Text 1036, 119 rader
Skriven 2005-04-05 23:28:04 av mark lewis (1:3634/12.0)
    Kommentar till text 929 av MARTIN ATKINS (1:123/140)
Ärende: rooted
==============
-=> MARK LEWIS wrote to MARTIN ATKINS <=-

MA> You have given me exploits that only infect the Windows
MA> environment.

ML> yeah? so? not knowing your level of expertise, i reached into the hat
ML> that most would know... besides, it is not their target that i was
ML> expounding on but their method of egress and expansion...

 MA> That's true. One of the reasons Windows is vulnerable is because it
 MA> is homogeneous. Most Windows users will probably be using IE and
 MA> Outlook Express, it makes them an easy target.

for one, thing, yes... for another, many are so nieve and ignorant that they
would need a clueby4 beating about the head and ears before they would actually
understand the implications... even then, it really takes them loosing stuff
and getting tired of reloading before they really and truely get the picture...

MA> They only infect the local machine as far as i know. Charles
MA> has said that by operating as root when using Linux i am a
MA> danger to other internet users.

ML> yes... take one of the above types of critters and it'll be using your
ML> system, connection and bandwidth to attack others with...

 MA> You keep saying this stuff but how are Windows viruses going to
 MA> take over a Linux operating system? Do you have a documented
 MA> instance? 

please stop being so myopic about windows virus'... i'm trying to say that it
may be possible for a _similar_ styled virus to be engineered for *nix boxen...
in other words, those that i used as examples move about and infect on their
own without the aid of spam or web pages to carry them about... i can just see
a rootkit tool being appended on to something like those critters that would
pop in thru some hole in some *nix box that hasn't been openly talked about and
poof! there goes the neighborhood! NOTE: once again, i'm speaking of a possible
*nix targeted critter that moves about without the aid of spam or web pages...
i'm not saying anything anywhere near close to what you seem to be assuming
that i am saying... i am NOT saying that a windows virus can or will invade a
*nix box, at all...

MA> The research you need to do is what if any exploits i am
MA> liable to fall foul of by operating as root in the Linux
MA> environment and in what way they would make me a menace
MA> to other internet users.

ML> any time there is a chance that you may be more open to infiltration
ML> one must be extremely wary... there's no telling what some hacker may
ML> stumble upon while developing win oriented critters... IIRC, there are
ML> some critters that can get on to other OS' but whether they do any
ML> damage is another matter... i know for a fact that some 16bit win
ML> critters have been known to get in to OS/2 systems and infect files but
ML> that was the extent of their activity... they never got executed once
ML> in... their infection was done getting in and then stopped there...

 MA> I fail to see what this has to do with operating as root when i use
 MA> Linux.

because root has wide open privs that normal users don't... take some critter
that maybe does use web pages to travel about... for the sake of argument,
let's say that there is a hole in *nix browsers  that this critter can squirm
thru... let's say that this critter targets /etc/rc.d/init.d with a startup
script and that it drops copies or somehow makes links in the necessary rc.d
directories to fire up its payload during system startup...

as a normal user, you don't have direct and easy access to /etc/rc.d/init.d and
such... my normal users haven't, TTBOMK... they've all had to use special tools
or ask me to put stuff in the startup...

that's the kind of stuff that i've been trying to point out...

MA> You may wish to follow this in the Linux echo as taking
MA> up Charles's challange i have thrown my hat in the ring. ;)

ML> that is quite alright... i'm tired of all the petty bickering,
ML> bitching, whining and crying... i'm about to start turning off echos so
ML> that i can read something that actually interests me and that i can
ML> enjoy... LINUX is one of those things but i'll shut it down, too, if
ML> that mess starts up in there...

 MA> The Fido is a public forum. If you express a view in a public forum
 MA> it  is best you first learn to take criticism

FYI: i know this... i've been involved in fidonet since early 1989... was a
supporting member of some of the most active support echos (500+ messages a
day) on the backbones, too... but anyway, that's ancient history ;)

ML> once again, some of this comes from not knowing your level of
ML> expertise... your "sudden" appearance and the level at which "you"
ML> "speak" can put others on "edge"... in other words, many have seen a
ML> lot of inexperianced folk come out of no where espousing that there is
ML> no harm from doing such'n'such when, in fact, there can actually be
ML> real harm...

 MA> What harm? Unless you can specify what harm i have done, your 
 MA> observations are just speculations. You have not yet pointed out to
 MA> me what could really go wrong. You are attributing Windows
 MA> weaknesses to a Linux system.

no, you are misreading what i've been saying and misinterpreting same... i've
never said that *nix systems had the same weaknesses that windows boxes have...
never implied it, either... what i was doing, that you were misreading, was
using windows virus' as an example of the type of possibilities of infectious
avenues that could be used... think of the morris worm and expand it to
something a lot more vile and subtle... _don't_ misread that, either... i'm not
saying to think of the morris worm's methods as being viable today... once
again, i'm just using it as an analogy to binary critters that move about on
their own and get into boxes without the need of cartage by spam email, which
is what started the whole thing off in the first place...

if the above is not clear enough for you to finally understand, then i truely
detest the time that i've even spent attempting to discuss it with you... as
far as i'm concerned, this thread is dead...

<EOT>

)\/(ark

 * Origin:  (1:3634/12)