Are Linux and it's variants "Malware Proof"?

what if you enabled the windows xp firewall (full stealth at grc.com), LUA, and SRP. all three are built right into windows no extra software needed. with those three things functioning, you wouldn't have anything to fear going without an av/as/sandbox/etc...

i bet you it would be every bit as safe as linux PLUS you'd have access to all your games and windows-only software.

 

Yes well said.

 

But would running Windows really bring "ruin" in a "matter of moments"?

You use a false conjecture as proof of Linux's inherent strength; in other words, you're proving nothing at all.

 

I can turn it around and edit your post a bit:

I guess that is what I am trying to figure out, if Windows LUA is as safe as Linux. I have gotten some good answers from knowledgable users about why Windows LUA is not as secure as Linux, but then come solcroft and questions this a poor sod like me who dont know so much gets a bit confused
So that is why I try to do my bit and do all the stuff I ever did in admin account on LUA without any security software (well LnS then) and see if and what happens. I guess experience is the only way to find out for sure Seems like no one ever compared them "live" so to speak.

 

Hello,

The W vs L discussion should be taken on a different level:
How does Mr. noob deal with it - not how geeks do it; for geeks, it really doesn't matter.

Take Mr. John and Ms. Joe, who are the perfect average noobs, using AOL as ISPor whatever, place them in front of a default installed XP versus default installed ... Ubuntu, let's say.

This is where the questions become interesting, not if someone capable of hexadecking his bios via isa wil get rooted...

Mrk

 

You´re absolutely right Mrkvonic, by default Linux is safer then Windows XP. But again, as mentioned earlier, this is nothing new. Is it however right to keep "punishing" a company for making such an error, installing in admin mode by default? M$ have at least released a version where it´s now restricted by default, even if there are still other issues with Vista and it has also taken a rather long time to take this step compared to *nix. So it should be more fair if one would compare Ubuntu versus Vista out of a security perspective in regard to your example.

/C.

 

My father doesn't know the difference between a "website" and the "desktop". He has no grasp of the concept that you can run multiple programs in Windows (he conscentiously closes the last one before opening another). But I told him how to, and he setup an LUA for himself and password-protected the default admin account, and got back to using his computer normally all in 60 seconds even though he probably had no idea what he just did. Just because LUA is impopular and not well-known doesn't mean it's rocket science.

In contrast, put my father in front of Ubuntu, and he'd probably be safer, only if because he'd have no idea how to do anything at all.

 

Hidden files are no protection against malware and System File Protection can be quite easily bypassed by hooking into Winlogon itself. LUA (with its more restrictive NTFS permissions) is better protection but not proof against an escalation of privilege attack.

IE's integration affects its security in three ways - the first is via extra functionality that provides no benefit online but can be exploited by malware (e.g. the res:// and help:// protocols). The second is that IE (and its components) can be run regardless of whether you have installed another browser or not (one Firefox "vulnerability" worked by using Java to fire up IE and send it a malicious URL) - this is made worse by the inability to remove IE (or stop Windows running it) without third party software. The third is that application vulnerabilities in IE are more likely to become system vulnerabilities in Windows itself.

More reviewers does not guarantee safer code (just like more police does not guarantee safer streets) but the likelihood of flaws being found and fixed is far higher. It also prevents the program author from suppressing news of serious or embarassing flaws.

Several distros (Debian, Gentoo) provide a mechanism for combined system and application updates. This avoids multiple checks for different applications and the problems inherent in applications checking and updating themselves (the need to allow network access for software that shouldn't otherwise need it, the difficulty in distinguishing between a legitimate update and one due to malware). However this is a distro feature rather than a generic Linux one.

One generic method for LUA processes to gain admin access has already been detailed above (the shatter attack). In addition, there have been plenty of vulnerabilities elsewhere in Windows (see CVE-2007-5350 for a recent example affecting Vista) which allow a LUA process to gain admin access, so LUA cannot be considered as making Windows "malware proof".

Well your version of Windows certainly seems to differ from everyone else's. What about Outlook Express? Windows Media Player 9? MSN Messenger 6? Core Windows components like Winlogon, Explorer, Lsass, Smss or Csrss that have received multiple updates to fix remote exploits? Plenty of examples are listed on the Microsoft Security Bulletins Page and this only covers vulnerabilities that have been discovered, reported and patched.

There are also numerous system settings that need adjustment (the stupid "hide file extensions" option in Explorer that allows malware executables to masquerade as media files, disabling unneeded services, locking down IE settings, disabling autoplay, adjusting security policy, etc).

Windows' own firewall is demonstrably useless for controlling outbound access so needs rapid replacement. As for process execution control, please provide an example of how you can prevent iexplore.exe from running on a Windows XP system without third party software.

And if a snafu occurs, deleting and recreating accounts is hardly an appropriate measure. Aside from the issue of data loss, it would do nothing to cope with more sophisticated malware like rootkits.

None of this however is of relevance to the thread title ("malware proof" Linux).

 

"In the history of the SMP linux kernel, there has always been, at any given time, at least one unpatched privilege escalation flaw."

 

Hello,
First: Source.
Second: local or remote? Don't forget, most Linux exploits are for local non-root users abusing the privileges of root.
Mrk

 

Agreed. Do keep in mind, however, that this argument was made in response to a poster who claimed it was relatively easy for the user to accidentally delete files by him/herself, not to argue that Windows in its default admin-access mode is more secure than Linux's default limited-access mode.

Agreed. The result of the flaws you mentioned is arbitrary remote code execution. And as I have discussed earlier: flaws in the browser are by no means flaws in the OS. The browser can be exploited to silently download and execute arbitrary code – the browser is vulnerable. However, whether that code can cause any harm to the OS once executed is another matter altogether; for instance, the res:// vulnerability you mentioned does not work on XP SP2, even if its copy of IE6 is supposedly susceptible to this attack. To reiterate; just because IE6 is vulnerable and has fallen victim to an exploit, doesn't necessarily mean that the same applies for the OS behind it.

I'm not familiar with this particular vulnerability offhand, but for some reason or other it seems to have been concurred that this is a Firefox vulnerability instead of an IE one, despite your use of quotation marks to indicate your personal disagreement.

Also, just for the record, IE can be blocked by using Windows XP's inbuilt software restriction policy feature, making your claim that "IE cannot be stopped from running without third-party software" an inaccurate one. I've just tested this myself, to make sure; you're welcome to do the same.

Would you be interested in providing an explanation to your claim?

It's rather hard to hold a discussion without it; I might just as well be trying to debate something as arbitrary as "pet dogs are more likely to bark at night in London than in New York".

That'd be a very nice feature to have, assuming it works how I think it does from your description. Unfortunately, it seems to have more to do with convenience than with security. The necessity for network outbound control is a debatable one. And regarding your "malware updates" argument, I'll believe it the day I click on the update prompt from, say, Firefox, or OpenOffice, and find out it's downloaded malware for me instead. Lastly, as you've already mentioned, it looks like a distro-specific feature, not a generic Linux one.

Conceded. However, it may be worth noting that Windows itself has not been vulnerable to the shatter attack since 2002; for the last six years it's only been a problem with third-party software that install admin-privilege services, and allow those services to be attacked by other processes in such a manner. I'd call this a third-party software vulnerability, instead of a Windows one, and personally I don't know any third-party software that remains vulnerable to this attack.

I am completely unfamiliar with Vista, having never used it (waiting for SP1 before upgrade), so I'll make no comment regarding this one.

Can these vulnerabilities compromise the OS if the OS properly secured? If not, then my previous argument holds.

I considered internet access as a critical function of the OS for the average user, and hence for the sake of that fact I conceded that IE6 could be counted as an OS vulnerability that needed fixing instead of being used as-is right out of the box, even though IE6 being an OS vulnerability is technically and entirely untrue. As far as I can see you seem to be interested in claiming that vulnerabilities in external applications are vulnerabilities of the OS itself; why stop at these programs? There are hundreds of other vulnerable programs out there as well that would be sure to cast an unfairly negative light on Windows for the novice user if their flaws were to be not-so-subtly implied to be actually a Windows flaw instead by a Security Expert.

Unless the user somehow turns it off or reduces its functionality, Windows' own built-in firewall renders all silent (i.e. not manually initiated by the user) remote exploits completely useless.

On the other hand, it provides practically flawless inbound protection, which is all you need to remain safe.

secpol.msc, anyone?

Backing up data files prior to deleting the account is peanuts, and show me a rootkit that successfully installs itself in LUA, much less survive an account deletion. Do that, and you'll have amazed me.

 

See this thread

 

Sorry, lucas, but aside from some may-bes, would-bes and could-bes, I don't see any solid evidence to tell me that the facts run contrary to my claim.

 

An excellent discussion on LUA is also going on at the DSL reports site http://www.dslreports.com/forum/r19757088-Attacks-without-administrative-privledges

Here is forum member Steve's take on LUA and he is absolutely right on it.

said by Cabal :

Malware that infects a system with user privileges can't change system files.
True enough
It can't change startup files
Sure it can - there are plenty of per-user startup vectors (including files)
It can't change the registry
Sure it can - the user has read/write access to many parts of the registry
It can't bind to privileged ports.
... which probably doesn't really matter that much.
It can't run in memory past the current session.
Fair enough.

So as we all see, running in LUA mode doesn't make one invincible in any ways under XP. Parts of registry can still be manipulated.

Mrkvonic,

Many thanks for your support, truly appreciated here.

 

So a malware is able start up every time Windows does. Can it also deliver its intended payload, by any chance?

No point trying to fleece wool over people's eyes. The point is whether it can deliver its payload, not do this or that that ultimately means nothing.

So as you obviously did not see (trying to jump into the middle of discussions and pretending to act smart without understanding how far the discussion's already gotten?), that was never the claim in the first place.

 

Remote code execution throu malformed packets
If I understand this correctly, the XP firewall won't do anything to filter the malformed packets which may cause remote code execution. Feel free to correct me.

 

On the very same page: "To help protect from network-based attempts to exploit this vulnerability, use a personal firewall, such as the Internet Connection Firewall, which is included with Windows XP and with Windows Server 2003."

 

lucas,

You're effectively saying that the network driver is able to execute code by itself without first passing it to the OS. Think about it.

The link to the firewall test between Windows Firewall vs Jetico is interesting, but it's just that. As long as network packets are filtered before they reach the OS, it'd be a stretch of imagination to think they could cause any practical harm, IMO.

Though I'll gladly accept any corrections to this as well.

 

Excellent write up here at http://www.theregister.co.uk/security/security_report_windows_vs_linux/

Windows Design

Viruses, Trojans and other malware make it onto Windows desktops for a number of reasons familiar to Windows and foreign to Linux:
Windows has only recently evolved from a single-user design to a multi-user model
Windows is monolithic, not modular, by design
Windows depends too heavily on an RPC model
Windows focuses on its familiar graphical desktop interface

 

Article blames Windows for running in admin privileges by default. In XP it takes less than 60 seconds to create an LUA. In Vista limited privileges mode is already default. Already explained in this thread numerous times.

Article blames Windows for integrating IE. Refer to posts 75, 86. Again, already explained numerous times.

Sasser strikes thanks to a vulnerability in SQL Server. zomg Windows is so insecure!!

... So?

 

Lets see.......

There are about 60,000 viruses known for Windows, 40 or so for the Macintosh, about 5 for commercial Unix versions, and perhaps 40 for Linux.

With simple social engineering and sending a harmless looking mail like here is a nice screensaver which a noob would most likely click on, you infect the entire Windows system because Windows allows a .exe or .scr to be run as a program.

Linux has Linus law "given enough eyeballs, all bugs are shallow"

The conclusion is the result of a four-year research project conducted by code-analysis company Coverity, which plans to release its report on Tuesday. The project found 985 bugs in the 5.7 million lines of code that make up the latest version of the Linux core operating system, or kernel. A typical commercial program of similar size usually has more than 5,000 flaws or defects, according to data from Carnegie Mellon University.

"Linux is a very good system in terms of bug density," said Seth Hallem, CEO of Coverity, a San Francisco company that makes flaw-detection tools for software written in C and C++ programming languages.

http://www.news.com/Security-research-suggests-Linux-has-fewer-flaws/2100-1002_3-5489804.html

Windows is developed by faceless programmers whose mistakes are hidden from the outside world because Microsoft does not publish the underlying code for Windows. They consider it a trade secret. In contrast, Linux is developed by hundreds of programmers all over the world. They publish the source code for the operating system and any interested programmer, anywhere in the world can review it. Besides the wide audience for peer review, there is likely to be pride of ownership on the part of the developers of Linux that can not exist with Windows.

The numbers speak for themselves.......the number of Malware for Linux is virtually non existent

LUA is a safe option in Windows, I have LUA setup on my XP machines but then its not like Linux, there are many programs that refuse to run well under LUA.

On a Windows system, programs installed by a non-Administrative user can still add DLLs and other system files that can be run at a level of permission that damages the system itself. Even worse, the collection of files on a Windows system - the operating system, the applications, and the user data - can't be kept apart from each other. Things are intermingled to a degree that makes it unlikely that they will ever be satisfactorily sorted out in any sensibly secure fashion.

 

Perhaps because there's no incentive to write malware for non-Windows operating systems. The malware landscape today is geared towards data theft, unwanted advertising, and establishing strong botnets, and to do that you want to make sure your trojans run on as many machines as possible.

Except that not everyone looking at Linux's source code is motivated by end users' best interests.

Linux is a secure OS. And so is Windows.

Run As, suDown, suRun, DropMyRights. Not to mention that this has nothing to do with Microsoft. If third-party software refuse to adhere to safe practises (except for the programs that obviously need admin rights to run), then there's nothing Microsoft can do.

Sources, please. How exactly?

Best one I've heard yet. How so, exactly?

 

Arup, forget it, he's not reading.