Re: [PLUG] Linux Virus Writing HOWTO

[Tobias DiPasquale <anany@ece.villanova.edu>]

On Sat, 2002-03-16 at 19:21, Michael Leone wrote:
> On Sat, 2002-03-16 at 23:56, Tobias DiPasquale wrote:
> > On Sat, 2002-03-16 at 11:20, Michael Leone wrote:
> > > On Fri, 2002-03-15 at 08:37, Arthur S. Alexion wrote:
> > > > 
> > > > Is the real reason *nix is relatively spared virus problems practical 
> > > > rather than technical?
> > > 
> > > What about Win2000, then? It's security model tries to come close to a
> > > Unix model, with user accounts deliberately kept separate from the
> > > "root" user.
> > 
> > Unfortunately, you still need to have Administrator privileges to do
> > anything worthwhile on Win2K, as well as Win.NET Server/XP. You cannot
> > install any programs (since InstallShield just *HAS* to screw with the
> > Registry), 
> 
> I've installed software as "Power Users" before; they're less than
> Administrator.

Power Users are administrators that can't change system files. (well,
not without knowing the trick, that is) That's the only difference.

> 
> > nor change any system-wide environment variables nor start
> > any service without having administrator priviledges. 
> 
> Can't services start as specified administrative users, while users log
> in as themselves? User accounts can't start services, not as themselves.

Yes, but you have to be an administrator to *install* a service to being
with. You cannot make changes to anything in the Component Services
panel without being an administrator.

> 
> > In UNIX, none of
> > these are true, since I can install StarOffice or XMMS or any other app
> > in my home directory if I feel like it. Those ACL schema in Win2K are a
> > good idea, but Microsoft misimplemented them and they are going to
> > waste.
> > 
> > > And the newer viruses come with their own SMTP engines these days,
> > > meaning that Outlook is not required.
> > 
> > Which viruses are these? I worked at an anti-virus company and I never
> > saw one of these... names would be appreciated.
> 
> http://securityresponse.symantec.com/avcenter/venc/data/w32.impo.worm.html
> http://securityresponse.symantec.com/avcenter/venc/data/w32.gibe@mm.html
> http://securityresponse.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html
> 
> -- 
> 
> PGP Fingerprint: 0AA8 DC47 CB63 AE3F C739 6BF9 9AB4 1EF6 5AA5 BCDF
> PGP public key:
> <http://www.mike-leone.com/~turgon/turgon-public-key.gpg>
> 
> The secret of flying is simple: Throw yourself at the ground and miss.
-- 
<< T o b i a s   D i P a s q u a l e >>
anany@ece.villanova.edu | tdipas01@villanova.edu | toby@khenry.com

Of course, in order to partially emulate an ASR-33, you could perhaps
connect an 
IBM selectric up to your computer while running a looped recording of
gunfight 
and an idling 58 chevy with one blown piston. For the final touch, you
could replace 
the room's light switch with a dimmer switch and wiggle it back and
forth whenever 
you are printing something out.

-- Anonymous Coward, SlashDot, commenting about Caldera's release of
some 
   original UNIX sources

Attachment: signature.asc
Description: This is a digitally signed message part