Posted on 01/10/2004 12:20:46 PM PST by Bush2000
Flaws raise red flag on Linux security
But many users remain confident about the security of the open-source environment
Story by Jaikumar Vijayan
JANUARY 09, 2004 ( COMPUTERWORLD ) - A report earlier this week about a critical flaw in the Linux kernel was the latest in a series of recently discovered security problems with the popular open-source operating system. But many users were unfazed by the report and said Linux remains a solid and secure environment for running enterprise applications.
Poland-based iSec Security Research on Monday said it had found a critical flaw in a function used to manage virtual memory on Linux systems (see story). The flaw affects the 2.2, 2.4 and 2.6 versions of the Linux kernel, according to iSec.
The vulnerability could allow attackers to take administrative control of compromised systems and run attack code of their choice, an iSec advisory stated. ISec claimed that it had developed and successfully tested code that was capable of exploiting the flaw, although it added that actually launching such an attack wouldn't be easy.
The news follows the discovery of a similar flaw in the Linux 2.4 kernel last fall. In November, unknown attackers used that flaw to take down several servers belonging to the Debian Project, which produces a noncommercial Linux distribution. And last month, an attack on the Gentoo Linux Project compromised a server that was being used to download copies of Gentoo's Linux source code by users.
The rise in such incidents can be attributed to Linux's growing popularity, which makes it a more attractive target for malicious attackers, said David Wreski, CEO of Linux security vendor Guardian Digital Inc. in Allendale, N.J.
"The underground hacker community is very interested in Linux as a potential target," he said. "Because of the accessibility of the source code to everyone, it provides an equal opportunity for malicious attackers to find vulnerabilities and ways to exploit them."
Even so, Linux remains a secure environment, said John Cahill, senior network security engineer at Piedmont Natural Gas in Charlotte, N.C.
"I would say it is more secure than Microsoft and other environments because the code is looked over by so many people and it's so widely available that any vulnerabilities can be quickly identified and patched," Cahill said. Piedmont uses Linux for several e-mail-related functions and is considering its use for antispam purposes.
"There's not very much we've needed to do to secure Linux [applications]," said Joe Poole, manager for technical support at Boscov's Department Stores LLC in Reading, Pa. The company runs several virtual Linux servers on its mainframes that are protected by network and internal firewalls. All nonessential services, such as file transfers and Telnet, have been disabled. But there has been no need for the kind of constant patching and maintenance required for Windows, Poole said.
Linux distributors in general are also doing a better job of shipping products that have nonessential services disabled by default, said Paul Schmel, adjunct information security officer at the University of Texas at Dallas.
"The biggest plus that Linux has is that it's designed to allow users to be users and not administrators," Schmel said. "What Linux has that Windows doesn't have is ease of configuration from an administrator's standpoint. Stopping and starting services, configuring services to only respond on certain ports and interfaces is dramatically easier than it is with Windows."
Excuse me, Bush... on second thought DON'T excuse me... but exactly what access level does a new installation of Windows, on either an old or new computer, present to the user at completion? Oh, Administrator Access... thought so.
No, Bush, it isn't. Go out, find 100 home or small business Windows users at random and check the percentage that are NOT running at Administrator level. I would be very surprised if the percentage was more the .1%... in other words, 99.9%+ are operating at Administrator level.
The vast majority of individual Windows users don't even know they can set up a seperate account for Junior, much less set "arbitrary privilege sets." On almost every small business LAN I have worked on where there was an internet router, even those set up by "consultants" or "experts," I have found that they are using the default addresses set by the router's manufacturer and the firewall is off.
No, Bush, it required connecting to a Local Network with a HOSTILE LDAP server... a very remote possibility... that can be prevented by changing ONE user setting.
Why don't you move into the REAL WORLD, Bush.
In the real world users are handed a box that boots into ADMINISTRATOR ACCESS and very few users are sophisticated enough to restrict their own default access.
In the real world Windows installers install Internet Explorer, Outlook, and a host of other applications that 99.9999% of Windows users think is part of their computer''s suite of WINDOWS software.
In the real world, Microsoft installers finish the job with the Messenger Service turned ON... so they and others can pop ads into your browser.
In the real world, Bush, many people buy an off-the-shelf upgrade so they can bring an older computer into the wonderful world of Windows XP.
In the real world, some even buy full installation versions so they can build their own boxes.
In the real world people want to install and USE software rather than just sit there and admire the Kernal of Windows doing nothing so they can be totally secure.
Of course, according to you, everyone of them is "practically no end user."
Then of course, Bush, there are the millions of users who aren't upgrading and are still using '98, 2000, NT, ME, etc. that are still Windows users at risk.
Bush2000 wrote:Actually, IE can be made to access a malicious web page if you view a maliciously constructed e-mail message in Outlook Express. That kind of exploit can affect a lot of users and compromise a whole bunch of Windows systems.
the rest depend upon an improbable chain of events, such as (a) browsing to a malicious webpage in IE or (b) running a malicious piece of software.
Also, many versions of Outlook Express were configured by default to open certain types of attachments automatically, and an email sent to a user who hasn't secured that "feature" can run a malicious piece of software. Again, this type of exploit will result in a whole bunch of compromised Windows systems.
Bush2000 wrote:The exploit referred to in this article requires access to a local account on the target machine. It almost requires shell access to the target machine, though it might be possible, if you are very, very good and/or very, very lucky, to exploit this vulnerablility with a web hosting account or similar non-shell access account on a particularly poorly secured server.
You don't need an account. A kernel buffer overflow can be hijacked to create an account with elevated privilege.
The vulnerability addressed in this article doesn't allow an unauthenticated remote system to create an account on the target machine. This is true for most Linux Kernel vulnerabilities that have been discovered recently.
BTW, this is the opposite of the MS-Blaster exploit and several other recent exploits to MS Windows. Many of the Windows exploits that have been discovered recently allow unauthenticated remote connections to compromise the target Windows system.
On a server, but likely on a desktop, of which there are millions. You can couple any of those malicious site exploits with the recent ability to disguise the URL of a link. Watch out for following links on bulletin boards like this one if you're on IE.
No, it's the upgrades which are usually purchased. But the upgrade is the same thing, just requires proof of an existing OS (whether installed or by having a CD).
That poor choice has nothing to do with the design of Windows.
Microsoft designed it to be insecure out of the box to make it possible for the average user to do anything he would normally want to, just as the OEMs do. I'd say it does.
Apple produces OSX. It is the OEM. Consequently, I'm not surprised that Apple preconfigures its machines with appropriate accounts. But blaming Microsoft for Dell or Gateway's failure is just BS
The basic architecture of a *nix system for years has had this better structure of user accounts. Microsoft has had their current poor structure since NT.
For Apple, "out of the box" means Apple has preconfigured the machine to its specifications and delivered it to the user.
They configure it to a pretty much standard *nix configuration for security. Dell and Gateway also configure their computers to a standard Windows configuration, as does Microsoft itself when they sell the product. Face it, Windows standards are deficient.
Given Microsoft's recent stress on security, you'd think this would be one good way to help, but hey haven't. Maybe they could up the privileges of Power User a bit and make that the standard user account. But they didn't. I am getting the feeling that, despite all the fine tuning possible with Windows user accounts, privileges are designed in such a way as to preclude being able to do the *nix equivalent of admin and root.
Considering that Microsoft likely gets 50% of the end retail price for Windows XP, that's between 800,000 users (home edition upgrade) and 266,000 users (professional full purchase). Based on what I see on the shelves, probably 600,000 users got Windows from Microsoft in the fourth quarter, 2+ million last year. Doesn't sound like "practically no end user" to me, since we're talking over two million more poorly configured computers out of the box waiting to be exploited.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.