Hmmmm.... Antivirus? Antimalware?

[WizardStan]

Ah yes, the 'security through obscurity' argument. Excuse me, I'm going to go scream in a closet.

What's more secure, a door with a deadbolt, or a door that no one really knows about (that also has a deadbolt)?


"Security through obscurity" is only bad when it's your only form of security. Linux has a lot more going on for it, the fact that it's a less likely target is just an additional layer.

 

[Eridger]

Ah yes, the 'security through obscurity' argument. Excuse me, I'm going to go scream in a closet.

What's more secure, a door with a deadbolt, or a door that no one really knows about (that also has a deadbolt)?


"Security through obscurity" is only bad when it's your only form of security. Linux has a lot more going on for it, the fact that it's a less likely target is just an additional layer.

But don't a majority of servers run Linux or UNIX-based systems? I agree with the whole 'security though obscurity' idea in general as you explained, but what I take issue with is the belief that Linux systems are really all that obscure.

 

[Klaue]

If the majority of the world used Linux, you can bet that it would be a target and a lot of unknown security problems would be exploited.

That argument is heard a lot, but most servers use Linux (as Eridger said too). Since today most or at least a lot of viruses (virii? I'm never quite sure of the plural of virus) are used to build a botnet to DDoS a server, you'd have to think that viruses targeting a server directly would be wide spread. Yet they aren't.


Sure, that could be because servers are generally seen as more secure than your usual home computer, but I've seen a lot of low-security-servers. Once I saw one that allowed ssh connections from everyone and the root hat the password "qwerty". (It was from a home user that just wanted to run a small website on a comp he keeps running all the time, but still)

 

[3jane]

"Those who don't understand UNIX are doomed to reinvent it... poorly."


The idea that Windows is targeted more because it is more popular is predicated on the notion that all operating systems are exactly secure as each other, which is an absurd idea. It's just not possible for two complex systems to converge like that. One HAS to be more secure then the other.

 

[WizardStan]

[totally OT]

viruses (virii? I'm never quite sure of the plural of virus)

Virus. The plural of virus is virus. Technically. The original word however many millennia ago it was had no distinction between singular and plural. I had a virus, you had a virus, we had virus. It basically just meant sickness, and for the time it didn't make sense (or maybe occur to them, I dunno) to classify multiple different sicknesses with a plural word. Like the internet! I am on the internet, you are on the internet, we are on the internet. We are not on internets because there is only one. But centuries from now, if we expand to the stars and there really are multiple internets, it'll become necessary to pluralize it.


Our current method of pluralizing is to add an 's' to the end. Internet would become internets. In this way, the people that say virii are correct, since that is grammatically how Latin, from which the word is taken, would be pluralized.


On the other hand, suppose after hundreds of years the rules of language has changed and something is made plural by adding some other pronounceable symbol to the end of it. "Internet" has become part of that new language and it is that new language that needs to pluralize it, so shouldn't it be the new language's rule that is used? In that way, the people that say viruses are correct, since that's how we do it under modern English.


Personally I subscribe to the "it's our word now, b*tches, and we'll pluralize it our own way" camp, so I like viruses, but both ways of pluralizing are acceptable.


[/totally OT]

 

[DavidBowman]

Respectfully (I mean that), to those of you who argue that security through obscurity isn't valid, you are wrong. But not because Linux isn't secure. Security isn't the main factor here: it's motivation.


If I wanted to cause as much damage as possible, or if I wanted to steal as much financial information as possible, or if I wanted to make a name for myself by infecting as many PCs as possible, what would I do? I would target the largest user base out there. Right now, that just so happens to be Windows machines. And bully for me that Windows has terrible security. System security aside, uninformed users are always going to be your biggest weak point, and Windows has plenty of those. I'm not motivated to attack Linux machines because the user base isn't enough to make it worth it. And really, I'm attacking the user base, not the operating system.


But let's say that Linux was the top operating system (all else being equal). That's still going to be my target since that's the largest user base, and not Windows just because the security is bad. Now, let's say I'm properly motivated to do some research and I go rooting around the publicly-available kernel source code. Hey, what's that? Let's exploit a kernel bug! Or maybe this one!


Kernel bugs aside, you'll still have plenty of uninformed users who can be socially engineered to help a hacker gain access. All I have to do was to look for an exploit either in code or in users and be properly motivated to do so.


The PS3 was the same scenario. Security on the machine is great, but it wasn't foolproof obviously. But even with the holes that existed, nobody attacked it because there was no motivation. Sony allowed the OtherOS option, and that appeased enough skillful people into not looking for an exploit. Take that away, and suddenly there's motivation.


As for the server argument, again you're talking about the user base here, not the actual operating system. The users who setup a server are obviously going to be more tech savvy than your average home user. They're going to know what to secure and what are the best security practices when it comes to instructing the users of that server (I'm imagining a company environment here with a clearly laid out security policy).


Does that mean that servers are never hacked? Hell no, it doesn't! But they're hacked when there's enough motivation to do so. Playstation Network, I'm looking your way.

 

[skeezix]

There is a logical problem here --


An AV product may be useful and sometimes is essential.. and often not useful at all. The thing to remember is they're usualyl very costly to operate - eating up 500MB-1GB of RAM, eating up CPU all the time, eating into IO and CPU on _every_ read or write. Thats a lot of strain on the system, a lot of bugs and crashes in apps and the OS introduced and so on.. so that once in awhile, it may be useful. Its like taking cough medicine every day, because you get a cold once a year.


IF people think they _need_ AV, then the _marketing_ has succeeded.


If you dont' visit .ru pr0n sites all day, chances are you're not going to need AV if you have a modern and fresh OS (even Windows); XP SP0 with IE6 and your'e toast if something hits you, but otherwise.. you're not too bad off. The trick is sometimes the malware comes in via a legit site when it gets hijacked, say.


On a _handheld_, you analyze your usage patterns and see if its what you need; chances are you don't need it there.


I just want to point out that if folks think they _Always_ need it everywhere.. then they've been duped


jeff

 

[3jane]

Dave (respectfully), the motivation is simply to pick the low hanging fruit.


It's like SPAM, it costs you no effort at all to crack a million Windows machines with automated tools, and you might get something out of a handful of them. Contrast it to the kind of work you are talking about - finding an original 0-day remote-exploit in the linux kernel? - how often do you think you could pull THAT off?


If you really were motivated to steal as much information or do as much damage as possible - don't you think you would target the servers that actually house this information? Why would you bother pwning Aunt May's XP box?


Sure you CAN to it - look at the Stuxnet virus - but you'd need the resources of a medium sized nation to pull it off.


I know security through obscurity sounds like it makes sense, but it's been thoroughly debunked.

 

[3jane]

Incidentally, the cracking of the PSN was a failure of security through obscurity, not the result of dedicated effort. Sony KNEW they were vulnerable and yet took no steps to secure their systems, believing that nobody would notice or bother to try.

 

[DavidBowman]

I disagree (again, respectfully). The low-hanging fruit is still there, it's just not as low-hanging as it used to be. If that was the only fruit to go after, people would still try.


I still argue that security is an illusion, and if properly motivated, plenty of holes could be found in Linux. It doesn't have to be through a kernel exploit. I'm not deriding Linux here. I love the OS, and security is worlds better than Windows. But it's not perfect. If it were, every server in the world would be running on it and we'd never have any security breaches.


If we're talking about viruses (virii) or malware, then no, you're not targeting a server most of the time, and your goal is to infect as many computers as possible. Those asshats that program these things are often only after chaos and "glory", not money. But that's not to say that Aunt Mary's XP box doesn't have her financial information on it, and perhaps that is what motivated me to pwn it in the first place.


It still comes down to the motivation. The effort is going to equal the motivation. Stuxnet is the perfect example.


And yes, the PSN was vulnerable. Everything is from some perspective. My point there was that nothing ever happened to it for the months and months that it had known problem. That is, until there was motivation.


You say that the theory has been debunked, but from what angle? Just because something is obscured does not make it secure. I'm not arguing that. I'm saying that the motivation isn't there because it's obscure.


Edit: Did I say "motivation" enough?

 

[Prometheus]

If we're talking about viruses (virii) or malware, then no, you're not targeting a server most of the time, and your goal is to infect as many computers as possible. Those asshats that program these things are often only after chaos and "glory", not money.

I might be mistaken, but I'm pretty sure that it's mostly been about money since about the middle of the last decade, if not a bit before that...


(The notion of viruses made for chaos and "glory" kind of reminds me of the internet as it was in 1999...)

 

[DavidBowman]

(The notion of viruses made for chaos and "glory" kind of reminds me of the internet as it was in 1999...)

RISC architecture is going to change everything.

 

[skeezix]

1999?


Virus and glory and 'exploring infecting agents' was mid-80s even early-80s ..


You're refering to spreading across the net, which sure made things more automatable.


How many remember boot sector virii on floppies? and later the 'anti virus virus' -- a boot sector virus that claimed to be benign -- it'd start up and report 'floppy is clean', and if you _didn't see it_, you knew something more malicious was at play; but these 'friendly' anti-virus virus would spread, and could damage games (that needed their own custom boot sector, say.)


Good times


jeff

 

[Bosbeetle]

I love the floppy ones that spread to all computers in a certain area... Now these seem to be usbstick related

 

[Prometheus]

1999?


Virus and glory and 'exploring infecting agents' was mid-80s even early-80s ..

Oh, I know that. I just meant that that was the last time I'd heard of such a thing.

 

[Asiyura]

RISC architecture is going to change everything.

We are Samurai… the keyboard cowboys…

 

[Eridger]

I really like this forum sometimes. It typically doesn't go in the "you're wrong because you're stupid" argument.


Anyways, you raise some interesting points, David. You see, when I sorta snorted at the 'security through obscurity' thing you mentioned - at least I think it was you, anyways - I was thinking you meant that the kernel itself was or could be exploited to the degree Windows is. But my argument against that is that since the Linux kernel is open source it would take almost no time to patch any exploits before they become serious enough to cause real damage to regular users. I still believe that the concept is true, but the problem with my argument is that it's centered entirely on the most ideal situations. After all, how many linux users use the latest kernel releases? Most distributions don't jump at updating the kernel to the absolute latest, up-to-the-minute release. Which of course as with any old software means that exploits will be found sooner or later.


Another problem is that users don't just run the kernel. They have dozens of applications running constantly on their systems. Now those could be potentially be exploited unless they are updated as often and as thoroughly as the kernel. And that doesn't even take into consideration any misconfigurations put in place by the user. For example, if you have a simple internet-facing ssh port on your system, regardless of your O/S your system will be exploited sooner or later. Firefox is known to have the occasional hole, and it's one of the most widely-used browsers in the world.





I think you're right about motivation being a major factor here. I agree that with enough malicious people working on it, holes would be found in the kernel. But those holes would be patched much more quickly than with Windows operating systems. In that case, dealing with exploits wouldn't be too hard as you'd just need to stick with the latest kernel, which could be handled by your distro. But that doesn't rule out application-level exploits or misconfigurations. Of course, no system is secure. But Windows is much less secure at it's core than the linux kernel ever will be. If I had to choose -and I did have to choose- I'd put my money on Linux.

 

[Letalis Sonus]

After all, how many linux users use the latest kernel releases? Most distributions don't jump at updating the kernel to the absolute latest, up-to-the-minute release.

Because they don't need to. Important patches fixing security holes are simply being backported to the used kernel, not every kernel update actually introduces a kernel based on a newer vanilla kernel version. Red Hat, Debian, Canonical, etc are very quick at that and usually provide a kernel update within a single day.

 

[Eridger]

After all, how many linux users use the latest kernel releases? Most distributions don't jump at updating the kernel to the absolute latest, up-to-the-minute release.

Because they don't need to. Important patches fixing security holes are simply being backported to the used kernel, not every kernel update actually introduces a kernel based on a newer vanilla kernel version. Red Hat, Debian, Canonical, etc are very quick at that and usually provide a kernel update within a single day.

Well... the more you know... well in that case go to hell, security through obscurity! :lol:

 

[DavidBowman]

I really like this forum sometimes. It typically doesn't go in the "you're wrong because you're stupid" argument.

I try never to do that as it just becomes a screaming match. I'm all for discussion, but not for arguments.

I think you're right about motivation being a major factor here. I agree that with enough malicious people working on it, holes would be found in the kernel. But those holes would be patched much more quickly than with Windows operating systems. In that case, dealing with exploits wouldn't be too hard as you'd just need to stick with the latest kernel, which could be handled by your distro. But that doesn't rule out application-level exploits or misconfigurations. Of course, no system is secure. But Windows is much less secure at it's core than the linux kernel ever will be. If I had to choose -and I did have to choose- I'd put my money on Linux.

You couldn't be more correct.