Michael Leone on Sun, 17 Mar 2002 00:21:38 -0500


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] Linux Virus Writing HOWTO


On Sat, 2002-03-16 at 23:56, Tobias DiPasquale wrote:
> On Sat, 2002-03-16 at 11:20, Michael Leone wrote:
> > On Fri, 2002-03-15 at 08:37, Arthur S. Alexion wrote:
> > > 
> > > Is the real reason *nix is relatively spared virus problems practical 
> > > rather than technical?
> > 
> > What about Win2000, then? It's security model tries to come close to a
> > Unix model, with user accounts deliberately kept separate from the
> > "root" user.
> 
> Unfortunately, you still need to have Administrator privileges to do
> anything worthwhile on Win2K, as well as Win.NET Server/XP. You cannot
> install any programs (since InstallShield just *HAS* to screw with the
> Registry), 

I've installed software as "Power Users" before; they're less than
Administrator.

> nor change any system-wide environment variables nor start
> any service without having administrator priviledges. 

Can't services start as specified administrative users, while users log
in as themselves? User accounts can't start services, not as themselves.

> In UNIX, none of
> these are true, since I can install StarOffice or XMMS or any other app
> in my home directory if I feel like it. Those ACL schema in Win2K are a
> good idea, but Microsoft misimplemented them and they are going to
> waste.
> 
> > And the newer viruses come with their own SMTP engines these days,
> > meaning that Outlook is not required.
> 
> Which viruses are these? I worked at an anti-virus company and I never
> saw one of these... names would be appreciated.

http://securityresponse.symantec.com/avcenter/venc/data/w32.impo.worm.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.gibe@mm.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html

-- 

PGP Fingerprint: 0AA8 DC47 CB63 AE3F C739 6BF9 9AB4 1EF6 5AA5 BCDF
PGP public key:
<http://www.mike-leone.com/~turgon/turgon-public-key.gpg>

The secret of flying is simple: Throw yourself at the ground and miss.

Attachment: signature.asc
Description: This is a digitally signed message part