Subject: Thinking ahead - LotD

From: "Arik" <[email-masked]>
Date: Mon, 15 Dec 2003 14:48:01 -0000

Hello all

#ifdef    RMS
#define   Linux   GNU/Linux
#endif

I was thinking... big mistake, I know, but hear me out.

Let's say that Linux on the Desktop becomes a reality. Like Windows 
today, it is everywhere you look. Your grandmother fires up her laptop 
and the chubby penguin greets her before her desktop comes up with her 
favorite email program already running. Hey, that's how it was before 
she shut it down.

Granny goes on to read the new mail she got from her grandchildren, and 
she answers that if they want to come over after school she had made 
great cookies and will serve them with milk.

Then on to the next email, which looks kinda strange. It has this 
attachment thingie, that gramma knows means she has pictures with her 
email. She eagerly opens the attachment, ignoring the security warning 
as usual. Strange... nothing seems to happen. Oh well, probably not 
important after all.

Viruses don't have it easy with Linux. Privilege separation, read-only 
system binaries and stuff. In the age of the Internet, sharing software 
with a friend in not very common anymore, usually you get pointer to the 
URL rather than the binary. Illegal software swapping on P2P networks is 
another issue, but it's limited to the swappers, and there's less 
illegal software for Linux, maybe even little enough to stop any virus 
for lack of critical mass of propagation.

Security bug related worms will undoubtably persist to some degree. 
There's just too much damn code, dammit. Heterogeneous environments will 
hopefully reduce this problem to a manageable degree, and sane security 
practices like secure-by-default and 
don't-run-that-daemon-unless-you-need-it would help keep these at bay.

The problem I'd like to raise is the grandma-clicks-on-attachment 
problem. The newbies. The uninitiated. The security unconscious. One 
wrong click of a mouse, and your computer is a lean, mean, 
spam-spreading worm-infested Linux machine.

One way to deal with the problem is to learn from the competitors: 
Install "anti-virus" on the workstations. How would a Linux "anti-virus" 
(or rather anti-human-propagated-worm) work? Will it listen on file 
systems with write-access and detect written files? Or use hooks in the 
kernel and scan executables which are about to run? How about some 
generic file-scanning API that mail clients would inevitably all use to 
scan attachments before opening them?

Is it feasible to run an open virus/worm registry? Would distributions 
include it as part of the security updates effort? How about generic 
detection?

How about some Trusted Computing... Stop that. Stop it, will you stop 
that. Now look, no one is to stone anyone until I blow this whistle. 
*Even*...and I want to make this absolutely clear...*even* if they *do* 
say "Trusted Computing"! Aargh....

But really, some central repository of signed binaries, maintained by 
the distributions and signed with the distribution key, and the kernel 
only runs trusted binaries for users who are not in the "runall" group...

What do you think? What's feasible? What's horse-dung? Do you have any 
other ideas? I'd like to know.

-- Arik

---

From: Omer Zak <[email-masked]>
Date: Mon, 15 Dec 2003 17:05:53 +0200 (EET)

> #ifdef  RMS
  #ifdef Linux
  #undef Linux
  #endif /* Linux */
> I was thinking... big mistake, I know, but hear me out.

Hooray, another thinking sentient being!

> as usual. Strange... nothing seems to happen. Oh well, probably not

Her eldest grandson (who is NOT the mischievous type) has already set her
E-mail program up so that it runs only inside a sandbox, which is inside
an UML instance.

There is an automatic script, which saves her newly-saved E-mail outside
of the UML.  This script is activated by the outside machine and reaches
into the guts of the UML.

Then, no matter what viruses, worms or stupidware runs inside the UML, its
effects don't propagate outside of it and don't cause data loss.

> ... One

The outside machine will also have a firewall and a module, which prevents
too much spam E-mail from going outside of the machine.

> scan attachments before opening them?

How about taking a lesson or two from Worsel (from the E.E. "Doc" Smith's
Lensman series) about the potentials of a multi-compartmented mind, which
can isolate its compartments from each other?

> other ideas? I'd like to know.

Definitely neither horse-dung nor bull-shit nor saddam-face.
                                             --- Omer
My opinions, as expressed in this E-mail message, are mine alone.
They do not represent the official policy of any organization with which
I may be affiliated in any way.
WARNING TO SPAMMERS:  at http://www.zak.co.il/spamwarning.html

---

From: Tzafrir Cohen <[email-masked]>
Date: Tue, 16 Dec 2003 02:09:06 +0200

> as usual. Strange... nothing seems to happen. Oh well, probably not 

The problem is that a picture attachment should not be "opened". It
should be "viewed". "open" implies that anything can happen. A viewer
should not be able to cause any harm to the system, whatever content it
is showing.

> scan attachments before opening them?

"anti virus" is good for catching yesterday's worm. However in linux the
software packages typically update pretty fast, and therefore they are
expected to close most holes within a matter of days. This is about the
same resposnse time you can expect from an "anti-virus" vendor.

> include it as part of the security updates effort? How about generic 

clam-av. But again: this is the solution to the wrong problem.

> other ideas? I'd like to know.

What about scripts?

  cat file |bash

How could bash know that "file" is an "unsigned binary" (err.. script)

-- 
Tzafrir Cohen                       +---------------------------+
http://www.technion.ac.il/~tzafrir/ |vim is a mutt's best friend|
mailto:[email-masked]       +---------------------------+

---

From: Oleg Goldshmidt <[email-masked]>
Date: 16 Dec 2003 08:34:54 +0200

> same resposnse time you can expect from an "anti-virus" vendor.

Strictly speaking, this implies the currently prevalent mode of virus
protection that recognizes viruses by individual "signatures". Besides
looking for "yesterday's worms" this is inherently non-scalable in the
face of potential future threats. [1]

This is one of the areas where - in principle - AI-like approaches
may prove more robust and scalable. I know that AI is a dirty word (or
is it two words?), but we already have successful spam filters based on
Bayesian detection and such. Note that the mechanism need not
necessarily be English-word-based.

[1] As an aside: it should be possible to write a Linux virus that
    would exploit a local "priviledge escalation" vulnerability like 
    the recent kernel hole, I suppose. Details left as an exercise to 
    the other kind of hackers.

-- 
Oleg Goldshmidt | [email-masked]

---

From: "Nadav Har'El" <[email-masked]>
Date: Tue, 16 Dec 2003 09:35:44 +0200

>     the other kind of hackers.

Of course, but how would such a virus spread? Most Linux users I know aren't
in the habit of copying binaries from each other, or running binaries sent
to them by email.

If you're thinking about spreading the virus from a central binary repository,
well, this already exists (it is called a compromised download site).

If you're thinking about spreading the virus over the Internet by exploiting
remotely-exploitable holes, well this already exists too - it is called a
worm. Several Linux worms have been spotted over the years, as well as worms
that worked across different variants of Unix. I myself saw at least one
succeed to crack my machine (it was not a "famous" worm, but it was certainly
a completely automated process), and a few others try.

-- 
Nadav Har'El                        |     Tuesday, Dec 16 2003, 21 Kislev 5764
[email-masked]             |-----------------------------------------
Phone: +972-53-790466, ICQ 13349191 |Despite the cost of living, have you
http://nadav.harel.org.il           |noticed how it remains so popular?

---

From: Oleg Goldshmidt <[email-masked]>
Date: 16 Dec 2003 10:26:00 +0200

"Nadav Har'El" <[email-masked]> writes:

> Of course, but how would such a virus spread? Most Linux users I
> know aren't in the habit of copying binaries from each other, or
> running binaries sent to them by email.

I am thinking of the golden age of world domination when there will be
lots of Linux users you don't know ;-). An example would be an Israeli
govenrnment employee who was "migrated to Linux", got an attachment in
the mail, clicked on it, got some sort of desktop-de-jour prompt
saying "are you sure?", and clicked "yes, of course, who do you think
I am!?".

Then the app could get root privileges because the IT didn't patch the
kernel, scan the list of users in /etc passwd etc, go over possible
address books starting from .mailrc down to .kab or whatever, and
proliferate.