

Linux Trojan rears its ugly head  - helwr
http://www.sophos.com/blogs/chetw/g/2010/06/12/linux-malware-rears-ugly-head/

======
alttab
The title is inflamatory, sensational, and misleading - albeit effective.

As others have pointed out, this isn't a "linux trojan" as much as it is a
"software source code repository hack."

Dropping a trojan into someones unguarded source repository can happen on any
system. This isn't anywhere close to a "security breach" for linux because
people still had to download and compile source.

This raises an interesting question - do you trust the source you build? But
that's a different issue. The closest thing to Linux security issues is the
null pointer bug which allows arbitrary execution as root. And that's like one
in 25 years as far as I know.

~~~
JoachimSchipper
"One in 25 years" is far too optimistic (see e.g.
<http://secunia.com/advisories/product/2719/?task=advisories> \- the NULL
pointer bug was exploitable only from programs already running on the host, so
most of these "count" by your criteria), but yes - the article is nonsensical.

------
rbanffy
<sarcasm>I am so scared by this. You mean, a program I run can do things I
don't expect it to do? Oh my... This is _huge_!</sarcasm>

No, really.

As far as we can know, every instance of Oracle RDBMS, PeopleSoft, AutoCAD,
PhotoShop, Windows, Exchange, Office and SQL Server may harbor any number of
backdoors. We will never know, since, as the article points out, we cannot
examine the source code. And Sophos probably won't know either unless the
maker is lame enough to include a fingerprintable backdoor.

If you are a package maintainer, you should always get your source off the
tagged releases in the version control system. That way you can always test
your build off trunk/head/whatever-the-most-current-version-is and ensure
that, when the next release becomes adopted, your package will be fine.

If you are a Linux sysadmin and you are not using package management, you are
insane. Or you will be, shortly. Even if you have to use the "yesterday"
release, you should build your own package.

------
bediger
This is a few weeks old right? Where did it go from there? Are we (linux
users) all infected with lots of rootkits and file infectors and worms? No.

The interesting question is not "Are linux machines infected with a cloud of
malware like Windows machines?" but rather, "What factors contribute to
Windows malware that don't exist for Linux?". That is, on a technical level,
Linux is just as vulnerable as Windows. Fred Cohen did his initial experiments
on a a 4.3BSD machine in the early 80s, so we've know about the vulnerability
all along.

Linux just doesn't accumulate the uncountable legions of malware that Windows
does. It can't really be "market share", as even at 1% of all users, Linux
desktops probably count higher than MS-DOS did in 1988, when the "Brain" virus
swept through the population. So, this Sophos-employeed blogger should shy
away from his name-calling, and start researching the really interesting "why"
to see if it can't be applied back to Windows.

~~~
shin_lao
One solid technical reason is that most Windows users run as Administrator
(root) which eases the spread of malware.

In addition, the lack of uniformity makes it more challenging to write an Unix
virus. You'd need to have the worm recompile itself on the target machine, as
did the Morris worm in 1988. That greatly increases complexity and cost.

Many Windows worms target a specific client/OS pair. That means the worm will
require you to run, say, Outlook Express _and_ Windows XP. That sounds pretty
specific, but the potential target size is so huge that the virus author can
allow itself to be that restrictive.

Let's imagine a disease that could contaminate only one human being out of a
hundred.

How fast do you think the disease would spread compared to one that can infect
ninety human beings out of a hundred?

Why bother write a malware that has got - even if it's perfectly written - an
order of magnitude less chances to spread?

~~~
Cliffer_ny
"Why bother write a malware that has got ... an order of magnitude less
chances to spread?"

That's plain wrong. Read Rick Moen takes on the subject here:
<http://linuxmafia.com/~rick/faq/index.php?page=virus#virus4>

~~~
shin_lao
I don't know this Mr. Moen, but the fallacy may not be where he believes it
is.

When writing an exploit you need to know the kernel, libc and apache version
to make your buffer overflow work, because memory layout is important - if
it's a buffer overflow. There are so many apache builds, that makes things
difficult for a worm (but not for a targeted exploit). Not impossible, but
more difficult.

On Windows, the build is uniform.

Additionally, servers are less interesting targets since they are more
monitored and operated by administrators. If your plan is to have as many
zombies as possible, not a good idea.

Last but not least, a lot of virii and trojans use mail and the web as a
channel. AFAIK you don't read mails and visit web pages on servers.

If the underlying argument is that there are less virii on Linux because it's
more secure than Windows, this is wrong.

It's difficult to "measure" security and I really don't want to have a Linux
vs Windows debate, but Windows cannot be considered as an insecure operating
system anymore. User's behavior on the other hand, is still problematic.

------
gcr

      The authors are now GPG-signing their releases to allow their customers to determine the validity of an archive.
    

I'm inclined to mistrust an article that calls users of an open-source IRC
server "customers".

------
nailer
It's an IRC daemon. Weren't half of these trojaned anyway? Most of these may
as well have been written by the past equivalent of 4Chan.

------
dododo
sophos anti-virus wasn't able to detect compromised binaries or source until
nearly 2 years after compromise, just like the rest of us. sounds like
software i don't need.

(and that's assuming you get their on-demand scanning working (talpa) which
only seems to work with out of date kernels.)

