Tobias DiPasquale on Sun, 17 Mar 2002 00:01:53 -0500


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] Linux Virus Writing HOWTO


On Sat, 2002-03-16 at 11:20, Michael Leone wrote:
> On Fri, 2002-03-15 at 08:37, Arthur S. Alexion wrote:
> > 
> > Is the real reason *nix is relatively spared virus problems practical 
> > rather than technical?
> 
> What about Win2000, then? It's security model tries to come close to a
> Unix model, with user accounts deliberately kept separate from the
> "root" user.

Unfortunately, you still need to have Administrator privileges to do
anything worthwhile on Win2K, as well as Win.NET Server/XP. You cannot
install any programs (since InstallShield just *HAS* to screw with the
Registry), nor change any system-wide environment variables nor start
any service without having administrator priviledges. In UNIX, none of
these are true, since I can install StarOffice or XMMS or any other app
in my home directory if I feel like it. Those ACL schema in Win2K are a
good idea, but Microsoft misimplemented them and they are going to
waste.

> > I feel that even my windows computer is safer than most since I don't have 
> > Outlook installed.  I've lost count of the times a virus has infected a 
> > list to which I subscribe, only to find that nothing happens to my system 
> > running either Eudora or Pegasus (with all the Outlook features turned off).
> 
> Well, doesn't Eudora use the underlying IE HTML engine to display HTML
> messages, and therefore is still (somewhat) susceptible to the
> HTML-based viruses?. I think Pegasus *can*, but does not have to, make
> use of IE to display HTML email.

It's not the HTML engine that needs attention. It's the fully-scripted
environment that is causing all the trouble. Remove VBA from Office apps
and most of these viruses disappear.

> And the newer viruses come with their own SMTP engines these days,
> meaning that Outlook is not required.

Which viruses are these? I worked at an anti-virus company and I never
saw one of these... names would be appreciated.
> -- 
> 
> PGP Fingerprint: 0AA8 DC47 CB63 AE3F C739 6BF9 9AB4 1EF6 5AA5 BCDF
> PGP public key:
> <http://www.mike-leone.com/~turgon/turgon-public-key.gpg>
> 
> The secret of flying is simple: Throw yourself at the ground and miss.
-- 
<< T o b i a s   D i P a s q u a l e >>
anany@ece.villanova.edu | tdipas01@villanova.edu | toby@khenry.com

Of course, in order to partially emulate an ASR-33, you could perhaps
connect an 
IBM selectric up to your computer while running a looped recording of
gunfight 
and an idling 58 chevy with one blown piston. For the final touch, you
could replace 
the room's light switch with a dimmer switch and wiggle it back and
forth whenever 
you are printing something out.

-- Anonymous Coward, SlashDot, commenting about Caldera's release of
some 
   original UNIX sources

Attachment: signature.asc
Description: This is a digitally signed message part