Ask Slashdot: Is GNU/Linux Malware a Real Threat? 252
New submitter m.alessandrini writes "I've been using Debian for a long time, and I'm not a novice at all; I install system updates almost daily, I avoid risky behaviors on Internet, and like all Linux users I always felt safe. Yesterday my webcam suddenly turned on, and turned off after several minutes. I'm pretty sure it was nothing serious, but I started thinking about malware. At work I use noscript and other tools, but at home I have a more relaxed browser to be used by other family members, too. Here I'm not talking about rootkits or privilege escalation (I trust Debian), I think more of normal user compromise. For example, these days much malware come from malicious scripts in sites, even in advertising banners inside trusted sites, and this is more 'cross-platform' than normal viruses. So, what about non-root user malware? How much could this be real? And how can you diagnose it?"
someone's spying on you (Score:5, Insightful)
Your webcam turned on, then off, and you didn't ask it to? I think you need to figure out what happened first.
Re:someone's spying on you (Score:5, Insightful)
Re: (Score:3)
Flash applications have to be given the right to access the Webcam. You can rightclick in a flash thing and go to Settings / Global Settings and look at the privileges per site, or generally deny it (by default: ask for each domain).
Re: (Score:2)
I'm sure a flash exploit (of which dozens are disclosed every year) is not going to obey some checkbox you've clicked in the settings.
Re: (Score:3)
Depends where the vulnerability is. If they get in prior to that check, then it would be obeyed, but if it's later in the codepath then of course it wouldn't apply.
Re: (Score:2, Interesting)
The only problem is, flash already has the right to access the damn camera/mic (default setting). You Have to deny it
Re:someone's spying on you (Score:4, Funny)
I avoid risky behaviors on Internet
I don't think op has flash installed.
[...]turned on, and turned off after several minutes[...]
Even so, polling a webcam is a few seconds at most, not minutes.
Re: someone's spying on you (Score:3, Funny)
Please, save up your money so you can buy a line feed or a paragraph tag.
Re: (Score:3)
Re: (Score:3)
Comment removed (Score:4, Insightful)
Re:someone's spying on you (Score:4, Informative)
As for this specific case? As somebody who works on systems 6 days a week? Yeah...smells like he has an infection.
I doubt it. You're just too used to Windows.
The Australian Communications and Media Authority's statistics breakdown shows of about infected 16,500 devices online at any one time, 20 Windows viruses make up more than 16,400 of the active IPs. Rarer Windows viruses, and Mac, iOS, Linux and Android infections all total less than 100 infections.
http://www.acma.gov.au/WEB/STANDARD..PC/pc=PC_600121 [acma.gov.au]
If the OP's computer IS actually compromised, it's far more likely to be a targeted attack or insider job than a random infection. My money's on a friend, family or associate with access to the machine.
Re: (Score:2, Redundant)
Preinfected (Score:4, Funny)
It would help if the manufacturers would preinfect their software so we could stop worry about "if" we are infected and move towards just accepting it.
*Disclaimer: I in no way work for, represent, or contract for Sony. (Sorry Sony lawyers made me add the preceding text.)
Re:Preinfected (Score:5, Informative)
It would help if the manufacturers would preinfect their software so we could stop worry about "if" we are infected and move towards just accepting it.
This is actually happening with phones now. just read some of the permissions of Facebook, Chrome, Firefox and a few others. They can take a photo or record audio without your permission.
Re: (Score:2)
Android has no API for "take_a_photo_with_permission()", there's just stuff to access the camera. It definitely makes sense why facebook app might need access to the camera: it clearly supports taking photos directly, and that's something users want. I'm not sure about Firefox or Chrome, but maybe flash runs within the brower's security context, so the browser would need permission to access the camera if flash was going to?
I highly doubt facebook, chrome, and firefox are using the camera without our knowle
Re: (Score:2)
I'm not sure about Firefox or Chrome, but maybe flash runs within the brower's security context, so the browser would need permission to access the camera if flash was going to?
HTML5. Flash is bundled separatly, but modern mobile browser have started to implement the getUserMedia stuff for webcam/micro access (without using flash).
Don't worry (Score:5, Insightful)
It was just Skynet checking out what you were up to. Or maybe the ATF. Or Russian Mafia. Or...
As for security, ~5 years ago read someone's account of watching while someone on the internet installed a root kit on his Linux box in a matter of minutes.
Presumably some platforms/applications are less likely to be compromised than others, but the safest assumption is that everything is compromised, or would be if the experts wanted it.
Re:Don't worry (Score:5, Funny)
luser$ sudo apt-get install rootkit
Re: (Score:2)
Gosh, I thought we all used aptitude now...
Re: (Score:3)
Sheeit, boy! Back in the day, we had to issue:
dweeb@old-ass-distro$~ tar rootkit-0.0.99.tar.gz && cd rootkit-0.0.99.tar.gz && sudo configure && make && make install
Re:Don't worry (Score:4, Informative)
How was the rootkit installed? Can you please elaborate on what security failures were involved?
Not sure if you are looking for how he did it, or indirectly doubting the story, but in case this is in doubt - there are plenty of Linux rootkits.
http://blog.sucuri.net/2013/02/linux-based-sshd-rootkit-floating-the-interwebs.html [sucuri.net]
http://www.securelist.com/en/blog/208193935/New_64_bit_Linux_Rootkit_Doing_iFrame_Injections [securelist.com]
http://arstechnica.com/security/2012/11/new-linux-rootkit-exploits-web-servers-to-attack-visitors/ [arstechnica.com]
http://packetstormsecurity.com/UNIX/penetration/rootkits/ [packetstormsecurity.com]
http://www.slideshare.net/AndrewCase/omfw-2012-analyzing-linux-kernel-rootkits-with-volatlity [slideshare.net]
list could go on for quite a while..
Re: (Score:2)
Thanks for the list - hadn't heard anything about the iframe exploit - course I have noscript set "Deny All" plus custom host file to block lots of adverts - many of the servers been compromised at some point and I don't give a damn about them - it's my bandwidth
Re: (Score:2)
like this: http://www.youtube.com/watch?v=vYNnPx8fZBs [youtube.com]
Re: (Score:2)
Sorry, all I got was a statement that it happened, no details.
Malware (Score:2)
That's not an O.S. issue. If anything it is an app issue.
Re: (Score:2)
Re: (Score:2)
It is an OS issue too (Score:3)
Do you deal with customers? (Score:5, Informative)
Re: (Score:2)
Also, if you connect your device to other networks (say VPN into work, US DOE, etc), usually as part of the VPN access agreement you agree to have Antivirus software installed and up to date on your device. Doesn't say anything about 'unless you are running....' And personally, I try to avoid any scenario that they (work, client, etc) can say that I broke something by not following directions (see your scenario).
Linux's Biggest Threat is Human Engineering (Score:2, Insightful)
Do not copy and paste commands into your terminal that you do not understand.
The vast majority of compromised Linux systems that I've dealt with have not been because of any malware or crazy hacking, they've been because people copied and pasted commands that gave attackers free access to their computer. I've seen fairly computer literate people open their systems right up because they had a bug, searched Google, and entered the first command they saw into their terminal.
Don't do it. Don't let your parents,
Re: (Score:2)
So you're saying adding the repository malware.org/debian and running sudo apt-get install rootkit was not a good idea? :-)
Re: (Score:2)
Re: (Score:3)
I never do.
In fact we do not allow root to login via ssh.
Sounds like bad practices on that one. Developers should not have root access, normally they will just break something.
Re: (Score:2)
What about subdirectories? You need executable permission to acess the contents of a subfolder on his home directory.
Root usage - A lot, but never browser (Score:2)
Re: (Score:2)
Most non-civilian Linux users run as root.
Dead wrong. Years ago, back in '06 I think, I had the unfortunate experience of working under a real penis who thought he knew better, until he accidentally deleted some system files and had to re-install. He poo-poo'd my notion of using su & sudo, but he didn't after his experience. I never log in as root, and I tell everyone I see doing it to knock it off.
Re: (Score:2)
I appreciate your wisdom. It hasn't helped my flamebaiting status. I see sooooo many paste jobs that say something like:
root@frankenstein # grep tail foobar etc.
As a coder, I like to run unscathed by logons, too. But after an indelicate rm decades ago, I'm a convert to user space.
Re: (Score:2)
Out of mod points, but I don't run as root. I've learned to like sudo, it took a while, but it is the Right Thing To Do.
The only time I have a root console open is when I absolutely must have it.
Re: (Score:2)
Most desktop Linux distros (the kind most coders who run it use) no longer HAVE a root account enabled, it's generally locked by default, and you would have to forceably go and set one to use it.
I can't speak for other people but I have only ever done this in very specific scenarios on my machine where I CANNOT use sudo (i.e. I want to move my /home to a new larger hard drive - this means I need to be able to unmount it - which means my normal account cannot be logged int)... considering it's "sudo passwd r
Re: (Score:2)
There are times when root is fine. But not for long.
I watch coders use root as a default. If you use any of the many distros, the default is user space logon and it works for most needs. I tracked myself yesterday and found myself in root seven times going on misc installation and modding adventures.
A collaborative effort I'm working on lands me as root on another coder's machine. It's always there, CLI forever. Bash at root stares me in the face. If I demote it, it's back again. It's unlikely this person i
Re: (Score:2)
I won't deny that it happens in some places, but it certainly doesn't happen here. In fact we take those default settings and hard-code them to make this even less likely.
We even have a bootscript that locks root on every reboot, and another hook in our build-scripts to relock it everytime you build our code, basically - even if people unlock it, it won't be unlocked for long - and if somebody changes that, well git blame means it won't be a secret...
Re:Linux's Biggest Threat is Human Engineering (Score:5, Informative)
Also, do not ever copy and paste commands directly in your terminal from an untrusted website, even if you do understand them:
http://thejh.net/misc/website-terminal-copy-paste [thejh.net]
Re: (Score:2)
I usually run them through a text editor, so I have a complete record of what I have done, I will do the religiously from now on.
Re: (Score:2)
Woah I'm impressed. Checking the website source, they made some extra code invisible, which now that I think of it is pretty trivial, and requires no Javascript voodoo. I guess I'll always copy and paste from the page source from now on.
Re:Linux's Biggest Threat is Human Engineering (Score:4, Interesting)
Hint: copied text can contain embedded newlines. And the first line of text will be some obfuscated form of stty -echo, if you have read the posted source, so you won't even know.
Well, it's impossible to prove something doesn't exist, and since this whole slashdot story originated because someone's computer did something unexpected, perhaps the OP is an example of where this was used?
Obligatory xkcd (Score:5, Interesting)
http://xkcd.com/1200/
Re: (Score:2)
Of course, if someone steals my laptop while I'm logged in, unless he drags it away from under my hands, he'll be presented with the screen saver's password screen
So he boots a linux live CD and then proceeds to rape your drive for all its got.
Your webcam (Score:5, Funny)
Yesterday my webcam suddenly turned on, and turned off after several minutes.
Hey, sorry about that. I was trying to get the girl next door that's leeching off your wifi. She's so cute! But when I turned on the webcam, I knew I had the wrong person. Also, dude, put some pants on. Nobody wants to see that.
Oh, and that stuff about Linux having malware? I'm sure you have nothing to worry about. The Year of the Linux Desktop hasn't come yet (though they say it'll be this summer for sure!), so you're safe. All the malware me and my friends at the Evil League of Evil make for Linux is designed to worm its way into web servers, ftp, etc., to spread malware to Windows boxes. We aren't interested in your personal life. You're a nerd, running Linux. We haven't found a single case of one of you having a life yet. Hell, you don't even have a decent car, man.
oh oh, gotta go, the webcam is up and... oooooh my....
Re: (Score:2)
oh oh, gotta go, the webcam is up and... oooooh my....
Pervy Hobbit fancier!
Yes (Score:5, Insightful)
As long as you have people on Ubuntu forums posting "sudo apt-get " as the solution to everything without explaining what they do, and as long as you have people willing to copy/paste the commands without understanding what they are doing, then malware is a threat.
The same groupthink plagues the Arch Linux forums. Blindly copy/pasting commands that someone else put on a wiki does not make you elite, it makes you an idiot.
The same issue exists in adding repositories from untrusted sources. What's the point of running an enterprise-class operating system if the first thing you do is add a third party repo from Russia and update the kernel with something ending -kmod?
The critical mass of idiot users still reside in Windows, where things like UAC and walled gardens exist to protect them somewhat. At least there, you have to know the administrator password to do real damage. Ubuntu and all the new user-friendly distros are content to put every new account in /etc/sudoers and allow you to use your own password to gain root access. Any operating system is prone to malware so long as people are willing to bend security practices.
Re: (Score:2)
Ubuntu does not, have never, and will never put any user in sudoers.
The default is allowing the groups admin and sudo, no more, no less.
Anything else would be bloody retarded.
If I ran servers... (Score:5, Interesting)
then I'd worry a lot. Rootkits for privilege escalation, SQL injection attacks against poorly-written 3rd-party and locally-developed databases, PHP, CMS & web framework vulnerabilities, etc, etc, etc.
For home use, I'm concerned about router vulnerabilities (Tomato helps but is not perfect) and MITM attacks (but there's nothing I can really do about them except keep my s/w up-to-date, while praying that vendors do the same).
I got a virus for Linux once (Score:5, Funny)
Re: (Score:3, Funny)
You probably forgot to install libmalware.
Re:I got a virus for Linux once (Score:4, Funny)
You probably forgot to install libmalware.
That was deprecated in favor of libopenmalware ages ago, do try to keep up.
Re:I got a virus for Linux once (Score:5, Funny)
libmalware depended on libkeylogger3.6.1 which depended on libmalware0.9 and fuck...
I installed windows and it was so much easier to get rootkitted. Damn linux dorks.
Re: (Score:2)
This may be helpful [archive.org]. It was posted to slashdot a few years ago [slashdot.org].
Re:I got a virus for Linux once (Score:5, Funny)
This virus works on the honor system:-
If you're running VMS or a variant of unix or linux, please forward this message to everyone you know. Afterwards, delete a bunch of your own files at random.
Re:I got a virus for Linux once (Score:5, Funny)
Obligatory: http://archive09.linux.com/articles/42031 [linux.com]
Sadly the article is a bit out of date, and Wine has hopefully increased support by now.
Re: (Score:2)
That should work better.
Updates, backups, and Flash (Score:4, Funny)
TEEX.com has some free online cybersecurity courses that may have good reminders for your and your family members regarding safe browsing habits and simple security practices.
Almost daily updates? (Score:2)
OP writes:
" I install system updates almost daily"
Seems to me.that any OS requiring multiple updates per week is a fail.
*DUCKS*
Re: (Score:2)
My Windows box seems to get updates pretty much every day or two.
Re: (Score:2)
Webcams . . . (Score:2)
No Big Deal (Score:2)
I was just look to see what's going on at your place . . .
Noscript is not optional (Score:2)
Two questions:
On my system, I've got noscript configured to deny all by default and all the other users (with log-ins) are configured the same way be default. If they want to change things, they can do so for those sites where it's a must to have scripts but they've already learned to be very careful about that and ask if they don't know for sure.
Linux Mint has been malware for me (Score:2)
Reading the replies some mentioned flash, Flash for Windows defaults to Webcam on, so thought I'd
check my Flash for Mint as I wasn't sure if I had set the settings. Mint is my start in Linux and used infrequently.
Things led to preferences, Network Proxy pref's showing that 127.0.0.1 as being ignored, hit the help button
and get a standard Mint manual of which "network proxy" isn't found.
http://i39.tinypic.com/2z5uf80.jpg [tinypic.com]
No help, I see if it means what I think it means and put "127.0.0.1. slashdot.org" in my
yes (Score:2)
As with the OS X userbase, the Linux userbase is fairly blaise with regards to the possibility of being compromised.
So far, the platform has been relatively safe, however as it gains popularity on the desktop expect more end-user focused malware (vs. the traditional sort of rootkit) to be developed. Given the vulnerabilities these days are mostly found in flash, java, javascript, etc, and your DATA is just as valuable (if not more) than root on your machine (and is available from your user account), I'd
Just a guess (Score:2)
Linux Malware (Score:2)
Non-root user malware? (Score:2)
Re:It's easier to exploit. (Score:5, Insightful)
Linux is much easier to exploit than Windows. All of its internals are well understood, and there are more things one can do with shell access.
2003 is calling. They want their FUD back.
Re: It's easier to exploit. (Score:3, Funny)
2003 is calling? Don't forget to warn them about Vista and Windows 8!
Re: (Score:2)
2003 is calling? Don't forget to warn them about Vista and Windows 8!
They've had plenty of forewarning by 2003.
Re: (Score:2)
To a lot of people this sounds fairly reasonable and logical - the internals are open and accessible, hence flaws should also more easily visible compared to a closed system.
It does seem logical, but the fact that sooooo many flaws have been found in Windows, Flash, Acrobat Reader, etc, etc belie the hypothesis that source code makes it easier to find exploitable bugs.
Re:It's easier to exploit. (Score:5, Insightful)
That is what SELinux and AppArmor are for. They might not be 100% (as there were some kernel exploits that could be used to bypass those), but with proper policies in place, something getting UID 0 would be pretty limited in what it can accomplish.
OS X also has a similar mechanism in place.
Linux also has a bunch of different distributions. A bug that causes SSL keys to be very weak in Ubuntu is not going to affect RedHat systems.
This doesn't mean Linux is worry-free, but it is more secure than people think. To cite an anecdotal example, the proof is in the pudding -- look at all the amateurish Apache servers and LAMP stacks out there. If Linux had major issues in general, there would be major screaming on almost every forum how insecure the OS is.
Re: (Score:2)
No, it isn't. Unless it's a fortune pudding for mathematicians.
Re: (Score:3)
Re:Define "real" (Score:5, Interesting)
Getting struck by lightning is real. Worrying about/preparing for it very much is silly. Draw your own conclusions about how this applies to malware on a Linux machine that's kept up-to-date and the user avoids risky behaviors.
For lightning, make a will, and you're covered. For Linux, make backups, and you're covered.
My home has a lightning rod. So do all the tall buildings downtown. I have UPS and surge protectors, and even surge arresting breakers in my home's electric service panel. It's not just worrying over lightning, it's also worrying over accidental electrocution (all circuits are GFCI protected in some form, which has saved my bacon more than once); The power spikes and drops in this city are pretty bad. Every time it rains or the wind blows a bit we get little power hiccups. My home has been struck by lightning 3 times in the past 20 years. My neighbors behind me have had a tall pine tree struck, and the neighbors across the street showed up at my doorstep at 3am one morning after a particularly loud thunder clap -- The large china-berry tree in their front yard was struck and it fell over on their house.
Just like with Malware and any OS, there is far more you can do to prevent against lightning or electrical damage. I've never lost a system to power issues, and I have many. In addition to backups I use VMs -- Oops, virused a VM image, restore from snapshot -- It's like a backup, but smarter.
Re: (Score:2)
My home has been struck by lightning 3 times in the past 20 years.
Do you live in central Florida? I understand that's "Lightning Alley". PITA electrically, but fun to watch.
Re: (Score:2)
He said "get a will and you're covered". I don't think he was talking about losing a computer to lightning, but getting struck personally while you're walking around.
That said, there are things you can do for that, too... try not to be the tallest object during a thunderstorm (ex, don't be in a boat on the lake, don't be in the middle of a field, and don't hide under the tallest tree). As you point out, there are very few times when burying your head in the sand is the best move.
Re: (Score:2)
DVD would be a step backwards. That's done with PXE these days.
Easy peasy, since the beginning (Score:2)
I created a system that backs up your Linux system to a virtual machine, so the backup can be booted directy, or be restored by copying it to a hard drive. Even coole
Re:lsof is your friend (Score:4, Informative)
Should be /dev/video*
Re: (Score:3)
Re: (Score:2)
You should trust that you have properly configured the systems security settings to prevent issues
a) No, you should not trust that you have configured anything properly.
b) Doesn't solve the problem even if you could trust yourself.
The best security only comes when you dont trust anything, even yourself. It is only then that you can make proper decisions...
Re: (Score:2)
> The best security only comes when you dont trust anything, even yourself. It is only then that you can make proper decisions...
Are you sure?
Re: (Score:2)
RMS would say that you're sacrificing your freedom if you allow non-Free malware to run on your GNU/Linux PC computer.
+5 Funny
Re: (Score:2, Insightful)
1% of 10% is smaller than .7% of 90%.
Yes, it is. But if you discuss infection risk for users and infectability of a platform, percentage of user base is the right measure.
Re: (Score:2)
Just bear in mind that there are maybe 20 kernel binaries for Windows (XP, Vista, 7, 8, each with their own service packs), which represent ALL of the windows installs, whereas we have thousands of binaries for linux at a certain moment (each distro with at least 1 kernel update/month from maintainers, but maybe not everyone applies it at the same time).
So again, why would anyone target linux?
Re: (Score:2)
There are many different combinations of the same software options, with a few extra patches; I don't believe there are nearly 'thousands' of unique code bases, and even then there has to be very large exposed code
Re: (Score:3)
Re: (Score:2)
Nah - go for eCom Station [ecomstation.com] - *nobody* uses that shit anymore, and you can dust off those ancient OS/2 skills!
Re: (Score:2)
Re: (Score:2)
Until you realize it's possible for malware to escape the sandbox....(at least it's been done in concept, anyway).
Re: (Score:2)
Linux but not Android (Score:2)
You mean Linux? What moron walks around saying "gee in yoo Linux"?
In practice, I've taken "GNU/Linux" to mean any Linux-based operating environment that is more similar to Fedora or Debian than to Android. What clearer term for Linux-that-is-not-Android do you recommend?