Software flaw threatens Linux servers

C|Net ^ | November 28, 2001, 1:50 p.m. PT | Robert Lemos

[Bush2000]

What is your main argument or evidence for this claim? I am skeptical that someone carried out security research that damaged real people just to embarass Microsoft. This isn't an attempt to bait you, just curiosity.

There have been several IIS exploits publicized recently, for example, without giving Microsoft the benefit of a warning. Clearly, these exploits were intended to embarrass Microsoft -- not make its products more secure. If you give me time, I can probably dig up the exact references; however, my memory is pretty good on this issue.

[Bush2000]

Indeed, in some cases this line is clear while in others it's not. And sometimes (albeit rarely) even when it clear there may be legitimate reasons to cross it and let the chips fall where they may.

Your arguments are sound. I can't disagree. The real question is ... who decides where that line is.

[Bush2000]

We use pro-ftp on our servers and we use linux. We don't have the problem. To blame the bug on Linux would be like blaming Microsoft for a bug in a AOL's software.

As long as wu-FTP is distributed with some of the major Linux distros (Redhat, etc), from a customer perspective, it is a Linux problem, regardless of anyone's attempts to "qualify the problem space." By the same token, customers consider IIS bugs to be Windows problems, not IIS problems. That's because the primary installation vehicle is Windows.

[supercat]

This is an important and very good question. It really highlights an argument made by one of the chief Open Source advocates: Eric S. Raymond. He wrote a paper called "The Cathedral and the Bazaar," in which he compared projects which used a top-down approach, vs. projects which use a more chaotic approach. He argues that the "Bazaar" approach gains the benefits of less bugs, and quicker bug fixes.

I just looked through another paper at that site: The Magic Cauldron. Here were my comments to that piece...

Interesting paper. Does a pretty good job of explaining market behavior for 'free' or 'open-source' software. There are a few points that I noted as I thought I'd share.

1. You state "Throwing the patch in the pool may gain nothing, or it may encourage reciprocal giving from others that will address some of J. Random's problems in the future.". The real payoff that JR may hope for, which you allude to above but should also mention here, is the incorporation of the patch into future versions of the software so that he won't have to re-apply it himself. This payoff does not depend upon any one else's reciprocity or generosity.

2. There are a few problems with source-sharing which you don't really mention:
   1. If someone develops an algorithm or piece of code which would potentially be useful to ten other people 'somewhere', any effort to publish it in such a way that those ten people can find it will likely cause extra man hours to be spent by those not interested (if it takes 7500 people one extra second to read through a list of patches, that's over two man hours' of time spent by those who got no benefit from the software). Unfortunately, it's often hard for a programmer to help his code find the people to whom it will be of use.

   2. Oftentimes products are a lot junkier than vendors want to admit. In some cases, this amounts to deception on the part of the vendor; in other cases, especially with code that has a finite useful lifetime, the quality of the code really doesn't matter to the client if it does what is needed but the vendor's image would nonetheless be harmed if the quality of the code were known.

      As an example of the latter, I have sometimes had to do one-time conversion of data from one format to another. There was a certain amount of data to be converted, and once that was done no more data would ever be created in the former format. If the conversion is checked for correctness, and the code performs the conversion in an acceptable length of time, the quality of the code is irrelevant. In such cases, I'll often spend half an hour cobbling something in QBASIC rather than write a 'real' program to do the job. Ugly, but it works.

      On a related note, any software which is to be shared must be documented. While documentation is important for any software whose useful lifetime might last beyond the programmer's ability to maintain it, it's often not terribly relevant with one-time-use programs such as I mentioned above. If it takes me half an hour to throw together a program to do some data munging but would take an hour to document it, that documentation is using up time that could have been spent to write two other similar programs.

   3. One reason hardware vendors are often loath to publish hardware details is that then such details often end up being "locked in stone". A vendor who hides hardware details behind a closed-source device driver may feel free to make hardware changes that break existing drivers if new drivers can deal with the change. By contrast, any vendor who does so after publishing the hardware details risks the wrath of many irate customers.

3. It's interesting to note the mention of DOOM. The phenomenon was actually more pronounced with Quake, and ID scored a major marketing coup with its balance of open vs. closed code.

   In particular, the rendering code and such were kept closed, but nearly all of the information required for someone to patch the game as they wished was open. ID's major coup, though, was allowing only certain 'standard' levels to be run on the free version of the game while allowing custom levels to be run on the purchased version.

   In earlier 'teaserware' games, a player would get 6-10 levels as a 'teaser'; paying $20-$50 would get the player an additional 20-50 levels. In Quake, the 'teaser' is similar (7 levels), but the payoff for buying the game is much greater: not only does the player get 20 more Quake levels, but he also gets the ability to play thousands of levels developed by other people. Compare the value of, e.g., Jill of the Jungle (30 extra levels for $20, or $0.66/level) with that of Quake (1,000+ extra levels for $50, or less than $0.05/level). It's pretty clear which is a better value.

4. In the early days of video games, hardware was sold well above cost. Today, much video game hardware is sold at or below cost, with the manufacturer making its money off royalties paid by software developers. While this type of system has pros and cons for everyone involved (manufacturer loses money selling hardware, but its lower sale price contributes to widespread adoption of the system; this benefits everyone, but software developers and customers have to suffer royalty payments) It's not clear how an open-source environment could work in this context, though some ways exist by which manufacturers could be assured of royalties even by open-source developers.

[supercat]

To blame the bug on Linux would be like blaming Microsoft for a bug in a AOL's software.

If some of AOL's software were installed by default with Windows, and if AOL bugs caused problems for users (whether or not they wanted to use AOL per se), that would be a Windows problem, since whoever put the software on the machine is responsible for it.

[Don Joe]

You found an NT driver -- running -- in the CMOS?

Years ago, I bought a BIOS upgrade from DTK for my 286, because there was some bug in the earlier BIOS that screwed up my PDS (either 6 or 7, can't remember).

When the chips arrived, I put them in my machine, and it wouldn't boot.

After quite some time pulling my hair out, I put the old EPROMS back, and read the new EPROMS into my burner, and read them to files. I then ran a little utility I'd written earlier, which interleaved their bytes, so that I could examine text strings that were split between the two chips.

When I loaded the output file into list.com, I saw text strings containing the phrase "DISK KILLER".

DTK's binaries were infected with the "DISK KILLER" virus, and they merrily went about their business burning BIOS sets and shipping them to customers.

To make a long story short, they didn't know a thing about it until I called them. I'd never heard a giant puckering sound in Chinese before. When they sent me the replacement chips, they worked OK.

The moral of this story is that I can't fathom how a trojan could copy an operating system driver file into a BIOS, and still have a bootable computer, let alone one that boots, and runs the driver too!

Am I misunderstanding your post?

[Don Joe]

In the article you quote Microsoft is arguing that security companies shouldn't provide an step by step instruction manual on how to exploit a new bug. I and most other IT professionals agree.

It is sufficient for the software company to say there is a problem, explain (in general terms) how the exploit is performed, and provide the patch. There is no need to provide script kiddies with an instruction manual.

I get the sense that the self-described "open source" advocates-cum-"supporters of information anarchy" paint a picture of a binary world: their side preaches "openess", and damns the other side, which it accuses of "security by obscurity".

In reality, there's a third option, which they refuse to consider. It's detailed quite nicely in that article.

Let's use a "door" metaphor. The "open" folks deride the more prudent homeowners, accusing them of "trying to make their homes secure by hiding the doorknob instead of buying a lock." Yet, they themselves continue to experience one break-in afer another.

Along comes a little boy, who was driven out of his last hometown after he pointed out that the emperor was naked. He looks at the situation, and tells the "open" people that he knows what their problem is.

Before he can say anything else the Head Open Guy pipes up and says "Look, kid -- we've got the best locks available, and we're constantly making them better. And because we're Open, we encourage others to work on the locks too, so that lock technology can evolve at an even faster pace. We fully document everything, so that they can get up to speed quickly."

The kid shakes his head, looks the HOG in the eye, and asks, "Are you done now?"

The HOG says, "fine, say whatever you want to say, but make it snappy; we've got a bunch of people in the next town that are getting hit really hard, and we've got to get an improved lock to them pronto!"

The kid says, "This won't take long. The problem with your locks is simple -- no matter how secure you make them, you persist in displaying picking directions on each one of 'em! You might as well not even bother having locks in the first place, because you're giving the thieves a blueprint to defeat them."

At this, the HOG shook his head, muttered an obscenity beneath his breath, and shot the kid.

[Don Joe]

"Anymore than I'm going to argue with someone who believes in witchcraft about Harry Potter."

This is not a sentence.

[Don Joe]

"shouldn't provide an step by step instruction manual on how to exploit a new bug."

"That's Microsoft's characterization. Not everyone agrees that's what security companies are doing."

The Script Kiddies seem to be happy with it. And they seem to be validating what oc-f said about it too. Did you even read that article?

[Don Joe]

"Please he'p us, Dom'nic."

Heah ya go, son. Have y'all some jaw'vah.

[Don Joe]

"Notice how happy the MS women are when _one_ UNIX-related exploit finally makes press"

Oh, tres drole! The "MS women" -- how wry, how pithy!

Then again, I'd expect nothing less than that level of brilliance from the Unix Eunichs.

BTW, if you really believe that there's only "_one_ UNIX-related exploit", your hard drive must be smokin' some fahn sheet, man. Um, I meant "man". Sorry 'bout that, y'all.

[Don Joe]

"people that know _both_ windows and UNIX agree that UNIX is the superior server."

Ah, the "people that know.." gambit.

OK, I'll play that game too. "People that use UNIX eat feces and pack fudge, and agree that Bill Clinton was the best president in the country's history."

As to whether the "people that" populate your example outnumber those that populate the example I provided, well, since neither of us has provided anything to address that aspect of the discussion, it remains unknown.

By the way, has anyone mentioned to you that your attitude epitomizes everything that makes normal people hold the Eunichs in contempt? Your smarmy attacks, cheap shots, and smug arrogance all rolled into one cloying, syrupy sweet bolus is a caricature of itself. And a good one, too!

[Don Joe]

The "big" security firms are as tangled up with Microsoft as everyone else, and they would also probably like to see their lives made easier too. After all, malicious attackers have been laying waste to Windows for years.

Oh, this is great!

First, you let us know that nobody is with 'em, then you let us know that everybody is with 'em! Spin, spin, spin.

Don't forget to take your Dramamine!

Are you related to Casey Stengle? Your argument is frighteningly reminiscent of his, "no one goes there, it's too crowded" line.

This campaign against “information anarchy” isn’t about "being responsible." It's about public relations. Otherwise, why characterize anyone who disagrees with the Microsoft position as an “anarchist”? Do you advocate INFORMATION TOTALITARIANISM?

Yup, it's Binary Blade, the Sailor! (Sung to the tune of Barnacle Bill...)

Anyone who doesn't put lockpick directions next to the doorlock is a TOTALITARIAN!!!

BTW, you forgot the part about shooting the kid.

I would note that published attack scripts are not a threat anyone running a secure OS.

Translation: "I would note that published lockpick directions are not a threat anyone with armed guards."

Barnacle, I'm afraid you Just Don't Get It. But don't feel bad. The syndrome is common to the Eunichs community. Perhaps hormone injections might help? :)

[Don Joe]

"By releasing the answers, Newsweek made the test 'obviously' worthless (whereas before it would have been 'deliably' worthless, since there was bound to be an unknown and unmeasurable amount of cheating)."

The difference is, when a test is rendered useless, they can put testees on hold, and quickly issue them new questions. When an OS compromise is cast to the four winds, millions of people suffer billions of dollars worth of damage. People may even die.

To the anarchy-purists, those are matters of little or no import.

Back when I was going to photography school, there were certain people who were of a similar doctrinaire philosophical bent. To those people, commercial photograpy was "prostitution", and anyone who would actually create something as requested by a client was nothing more than a whore.

Reality never seems to be much of a consideration to the taliban wing of any endeavor.

[Don Joe]

"We use pro-ftp on our servers and we use linux. We don't have the problem. To blame the bug on Linux would be like blaming Microsoft for a bug in a AOL's software."

Logic like that never stands in the way of the Eunichs. They play the double corner of the checkerboard. You move in for the kill, and they squirm over to the other box, and vice-versa.

They pile on the lies thick and heavy about Windows. When you finish debunking them, they act as if they never even mentioned them, and launch into "Did you know that Bill Gates is an Athiest?" style anti-MS rant.

[Justa]

"I can't fathom how a trojan could copy an operating system driver file into a BIOS, and still have a bootable computer, let alone one that boots, and runs the driver too!"

Why, flashing bios is nothing difficult for a virus. I don't see the difficulty in flashing an additional controller driver into bios.

On a suspect 440BX-2 motherboard I put in a blank HD that had been stored for 11 months then loaded DOS 6.22, then Windows 3.1. In both installs I found two comm.drv files of differing sizes and dates. 3.1's install was buggy so I went to '98. When I upgraded to '98 I had dual instances from kernal32 and the OS installed the hardware twice. Once on one boot, then again on a second boot. Both the comm.drv's were in '98 as well. At the second boot the CPU usage would spike to almost 100%. It was rather straight-forward. In '98 I checked the properties of the newer driver and it identified itself as the "NT5" version. This occured via a blank HD and write-protected archive media that hadn't been used in years.

In any event to be sure about what I'd found I isolated the worm to a CDR and after cleaning the network chose a machine to recreate the problem. I infected and cleaned it 3 times to be sure of the infection course and how to clean it. Trend, Symmantic, AVG, and McAffee all reported the sytstem was 'clean' when it was infected with the driver and/or the virtual root trojan.

The fix was a bit drastic but it worked:

1) write 0s to the drive, power off, remove the HD.

2) Flash the bios, power off and remove the CMOS battery for a min. 3) Reconnect, reinstall.

That's the only thing I found which worked. If I just zeroed the HD it would load up with the NT5 comm.drv sending calls to the OS, ergo it was in bios. You do know the NT5 comm.drv is a network comm.drv? I had no intention of that owning my NT4 machines.

[Blade]

You are very eloquent. So was Bill Clinton.

[ShadowAce]

Reality never seems to be much of a consideration to the taliban wing of any endeavor.

As you so elegantly prove with every post.

I use both Windows and Linux. Why? Because each has a tool I require. Linux is mainly in use as my network firewall/router, because of the security and cost benefits it provides. Windows provides access to applications I use. The OS is a tool--not a religious/fanatical experience.

[oc-flyfish]

-reliable remote administration

Windows has this, but what do I know...

-uptime in excess of 600 days (obviously not windows servers then)

Gee, you never patch your servers huh? I wouldn't want to work at your company if you only patch every 1.5 years. My NT based web server ONLY gets rebooted when a new patch is released. There is never a need to reboot otherwise.

Notice how happy the MS women are when _one_ UNIX-related exploit finally makes press (this software also runs on windows motards)...and this is one which can only be used when anonymous access is turned on anyway, so it doesn't pose a threat to any admin worth a damn. compare this to the win32 exploits which have come down the pipe this year, which _all_ windows servers were vulnerable to.

Sorry Charlie wrong again. If you subscribed to any of the security mailing lists you would know that Unix has just as many exploits discovered as Windows. Don't believe me, subscribe to the SANS Security Alert Consensus newsletter.  It is a weekly digest of new exploits for all platforms (Windows, Unix, Linux, BSD, Solaris, Network Appliances, etc..) Your eyes will be opened my friend.

I know some of the windows people on this list are happy to finally see something bad come down the pipe re a UNIX-type server, but that is because they so desperately cling to their world where clicking a next button qualifies them as being a system administrator.

Finally? Have you been living in a cave? What about the recent Sadmind, and BIND exploits? Were they just lies put out by Microsoft's media relations department?

Setting up enterprise level software _is_ difficult. It can be made easier by introducing WYSIWYG admin tools, and fancy GUI, but for the most part, you get what you give. and when you give next to nothing (setting up a windows server) you get next to nothing (a windows server)

I agree that setting up enterprise software is difficult on all operating systems. It takes me roughly a day to harden (if you don't know what this term means than please go look it up) a NT server. The broader problem you are talking about is having an admin take the default settings of any operating system and then placing the machine on the Internet. Be it Unix, Linux, or Windows the machine has exploits out of the box.

you need qualified administrators , not inept fools.

Agreed. The problem with poorly trained admins exists on all platforms. Are you trying to say that ALL Unix admins are brilliant and never make mistakes? Don't make me laugh.

[oc-flyfish]

The "big" security firms are as tangled up with Microsoft as everyone else, and they would also probably like to see their lives made easier too. After all, malicious attackers have been laying waste to Windows for years.

Oh, I see... it's all part of some vast global conspiracy. You asked for examples and I provided them.

The Code Red and Nimda viruses were incapable of executing on non-Windows machines, and they caused billions of dollars worth of damage to production data. Tell me, what vulnerability that is specific to all flavors of UNIX/Linux and only to UNIX/Linux has ever caused that kind of financial pain?

First of all I think everyone agrees that these figures are WAY blown out of proportion. BIND is a recent Unix exploit that comes to mind. Screwing up a DNS record can cause your website to be unvailable to customers. Large commerce sites can loose thousands of dollars per hour if their site is not accessible.

This campaign against “information anarchy” isn’t about "being responsible." It's about public relations. Otherwise, why characterize anyone who disagrees with the Microsoft position as an “anarchist”? Do you advocate INFORMATION TOTALITARIANISM?

This is where you and I disagree. I think the proposal is reasonable and will benefit the industry. Please don't try to associate me with facisism, totalitarianism, or communisism... that obscures the point.

I would note that published attack scripts are not a threat anyone running a secure OS.

You are so full of it. Are you doing to say the Unix is a secure OS and there are never exploits on it? Get real. The OS is never secure it can only be hardened.