From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 809571381F3 for ; Sat, 6 Jul 2013 11:33:47 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id CD4D5E09AF; Sat, 6 Jul 2013 11:33:39 +0000 (UTC) Received: from mail-vc0-f180.google.com (mail-vc0-f180.google.com [209.85.220.180]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 9B32CE096D for ; Sat, 6 Jul 2013 11:33:38 +0000 (UTC) Received: by mail-vc0-f180.google.com with SMTP id gf11so2209853vcb.39 for ; Sat, 06 Jul 2013 04:33:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=AHPgKVwvLgIsjyR+h0dgKB9Ns6kZd0V0XyXgGdKYVHU=; b=RG4vDu1oXBX6L+cM2SSfQXwIGpcz4Re/Athps+bCp/yyK835k4yBh75AzHGR9iCBSq p/DexHBHnWX8j6QIleE3XvMfxpxf4P9AHWKzQItuAEHaB/57X+3ZRh8BzXb3pO1HW4LX VagfrWrscn1Uwo2I2oN3Ut4ncM/HUv2tPB+qszw3egWl+yBMVYhOyQMpOy/CYnJ3f0/L oqo+zIvCnUhoTOYWMVAJbzlkRZQdbUa6bHv21VcuPPpbVPiY4WwGBk/4slXa4zJqyupr KIQ2ymwkVWj+p48Yc62QCXgStfq2xDEOtKfSjbnu7M8YuZNC/7yKFkzymlufGlXl9L0I nFwg== Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 X-Received: by 10.59.9.69 with SMTP id dq5mr9664880ved.87.1373110417618; Sat, 06 Jul 2013 04:33:37 -0700 (PDT) Received: by 10.52.116.72 with HTTP; Sat, 6 Jul 2013 04:33:37 -0700 (PDT) Received: by 10.52.116.72 with HTTP; Sat, 6 Jul 2013 04:33:37 -0700 (PDT) In-Reply-To: <201307061020.26154.michaelkintzios@gmail.com> References: <51D728BA.4060906@gmail.com> <51D746E5.1040606@gmail.com> <51D7BFE2.3070300@mail.ru> <201307061020.26154.michaelkintzios@gmail.com> Date: Sat, 6 Jul 2013 07:33:37 -0400 Message-ID: Subject: Re: [gentoo-user] Linux viruses From: shawn wilson To: gentoo-user@lists.gentoo.org Content-Type: multipart/alternative; boundary=047d7bd74cf8adfc0404e0d62e98 X-Archives-Salt: cad037d2-c5cf-4218-9d5b-c41010e99eaf X-Archives-Hash: 743b6a64a24cba7603c3d6467a716a13 --047d7bd74cf8adfc0404e0d62e98 Content-Type: text/plain; charset=UTF-8 I was present for a discussion about which is the most secure OS. I don't remember the forum but the consensus was that the most secure OS is the one you know. Anyone can wreck a system but not everyone has the ability to maintain a system. I'm not arguing that you can run Windows as tight as Linux (no SELinux, tripwire costs $, etc). What I'm saying is if someone doesn't know Windows they'll do more harm than good. (same Linux). You can probably grep through a virus definition db and find an OS field. Probably ClamAV is your best bet here (but any may work). There's also a 50+ gig torrent of all known viruses you can look for. You could also figure out how to query vulns for the OS they're on (mitre or NIST) - probably hard. Reversing - as mentioned above, get a hex editor, and use strings. The other option is that it could have debug symbols still. Indicator lights is a piss poor way to see anything about what might be running. It's like looking at the hdd light to see how much your computer is processing. Ps - the software you're talking about is Windows. On Jul 6, 2013 5:22 AM, "Mick" wrote: > On Saturday 06 Jul 2013 07:57:38 the wrote: > > On 07/06/13 02:21, Dale wrote: > > > William Kenworthy wrote: > > >> On 06/07/13 04:12, Dale wrote: > > > >>> While we was > > >>> chatting, he said that Linux is just as prone to getting a virus as > > >>> windoze and so is a Mac. I think my laughing let him know I wasn't > > >>> buying his comment. > > Well this is just FUD. Linux and BSDs are much much less prone to virus > infection due to their architecture and default authentication > restrictions. > Also your average Linux user, well at least your average Linux desktop > user is > more clued up than the MSWindows equivalent. With the advent of Linux to > mobile devices (Android) this statement is no longer true. > > > > >> food for thought - some years back a member of the local lug picked up > > >> that something was listening on a port that he didn't think should be > in > > >> use. Turned out to be an infected windows binary running under wine > ... > > >> > > >> I presume he had been using wine and this was left running, rather > than > > >> self starting. > > >> > > >> BillK > > > > > > Well, no Wine here. So that won't happen. Actually, I don't have a > > > copy of windoze here at all. Neither of my two rigs have ever had > > > windoze installed on them at all. > > I'm sure some poster in 2003/04 posted in this same list about a MSWindows > malware running in Wine. That's indication of good code as far as I'm > concerned, because most MSWindows programs that I tried would fall over > themselves in Wine! LOL! > > > > > BTW, I have been known to open those attachments before. I usually open > > > them with kwrite or something and try to see what is human readable in > > > there. Most is machine language but there is usually a small portion > > > that is human readable. They sent it and I'm nosy that way. lol > > > > Perhaps it's easier to use strings? > > hexdump -C > > You may have to unzip it first, because a lot of malware is zipped to > escape > detection from some simpler anti-virus checkers. You can also use dd and > pipe > it to an antivirus to see if it finds anything known. > > All OS are susceptible to malware, but not all malware are viruses. At > least > one virus has existed for Linux (in the 90s or early 00s), but it was > patched > overnight if I remember right. Other than that I don't know of any > programs > which can be replicated on Linux machines. I think this is because despite > Lennart's efforts no two linux OS are exactly the same. So, as the virus > is > trying to replicate itself it will fall down at the next box it tries to > infect. > > However, rogue add-ons in browsers, increasingly sophisticated JavaScripts, > and HTML 5 with all its cross-domain/cross-site-request potential could > wreck > at least some of your data and steal your information, just as easily as > the > adjacent MSWindows box. Oh, before I forget, did I mention Java? > > Linux running on mobile devices is a different category because there is > great > uniformity of the OS across devices. This is a big target for any malware > writers and state actors who value their coding time: > > http://techcrunch.com/2013/07/04/android-security-hole/ > > -- > Regards, > Mick > --047d7bd74cf8adfc0404e0d62e98 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

I was present for a discussion about which is the most secur= e OS. I don't remember the forum but the consensus was that the most se= cure OS is the one you know. Anyone can wreck a system but not everyone has= the ability to maintain a system.

I'm not arguing that you can run Windows as tight as Lin= ux (no SELinux, tripwire costs $, etc). What I'm saying is if someone d= oesn't know Windows they'll do more harm than good. (same Linux). <= /p>

You can probably grep through a virus definition db and find= an OS field. Probably ClamAV is your best bet here (but any may work). The= re's also a 50+ gig torrent of all known viruses you can look for. You = could also figure out how to query vulns for the OS they're on (mitre o= r NIST) - probably hard.

Reversing - as mentioned above, get a hex editor, and use st= rings. The other option is that it could have debug symbols still.

Indicator lights is a piss poor way to see anything about wh= at might be running. It's like looking at the hdd light to see how much= your computer is processing.

Ps - the software you're talking about is Windows.

On Jul 6, 2013 5:22 AM, "Mick" <michaelkintzios@gmail.com>= wrote:
On Saturday 06 Jul 2013 07:57:38 the wrote:
> On 07/06/13 02:21, Dale wrote:
> > William Kenworthy wrote:
> >> On 06/07/13 04:12, Dale wrote:

> >>> While we was
> >>> chatting, he said that Linux is just as prone to getting = a virus as
> >>> windoze and so is a Mac. =C2=A0I think my laughing let hi= m know I wasn't
> >>> buying his comment.

Well this is just FUD. =C2=A0Linux and BSDs are much much less prone to vir= us
infection due to their architecture and default authentication restrictions= .
Also your average Linux user, well at least your average Linux desktop user= is
more clued up than the MSWindows equivalent. =C2=A0With the advent of Linux= to
mobile devices (Android) this statement is no longer true.


> >> food for thought - some years back a member of the local lug = picked up
> >> that something was listening on a port that he didn't thi= nk should be in
> >> use. =C2=A0Turned out to be an infected windows binary runnin= g under wine ...
> >>
> >> I presume he had been using wine and this was left running, r= ather than
> >> self starting.
> >>
> >> BillK
> >
> > Well, no Wine here. =C2=A0So that won't happen. =C2=A0Actuall= y, I don't have a
> > copy of windoze here at all. =C2=A0Neither of my two rigs have ev= er had
> > windoze installed on them at all.

I'm sure some poster in 2003/04 posted in this same list about a MSWind= ows
malware running in Wine. =C2=A0That's indication of good code as far as= I'm
concerned, because most MSWindows programs that I tried would fall over
themselves in Wine! =C2=A0LOL!


> > BTW, I have been known to open those attachments before. I usuall= y open
> > them with kwrite or something and try to see what is human readab= le in
> > there. =C2=A0Most is machine language but there is usually a smal= l portion
> > that is human readable. =C2=A0They sent it and I'm nosy that = way. =C2=A0lol
>
> Perhaps it's easier to use strings?

=C2=A0 hexdump -C <suspect_payload>

You may have to unzip it first, because a lot of malware is zipped to escap= e
detection from some simpler anti-virus checkers. =C2=A0You can also use dd = and pipe
it to an antivirus to see if it finds anything known.

All OS are susceptible to malware, but not all malware are viruses. =C2=A0A= t least
one virus has existed for Linux (in the 90s or early 00s), but it was patch= ed
overnight if I remember right. =C2=A0Other than that I don't know of an= y programs
which can be replicated on Linux machines. =C2=A0I think this is because de= spite
Lennart's efforts no two linux OS are exactly the same. =C2=A0So, as th= e virus is
trying to replicate itself it will fall down at the next box it tries to infect.

However, rogue add-ons in browsers, increasingly sophisticated JavaScripts,=
and HTML 5 with all its cross-domain/cross-site-request potential could wre= ck
at least some of your data and steal your information, just as easily as th= e
adjacent MSWindows box. =C2=A0Oh, before I forget, did I mention Java?

Linux running on mobile devices is a different category because there is gr= eat
uniformity of the OS across devices. =C2=A0This is a big target for any mal= ware
writers and state actors who value their coding time:

=C2=A0 http://techcrunch.com/2013/07/04/android-security-hole/

--
Regards,
Mick
--047d7bd74cf8adfc0404e0d62e98--