware that triggers AV software on purpose, and acts as a distraction while
Re:Not more safe (Score:5, Insightful)
There's also been some evidence of malware that triggers AV software on purpose, and acts as a distraction while the real dirty payload gets delivered silently elsewhere in your system. You are now fooled into thinking your system is clean because your AV caught the distraction virus, completely missing the real one that was also installed.
AVs don't get "distracted" -- either the real payload is detectable by the AV, in which case the distraction won't be successful since both will be found and removed, or else the real payload is undetectable, in which case you don't need the distraction at all, and as a matter of fact it hurts you by making user more security-conscious.
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
/etc might not be the same as the Windows registry (I agree with this statement, /etc is much more manageable), but the gconf registry is looking more and more like it every month. You can say gnome isn't an integral part of Linux, but it's installed on the majority of end-users systems nowadays so for these purposes, it pretty much is...
Re:Not more safe (Score:5, Interesting)
My mother managed to get some nearly-impossible-to-remove scareware on her (Windows) netbook. She swears up and down that she never visited any sketchy sites, had AV (but no anti-malware), etc. She was basically using it for several things:
1) Visiting various newspapers' websites
2) Webmail (a dedicated server for her business)
3) Word processing (OpenOffice.org)
4) Spider Solitaire
5) A few online games (jigsaw puzzles, sudoku, presumably flash-based) she found on Google. I think this is the most likely vector, but she uses the same websites all the time.
6) Visiting certain reputable, ad-free (AFAIK) sites.
She is smart enough to never download/run/open suspicious programs/files/etc and she was using Firefox 3.5. This thing was able to prevent itself from being uninstalled easily. On Linux, she could have simply killed any offending processes (O.K. that's nontrivial, but no root permissions needed in theory) and check the (graphical, so-easy-to-use-a-caveman^H^Hgrandma-could-do-it) Gnome startup programs tool for suspicious entries. On Windows, we eventually had to use "System restore" (an OS feature) -- which the program could potentially have disabled had the malware author thought to do so (it was totally rooted -- the malware was preventing the installation of some anti-malware programs) and then download the anti-malware program that had previously failed to install. Windows Vista/7 are probably more secure than XP which she has, but I'm still reluctant to blame all Windows security issues on user stupidity. Now I have her running Firefox+NoScript so that it (hopefully) won't happen again, but that's mostly because she refuses to switch to Linux. Most users would be running IE7 or so... not Firefox+NoScript. This is clearly not just "user stupidity" -- it's a windows genuine advantage^H^Hbug.
Re: (Score:3, Informative)
Disclaimer: I'm a tech at a work a computer repair shop.
Let me guess: she was running as root. This scareware deleted mbam.exe as soon as the installer unpacked it, and/or had a little icon by the clock that popped a notification balloon every time you started a process saying that it (even taskman) was infected with $SCARY_VIRUS_NAME and killed the process.
Since the middle of October, we've had a wave of clients with this stuff, many whom are running the best AV's (we sell NOD32) and have no idea how they
Re:Not more safe (Score:5, Interesting)
No, even the iphone has vulnerabilities. Locking down a system does not fix vulnerabilities, it only hides them from public view. An open system is more secure as everyone know when a vulnerability is discovered and syadmin's can make work arounds (or even pull the system down) until a patch is developed. With a closed system there is less chance of an exploited vulnerability being discovered by the people who want to fix it or are affected by it.
Re:Not more safe (Score:4, Insightful)
If you have the source, you can do this in a few minutes (or put in your own temporary patch) with the proper skill and be back up and more secure than someone waiting for "Patch Tuesday."
If you want Linux to grow and reach more people, as opposed to being a geek niche, then you should forget about requiring people to have the skills necessary to patch the source. Emergence of malware means only one thing: Linux is growing in popularity. Now, if we wish for its popularity to prosper then we should use the normal user's perspective a little bit; you know, people who can't patch the source and compile it by themselves.
Re:Not more safe (Score:5, Insightful)
If you want Linux to grow and reach more people, as opposed to being a geek niche,
I don't.
For me, Linux is the perfect operating system for a programmer. I'd like it to stay that way. If it becomes popular, that's fine; but if it becomes something other than a programmer's operating system, I will switch to BSD or something.
Re:Not more safe (Score:5, Insightful)
You can make a machine smarter, but people keep getting dumber all the time. At some point you just have to say to those people forget it, you're not going to learn, you're not worth trying to explain it to. Here's your Etch-a-Sketch.
Re:Not more safe (Score:5, Insightful)
Only the tech savvy programmer types that care enough to fix can fix it.
Re:Not more safe (Score:5, Insightful)
Malware doesn't need to exploit vulnerabilities in the software: it only needs vulnerable users. There is no way to patch that.
Re: (Score:3, Insightful)
But there is a way to minimize the impact, correct? Take this vulnerability for example. It might have had an effect on just the one user, but it wasn't going to be able to infect the system folder...
Windows is getting better with this, but a Windows user still has more potential system destructive powers than an equivalent Linux user.
Re: (Score:2)
But there is a way to minimize the impact, correct? Take this vulnerability for example. It might have had an effect on just the one user, but it wasn't going to be able to infect the system folder...
Not true. It affects the system as a whole because packages need root privileges to install.
Re:Not more safe (Score:5, Informative)
But so what if it only gets access to one user? Malware doesn't really need root access. Stealing user data and sending spam is just as possible from user base. In history malware tried to just fuck over the computer which would had required root access, but now its just about sending spam or stealing data.
Re: (Score:3, Funny)
... which has nothing to do with how secure the operating system is, but the profile itself.
Re: (Score:3, Insightful)
(If I didn't have backups) I would rather you ran rm -r /etc/ than rm -r ~/ on my box.
Re:Not more safe (Score:4, Funny)
I was going to comment on your post, but I've set my system to allow the browser to send only 100 cha
Re: (Score:2)
And how many desktop Linux machines even have more than one user?
Re: (Score:3, Informative)
Wrong. They may have multiple user ACCOUNTS but most of them are only going to have one actual meat sack (i.e. USER) at the keyboard.
Re:Not more safe (Score:4, Insightful)
We are not. The whole point is that there is one actual human user, and thus there is zero difference if the malware can spread to other users or not, since it has already infected 100% of the available users.
Re:Not more safe (Score:5, Insightful)
Re: (Score:2)
Re:Not more safe (Score:5, Insightful)
Re: (Score:2)
Yeah, but now that the malware was created, it shouldn't be long before for someone prevents another screensaver from doing this again... that's what I was getting at.
Even if it isn't patched immediately, a Linux screensaver has lower potential of screwing up the entire system folder with it's payload.
Re:Not more safe (Score:4, Insightful)
This particular malware is not because of a security problem with the OS.
Except that if this was a Windows screensaver you can bet it would be blamed on the OS and not on the fact that it was a social engineering attack.
Re:Not more safe (Score:4, Informative)
Re: (Score:3, Insightful)
Re:Not more safe (Score:5, Insightful)
The idea behind it is so that someone will put out a patch for said vulnerability without having to wait for parent company to do so....
It turns out that I have patched a serious vulnerability in Linux. Please download and install my patch as root on your system.
Sincerely,
Someone
Re:Not more safe (Score:4, Insightful)
This just shows that if ever linux did gain marketshare with casual people enough, the malware problem will be there too. Repositories won't help with that, because people want 3rd party programs and games.
Well that's why the goal is to get as much of the third party software into the repository as possible.
Re: (Score:3, Interesting)
And thus you raise the threshold for entry for new third-party software.
Re: (Score:3, Funny)
The argument is that people want 3rd party software, ergo if the repository does not have it then people will go somewhere else for it.
The response to this point is that repositories strive to have as much 3rd party software as possible on them. This would be fine and dandy if there is no raised entry bar, because there could theoretically be enough resources to host every 3rd party program t
Re:Not more safe (Score:5, Insightful)
All it shows is that Linux is vulnerable to trojan horses. ALL operating systems are vulnerable to trojan horses. When you show me a Linux or OS X computer that's vulnerable to something like the slammer worm, get back to me.
Re: (Score:3, Interesting)
Any (good) linux sysadmin knows that there has been many Linux worms in the history. Yes, history. You're also referencing to a 2003 Windows worm here.
Conficker aside, such worms are pretty much in history. Most malware now a days comes via trojans, and any OS can't protect against that unless it's totally locked down (like iPhone)
Re: (Score:3, Interesting)
There's a middle ground that can maximize protection against trojans (of course, nothing can protect against completely unwary users), and that's using something a model where untrusted apps are (whether by running through app-specific accounts or otherwise) required to be given fairly finely grained permissions on installation before accessing resources.
While Linux distros provided
Re:Not more safe (Score:5, Interesting)
Here's an idea. Feel free to agree, disagree, tear it apart, whatever...
Why not have a kernel network access logging module with a userland process that periodically reports to users which programs are accessing the TCP/IP network? Say once a week or once a month or something. The number of programs that do this for many users is quite low. Probably Firefox, Thunderbird, Opera, uTorrent, a short list of other programs. Users then have an opportunity to ignore those programs on future reports. Users now have a good idea if there are changes to their system that might affect security.
There would still be opportunity for malware to access the internet, but users would either 1) notice it or 2) it would make the malware work in very complicated, noticeable ways(like uploading data to a website using a URL).
Re:Not more safe (Score:4, Interesting)
Re:Not more safe (Score:4, Insightful)
That's not the lesson I see. To me it says that a user-based security model are insufficient - apps are too free to call/use each other - the threat has moved from "rooting a box" but rather to "rooting a user". OSes (and users) need to start looking at the user as a system administrator of many threads of personal data.
Web browsers have already discovered much of this - different tabs on your web browser are like different apps and just as a sysadmin cannot trust all the users to play nice with each others' data, users can't trust different apps with full access to all other apps.
Re: (Score:2, Insightful)
Re:Not more safe (Score:5, Interesting)
Except one would hope that you could trust what you get from a site like this. Not everyone can scour the source/binary of every app they get from a 'trusted' site.
And if you cant trust the 'trusted' sites for the free stuff, then the entire FreeOS movement is dead in its tracks.
Re: (Score:2)
Re:Not more safe (Score:5, Interesting)
It looks like it's following the same pattern as Windows malware, too: make a cool screensaver, post it to sharing sites, hope people tell their friends about it. That was a common malware vector for Windows in the early part of this decade. Next there'll be dodgy "codecs" on pr0n sites, and once people start using malware scanners for Linux, they'll make dodgy fake antivirus software to con gullible users. Netbooks may be great for attracting attention to Linux, but we have to remember that this will include the kind of attention that no-one wants.
Re: (Score:2)
The difference is that there isn't a common software repository for windows like there is for Linux. If you want a screensaver for Linux, you can get tons with xscreensaver. For windows, the software ecosystem is much more confusing.
Google's netbook won't even have the capability to install software.
Re: (Score:3, Insightful)
The software ecosystem is "much more confusing" because it's an OS with 95% marketshare and theres millions of 3rd party programs and games for users. And they really want and need those.
Actually it would really suck if Windows had just one Microsoft verified "app store" where everything is controlled like with iPhone.
Re:Not more safe (Score:4, Interesting)
Actually it would really suck if Windows had just one Microsoft verified "app store" where everything is controlled like with iPhone.
Yes it would, and in this would I would add the google repository, and perhaps the apple repository. Anyone could set up a repository (same as you can with debian), and sign their packages, but if they got compromised, or let crap in, then I'd be wary of using them in the future.
The problem with the iphone appstore is there's only one. You cant add a competitors.
Re:Not more safe (Score:5, Interesting)
You kind of have a point, but the fact is, you need root privileges to install a .deb, and I have quite successfully installed gtk/gtk2 themes/icons/etc without admin privileges. If I downloaded a .deb from a random site and then installed it, it would be just like running a .exe on windows, but for most things I need to do on linux, I don't actually have to take that risk, while on Windows it seems everything is a .exe. Not sure about screensavers, but it seems this was, like 90% of viruses for any platform, a hack relying on stupid users elevating the virus to root authority themselves.
Repositories are getting a lot better too, I don't use ubuntu any more but when I left the PPA was in ascendancy, which seemed to allow a much better enforcement of security while still letting 3rd party stuff in.
Re:Not more safe (Score:5, Insightful)
Mod parent up. I know he's AC, but the point he makes is still good: There is no amount of security that can protect your machine from a clueless user.
When you install a theme the normal way, you just drag the archive file - that is to say, no executeable parts, or any way to make the parts executeable - into the theme manager, and presto, it's installed and it asks if you want to apply it. This doesn't require root privilages because it installs to the user's personal themes folder within their home folder. When they do this, there's no way to sneak in a cron job (that's a scheduled task) or any other nasty automatically executing files. Installing from a .deb is usually unneccessary, and as this story proves, exposes your install to risk if you don't pay attention to what you're installing. In my opinion, Ubuntu, being the most newbie-visible Linux distro at the moment, has a responsibility to educate users on things like this. A PDF in their home folder, or a slide show that takes like ten minutes to go through, telling new users how Linux is different to Windows would work wonders, and take up virtually no space on the install disc. There's no excuse for there not being one.
Re:Not more safe (Score:4, Insightful)
Did you just seriously suggest that Ubuntu include a ten minute presentation for users to watch? As in, no sarcasm there? Do you honestly expect anyone to actually sit through that? Most people don't have the attention span to sit through the multilingual Welcome video OS X shows on first-boot without trying to skip it, let alone something that talks about security for ten minutes. Remember, if you can't make the user care enough to look in the address bar to see if the 'PayPal' link sent to them in an email is actually legit, you aren't going to make them care enough to sit through ten minutes of tedium after their install is done.
Re: (Score:2, Troll)
Voluntarily installed malware by using social tactics and the like w
Re: (Score:2)
But the thing is, most malware doesn't even need root access to do it's job. Stealing users data and sending spam works just as well from user base.
Requiring root access is mostly for those who want control over that exact machine, like hackers.
Re:Not more safe (Score:5, Insightful)
I've been telling many the same thing, but with one exception; Mac and *nix have started out with a better permissions system and therefore users who have downloaded an app from the Internet have been trained to be doubly sure about whatever it is that requires sudo power (e.g, the Mac sudo GUI prompt). Microsoft UAC, on the other hand, has had to deal with transitioning software developers to not write in "Program Files" and other public areas and to save data to personal home folders.
While I'll agree with you that Mac/*nix are not any more secure than Windows, the Mac/*nix users have been taught to take a sudo prompt seriously, while in the early stages and growing pains of UAC, Windows users were easily annoyed by UAC prompts and therefore took the UAC prompts less seriously, because UAC prompted were being triggered by transitioning software developers that did not save data in the user's home folder.
In the end, the security of any system relies on the ability for the user to authenticate and verify software downloaded. But making it more difficult, such as requiring an administrator password to be entered for elevated privileges, makes users more cautious of software requiring a sudo prompt. And while that's not inherently any more secure, at least users think twice before entering their password.
Re: (Score:2)
This just shows that if Linux had 95% marketshare on desktop, and Windows 0.5%, it would be the same thing but just turned around.
Absolutely FALSE! The numbers would be closer, but not equal. By definition, you cannot know all the vulnerabilities in "secret source" software, because they are simply not disclosed. This number is surely more than zero. Therefore, all other things being equal. open source will always prevail because the "secret" vulnerabilities will be fixed on OSS, while they still exist in secret source software.
Re: (Score:2)
> And before everyone jumps on the "but you can't get infected by just browsing on porn sites on linux!", why not?
Linux doesn't go out of it's way to do stupid things for a dubious gain in "convenience".
Linux never bought into this idea of blurring the line between data and programs. Linux never encouraged executing random executables from unknown and untrusted sources.
Neither did MacOS, or FreeBSD, or any of the commercial Unixen.
In that regard, merely avoiding Microsoft apps while running their OS can
Re: (Score:2)
Linux can't cure idiocy. But the repositories are a pretty solid base of tools before they start wanting to shoot themselves in the foot. How many people are infected by the time they're done warezing up their computer with "basic" tools like Windows itself, MS Office etc? Quite many. How many people block or are blocked from patches because they're not a "genuine" install? It would help.
P.S. PDF is quite safe, Adobe PDF Reader on the other hand is not but luckily us Linux users in general don't use it. Sam
Re: (Score:2)
Which is a great argument against monoculture, something the "linux zealots" have been warning us about for years.
Re:Not more safe (Score:5, Insightful)
You have a poor understanding of what "malware" is or what Linux/Mac zealots claim.
Malware is piece of code, all OSes run code, therefore all OSes are vulnerable to malware. What Mac and Linux "zealots" claim is that it's not likely to get malware in Linux/Mac just by browsing a site, opening an e-mail, or just by keeping the computer on and connected to the network -- that hasn't changed.
"Repositories won't help with that, because people want 3rd party programs and games."
I am happy with 25,000+ programs available in Debian repository, I never install random package from the Internet. At least the basic packages should be available from the repos so the risk is at least reduced if not eliminated (depending on the behavior of the user)
In my experience people who use the word "zealot" lack arguments.
Re:Not more safe (Score:5, Insightful)
Sorry, this line of argument is stupid.
You're basically arguing that you can't be more secure than Windows -- Windows' security is as good as things will ever get, and everything else only gets less viruses because it has less marketshare.
But if so, why all the security advancements in the latests Windows versions? Why isn't it still using Win95 era security? Why did MS bother coding support for NX, UAC and so on? Well, because turns out, it's possible to do better. Current Windows versions are vastly more locked down than Win95, because some design choices turned out to be stupid and vulnerable.
Linux doesn't follow some common Windows security pitfalls, like having ActiveX and having the browser execute binaries from the net. It also doesn't have autorun. Just that closes several ways of compromising the system, therefore at least in that respect it's more secure. Of course it's not 100% impenetrable, but evidently there exist features and implementation details which make it easier or harder to compromise the system, so not all OSes are equally [in]secure, it depends on how they're implemented.
Re: (Score:3, Informative)
WIndows NT 3.5 existed at the same time as Windows 3.1 and had most of the same security features as Windows 7. The NX bit had not been implemented by Intel, so it couldn't support that, and the UAC stuff is not really needed for security. It's just a shortcut for getting admin privs without logging in as admin.
Really the recent changes in Windows security has been in guiding the user to more secure practices, such as not logging in as admin.
Re: (Score:3, Insightful)
Similar functionality was available in grsecurity long before. Most distros don't ship the vanilla kernel anyway.
No, it doesn't. Ubuntu will ask things like "Would you like to see the files on this CD, or download photos from it?", but that's not autorun. What I was referring to is running binaries from newly ins
Re: (Score:2)
YES! Finally! (Score:5, Funny)
It's the YEAR OF THE LINUX desktop! It's official! /Happy Ubuntu User
Removal instructions from the site (Score:3, Insightful)
Re:Removal instructions from the site (Score:5, Insightful)
This makes me wonder how long it will be before some warning about a fake virus/trojan/worm succeeds in convincing a few Linux newbies to run some command to get rid of the fake malware which inevitably causes damage or actually downloads actual malware. Something along the lines of: "if you've been infected with virus.deb just run the following command: sudo rm -rf / usr/bin/virus" The only cure is education.
Re: (Score:2)
That malware was such a simple script... It could have done boat loads more damage than it did. Lock out the user from sudo by changing the sudoers file, replacing the password hash for root, IN that case just about the only thing that you can do is grab a live cd and fix the problem...
Re:Removal instructions from the site (Score:5, Insightful)
A confusing command line instruction which most people would Ctrl-C and Ctrl-Shift-V into their terminal is actually a pretty good way to get a virus onto a Linux newbie's computer.
Re:Removal instructions from the site (Score:5, Insightful)
Oh, dude. When I'm forced to use a Windows machine my #2 pet peeve is the paste buffer. You don't realize how much middle clicking you do until you don't have it anymore.
Re: (Score:3, Funny)
There is an easier (read: more elegant) way to get rid of this Linux malware:
sudo rm -rf /
Pussies.
rm -rf /
works fine for me!
Repositories! (Score:2)
This is why you only install packages from the repositories.
Re:Repositories! (Score:5, Insightful)
Why? Because it's a sane method of delivering software, which is becoming widely used (i.e. Steam, iTunes Store, etc) vs the traditional "Herpes" model used by Windows?
Re:Repositories! (Score:4, Insightful)
Well do you really want the iPhone like only-approved-software app store for your computer? With no way to download software from anywhere else than that said approved app store.
Re:Repositories! (Score:5, Informative)
No one is being locked into the repositories. If they want they can go elsewhere to get their software. The repositories merely provide a reasonably safe set of software available for the user.
Re: (Score:3, Interesting)
The inherent problem with the iPhone is that you can only go to one store to
auto-update (Score:4, Insightful)
Okay, this scares me.
1. What happens when a publisher includes auto-updating code, but not specific attack code, like the DDoS software in the mentioned examples? If discovered it will appear to be a security risk, but not specifically malicious...
2. What happens when a software developer produces some completely innocuous software, gets into the repositories - and then months down the road, produces an update with DDoS capability, and has the update pushed into the repositories and automatically distributed?
At least it was fixable. (Score:2, Insightful)
Before trolls start yelling about how "OMGZ LINUX ISN'T SECURE HAHAHA" and things like that, let me tell you something: because GNU/Linux is so open and configurable, malware like this can be very easily removed. All you have to do is run a few commands in a terminal to remove this. On Windows and the like, things are so complicated that Anti-virus software is almost required to remove some of their malware. I am glad to use an OS that doesn't restrict me like that. :)
Re:At least it was fixable. (Score:5, Insightful)
Before trolls start yelling about how "OMGZ LINUX ISN'T SECURE HAHAHA" and things like that, let me tell you something: because GNU/Linux is so open and configurable, malware like this can be very easily removed. All you have to do is run a few commands in a terminal to remove this.
Before trolls start yelling about how "OMGZ WINDOZE AV SOFTWARE IS COMPLICATED HAHAHA" and things like that, let me tell you something: because Windows is so accessible, AV software like this can be very easily deployed. All you have to do is click a few icons in the Start Menu to remove this. Blah, blah, blah
On Linux and the like, everything is simple if you already know what you want to do. Otherwise, you have to trust unaccountable internet entities to provide you abstruse commands to run and hope they aren't trying to trick you into doing even more damage to your system. It should be obvious why that is a no way to combat malware.
Re: (Score:3, Informative)
Re:At least it was fixable. (Score:4, Interesting)
And saying the problem is not in the kernel but the software applications doesn't cut it either. The same could be said for many of the windows issues, it's just that the software applications in question are in every install and part of the windows user environment. It's no different than applications that might be part of the ubuntu user environment (gnome, samba, etc) etc.
Phil
Re:At least it was fixable. (Score:5, Insightful)
Ah but here is the problem.
To you, removing a virus from Linux is easy, because you are obviously an intelligent Linux user.
(Someone posted above the removal instructions)
For you to write out: sudo rm -f /usr/bin/Auto.bash /usr/bin/run.bash /etc/profile.d/gnome.sh index.php run.bash && sudo dpkg -r app5552
seems like nothing at all, but what about the average computer user? Do you think they know what sudo is? Hell I don't use Linux and I have no idea what the shit any of that stuff means. So no, that would only work with someone who really knows what they are doing with Linux.
Now on the flip side, you say...
"On Windows and the like, things are so complicated that Anti-virus software is almost required to remove some of their malware"
Ah, but this is going off the assumption that we are dealing with an average Windows user, not an expert user (Such as your self with Linux)
An expert Windows user like myself would say "Removing Malware is easy, just go into the registry's run section, remove what looks suspicious, delete temp files, prefetch, and search for the malware running process (Example: virus.exe) in the registry, and delete it"
Ah see that to me is easy, I've done things like that all the time, and it's just cake.
So I guess the point I'm trying to make is that...To you, removing a virus like this from Linux can be really simple...to someone who knows Linux, but the same can be said to a Windows user...who knows about Windows.
Re: (Score:3, Interesting)
To refute your point: Malware can get its hooks into Windows in a variety of different ways, and removal often requires specialized tools. For example, I had to remove one of those hideous fake-antivirus programs from a neighbor's computer. Real antivirus was no help. MalwareBytes Anti-malware couldn't get rid of it. Going into S
Re: (Score:3, Insightful)
This kind of problem is not about Linux or Windows but about distro that added malware in some crap application. In order to avoid that:
1) The typical crap software should not be allowed the same privileges as a typical user (why an screensaver should open sockets? remove files?) There are capabilities and several security options that nobody takes seriously
2) The package system should allow only a predefined set of actions in the installation process. Currently it runs as root any package' script; that's t
Re:At least it was fixable. (Score:5, Informative)
I'm afraid not. The reason this malware is easy to remove is because it doesn't do anything truly wretched, like patch libc and other applications, install a rootkit kernel module, and the like.
Having dealt with Linux boxes that have been hit by automatic exploitation tools that go well out of their way to hide their presence, I can tell you that no matter what the operating system, the standard advice holds: once the machine is infected, the only sure way to get it back to a known state is to restore from a backup made prior to the exploitation or to wipe it completely and start over. I should also point out that these machines were rooted through the exploitation of previously-patched vulnerabilities in setuid services -- which is the exact same vector many Windows worms use, including Slammer and Conficker.
The only difference between the tools I've run into and a full-on worm is that they run at the command of a cracker and scan IP address ranges of his choice. With a bare amount of automation, they could become very successful Linux worms, breaking into all those machines that, say, have old OpenSSH binaries that haven't been patched against its known remotely exploitable vulnerabilities.
What the summary didn't mention... (Score:5, Informative)
see pro-linux.de [pro-linux.de] (german)
Patch news... (Score:3, Funny)
The Gnome team is working with several university neurology departments to develop a patch for human nature that fixes this problem. It will be included in Gnome 4.
Re: (Score:3, Funny)
Don't you mean "Genome 4"?
Interesting... (Score:3, Funny)
Gnome team is working [...]] to develop a patch for human nature that fixes this problem.
I suspect they've decided that a free will is unusable and will replace it with sane defaults ;)
"cleansing your system" (Score:3, Insightful)
There's only one way to "cleanse" your system of malware once it's infected:
Any malware that can auto-update itself can potentially install anything at all. It could, for example, set up a file-sharing node which caches illegal data files [slashdot.org] on your system.
Re: (Score:3, Insightful)
You forgot to verify the BIOS checksum.
Although most malware probably doesn't go that far, it seems like if I really wanted to "pwn yur box", I'd at least patch rm to not delete my executable and instead simply fool the user into thinking it was gone. Patch ps to not display the process.... and general other rootkit mischief. I'm not terribly familiar with that kind of thing, but I assume there are people who have made it their life's work to hide executables on Linux, whereas I KNOW there are people who'
Security is like sex (Score:4, Funny)
Security is like sex. Once you're penetrated you're ****ed.
When you install software, you're having unsafe sex.
Don't do it lightly.
Linux needs a "Zone Alarm" like program (Score:3, Insightful)
> keep itself updated via downloads
I keep boring people with this point and I'm going to keep doing so until the Linux peeps get it. Linux needs a program that performs the same function as Zone Alarm. In other words no program on a desktop system should be allowed to connect to the internet before the user has okayed it.
One of the first things I do when a non tehcnical friend asks me to help with their Windows PC is to install Zone Alarm simply because it will prompt you before a programm cann connect to the network or internet. I then explain that if they don't know what a program is, or why it's trying to connect to the internet, don't let it. You can always change your mind later and you can always google it, or ask me, to find out what the program is and what it does.
This has stopped numerous malware infestation getting serious (i.e. downloading their real payload) I believe there's very little real malware nowadays that doesn't require 'net access to do it's work (reporting personal information such as credit card details, being a node in a botnet etc.) so having a gatekeeper between programs and the network should be a primary design consideration of all desktop systems.
Without this functionality it's just a matter of time before the first serious auto updating Linux virus problem occurs. It might well be harder to get a root infestation on a Linux box but does this matter ? A userland program can steal information, participate in a botnet etc. quite adequately for most purposes. If it's well written and consumes little in the way of resources a user probably wouldn''t even notice either.
On Windows Zone Alarm acts like a nightclub bouncer for 'net access. Meanwhile on Linux any old program gets full internet access without the user knowing a thing.
Re: (Score:3, Informative)
Linux needs a program that performs the same function as Zone Alarm
It is called Netfilter [netfilter.org] and it is built into the kernel. For low-level configuration, take a look at the iptables command. Several hundred programs offer "simpler" configuration tools, from command line to GUI. Take a look at the L7-filter for application layer packet classification.
Re: (Score:3, Funny)
He scurries in the darkness because he fears the light that is the Sun Source... Sinanju.
So Solaris users are unaffected?
Re: (Score:3, Informative)
X-screensavers includes one that is supposed to reverse the LCD equivalent of screen burn. I run it occasionally. It makes the screen flicker, and will probably hospitalise any epileptic who sees it.