Free Republic
Browse · Search
General/Chat
Topics · Post Article


1 posted on 11/29/2010 5:35:07 AM PST by ShadowAce
[ Post Reply | Private Reply | View Replies ]


To: rdb3; Calvinist_Dark_Lord; GodGunsandGuts; CyberCowboy777; Salo; Bobsat; JosephW; ...

2 posted on 11/29/2010 5:35:33 AM PST by ShadowAce (Linux -- The Ultimate Windows Service Pack)
[ Post Reply | Private Reply | To 1 | View Replies ]

To: ShadowAce
Unix and Linux-based operating systems are much more secure than Windows due to compartmentalization, kernel isolation, and file level security. However, there are NO operating systems that are immune to malware/viruses.

Windows focused on functionality while unix/linux focused on stability and security. MS grabbed market share . . . and the vast majority of the viruses.

3 posted on 11/29/2010 6:26:01 AM PST by DesertSapper (God, Family, Country . . . . . . . . . . and dead terrorists!!!)
[ Post Reply | Private Reply | To 1 | View Replies ]

To: ShadowAce

Tech Bookmark.


6 posted on 11/29/2010 6:54:11 AM PST by Sergio (An object at rest cannot be stopped! - The Evil Midnight Bomber What Bombs at Midnight)
[ Post Reply | Private Reply | To 1 | View Replies ]

To: ShadowAce
The archtypical exploit, buffer overrun, was born on Unix before Windows even existed.

And although Unix had a reasonably sophisticated concept of file priviliges (especially for its time), default file privileges were kind of loose. This was to be expected in the cooperative, non-adversarial environment in which Unix arose.

The password mechanism was innovative, in that passwords were not stored in plain text, but were encrypted, using each password as its own key. This led the designers to make the user file, with its encrypted passwords, publicly readable. That allowed for extensive brute-force attempts to crack the password file, after it was copied somewhere else, off-line.

And with any reasonable number of users, at least one user would have a trivial password (this was before there was any built-in enforcement of password complexity). A colleague of mine wrote a snooper program that examined the passwd file for trivial passwords, and reported the results to him. He was continually uncovering trivial, and therefore, easily hackable, passwords.

Therefore, you could hack into the system by guessing passwords. Then, you'd go straight to the password file and ftp it to your own machine. Then, you'd go to work exhaustively testing random passwords, encrypted against themselves, against all entries in the file. You might get lucky and hit on somebody with real privileges, and of course then you were in, with whatever privileges the hittee had.

Of course, if you knew the exact structure of the shell object code, you could log in from Joe Schmo's non-privileged account, and fill the password field with a long string that would overwrite the critical part of the su command handling code with instructions that would simply make you super-user on the spot. Then you were also in, wihtout having to guess the password of any user with real power.

12 posted on 11/29/2010 9:07:24 AM PST by Erasmus (Personal goal: Have a bigger carbon footprint than Tony Robbins.)
[ Post Reply | Private Reply | To 1 | View Replies ]

Free Republic
Browse · Search
General/Chat
Topics · Post Article


FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson