01.16.09

UNIX/Linux Offer More Security Than Windows: Evidence

Posted in GNU/Linux, Mail, Microsoft, Security, UNIX, Vista, Windows at 6:38 am by Dr. Roy Schestowitz

“Two security researchers have developed a new technique that essentially bypasses all of the memory protection safeguards in the Windows Vista operating system…”

Dennis Fisher, August 7th, 2008

Peter Kraus and David Gerard drew attention to the following interview with an author of adaware a few days ago. It explains in simple terms why Windows is inherently lacking in terms of security as it accommodates intrusion, despite all the denialist spinning [1, 2, 3]. Here is just a portion of this interview:

Eventually, instead of writing individual executables every time a worm came out, I would just write some Scheme code, put that up on the server, and then immediately all sorts of things would go dark. It amounted to a distributed code war on a 4-10 million-node network.

S: In your professional opinion, how can people avoid adware?

M: Um, run UNIX.

S: [ laughs]

M: We did actually get the ad client working under Wine on Linux.

S: That seems like a bit of a stretch!

M: That was a pretty limited market, I’d say.

Patching

Earlier in the week we found reports of new holes in Windows.

As previously announced, Microsoft has released a security update for Windows to close a total of three holes in the SMB protocol implementation. All three holes are based on buffer overflows. Two of them can apparently be exploited to inject and execute code remotely, without previous authentication. The third buffer overflow reportedly only causes the computer to reboot.

This is a lot more serious than Microsoft wants people to realise.

Microsoft Patch Tuesday bug is scary

THE FIRST Patch Tuesday fix of 2009 put out by Microsoft addresses a dangerous security vulnerability in its Server Message Block (SMB) protocol, or so say some insecurity experts

Botnets

“It is no exaggeration to say that the national security is also implicated by the efforts of hackers to break into computing networks. Computers, including many running Windows operating systems, are used throughout the United States Department of Defense and by the armed forces of the United States in Afghanistan and elsewhere.”

Jim Allchin, Microsoft

The pace of infection is very high and one worm alone is claimed to have seized millions of Windows-run computers in just one day.

The computer worm that exploits a months-old Windows bug has infected more than a million PCs in the past 24 hours, a security company said today.

One worm alone is spreading like wildfire.

Report: 2.5 million PCs infected with Conficker worm

According to F-Secure, there are already almost 2.5 million PCs infected with the Conficker worm, also known as Downadup. Since the worm has the ability to download new versions of itself, it is expected that the infection could spread much further. The new code is downloaded from domain names generated with a complex algorithm, making it hard to predict what domains will be used to spread the worms updates.

About 300 million PCs are still primed to become zombies too because of this one flaw.

With nearly a third of all Windows systems still vulnerable, it’s no surprise that the “Downadup” worm has been able to score such a success, Kandek said. “These slow [corporate] patch cycles are simply not acceptable,” he said. “They lead directly to these high infection rates.”

In general, it is estimated that 98% of Windows PCs are ripe for hijacking [1, 2].

Attacks

Is there room for some humour in all this?

Here’s a new way to get Microsoft to pay attention to you: Slip a brief message into the malicious Trojan horse program you just wrote.

That’s what an unnamed Russian hacker did recently with a variation of Win32/Zlob, a Trojan program victims are being tricked into installing on their computers.

The message is surprisingly cordial, given that Microsoft’s security researchers spend their days trying to put people like Zlob’s author out of business. “Just want to say ‘Hello’ from Russia. You are really good guys. It was a surprise for me that Microsoft can respond on threats so fast,” the hacker wrote, adding, “Happy New Year, guys, and good luck!”

E-mail

Many people remember Windows for submarines — a fiasco that reportedly led to the departure of many angry engineers. Well, not more than a month passes by and the Royal Navy, which runs Windows, gets stung by a virus infection that causes harm. Interestingly enough, the report from The Register mentions only lost E-mail as the severe consequence, but surely there is considerably more.

The Ministry of Defence confirmed today that it has suffered virus infections which have shut down “a small number” of MoD systems, most notably including admin networks aboard Royal Navy warships.

The Navy computers infected are the NavyStar (N*) system, based on a server cabinet and cable-networked PCs on each warship and used for purposes such as storekeeping, email and similar support functions. N* ship nets connect to wider networks by shore connection when vessels are in harbour and using satcomms when at sea.

It is no surprise that the United States military gradually moves to Red Hat Linux. Crucial operations were getting stung by Windows, even in the recent past.

Along with a rise of botnets, whose masters exploit vulnerabilities in Windows, comes a lot more SPAM as well. SPAM affects everyone.

The demise late last year of four of the world’s biggest spam botnets was good news for anyone with an email inbox, as spam levels were cut in half – almost overnight. But the vacuum has created opportunities for a new breed of bots, some of which could be much tougher to bring down, several security experts are warning.

This short report is based on just a few days. Nothing has improved — security-wise — in Microsoft’s product line.

“Usually Microsoft doesn’t develop products, we buy products. It’s not a bad product, but bits and pieces are missing.”

Arno Edelmann, Microsoft’s European business security product manager

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

5 Comments

  1. Needs Sunlight said,

    January 16, 2009 at 7:39 am

    Gravatar

    I remember in 2000 when WIndows rootkits started to get popular, they’re largely ignored by the press. I’d guess they’re ignored because they bypass any and all AV software, and thus bypass the advertising money. They also go against the myth about Windows being securable that Gates folk like the public to bleat.

    Two interesting pieces:

    “Trusting Trust”
    http://www.acm.org/classics/sep95/
    alternate link:
    http://cm.bell-labs.com/who/ken/trust.html

    “Exploiting Concurrency Vulnerabilities in System Call Wrappers”
    http://www.usenix.org/events/woot07/tech/full_papers/watson/watson.pdf

    The first link, “trusting trust”, shows that no amount of bluster or bluffing can make Windows secure. Without full access to the source code for all components in the system and its applications back doors can be hidden all over.

    Two follow ups for that, also show that at the end of the day, you must have and be able to use the complete source code for the whole system and each and every component or application:
    http://www.dwheeler.com/trusting-trust/
    http://www.schneier.com/blog/archives/2006/01/countering_trus.html

    The second link, “concurrency vulnerabilities”, looks like it completely destroys the myth that add-ons can help. It *looks* like all currently existing security software for Windows can be bypassed without detection or recourse — until such time as Windows is redesigned and rewritten from the Kernel on up.

    To pick on FOSS for a bit, the first two show why the decision to tolerate BLOBs in Debian and the downgrading of the Qt license to LGPL can lead to unmitigated disasters, either through insecurity, vendor lock-in, DRM, and hardware lock-in.

  2. The Mad Hatter said,

    January 16, 2009 at 10:24 pm

    Gravatar

    As an aside, has anyone read 2003 and Beyond by Andrew Grygus? It’s one of the reasons that I started to seriously pursue an alternative to Windows (and Microsoft), and it’s an excellent evaluation of Microsoft’s plans for the years ahead (and it’s interesting to read it 6 years on, and compare what Andrew thought was happening, with what actually happened).

  3. Jose_X said,

    January 18, 2009 at 4:29 pm

    Gravatar

    [ http://cm.bell-labs.com/who/ken/trust.html Reflections on Trusting Trust ]>> The moral is obvious. You can’t trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode.

    To add some:

    Reading source code tells all — if you trust the build system binaries that will be used to turn that source into binaries. In particular, if you have the source to the build system components, it’s easier to trust those build system binaries; however, the build system binaries have to be built themselves, this means you need an existing (simpler) build system. So do you have the source to that? And how about the source to the (even simpler) build system that built this last build system? At some point, dissembling very simple binaries upon which a multi-stage build process will occur may be what is necessary in order to gain the most trust.. or just be really sure you get your binaries from someone that has gone through that trouble. For example, the gcc system should have gone through a lot of care over the years (including back when gcc was much simpler). If gcc+co are safe, then everything else built upon it (eg, a whole distro since even other language platforms like perl, etc, could be built with gcc+co) should be as trustworthy as the sources to each of the component parts of the distro (ie, you can trust those sources that make up the distro if you trust the gcc build system).

  4. Jose_X said,

    January 18, 2009 at 4:36 pm

    Gravatar

    In the prior post, I ignored the obvious hardware issues that parallel. It’s important to at least make sure companies like AMD exist to keep Intel somewhat honest. ..AMD/Intel to keep Nvidia somewhat honest. Etc.

  5. Roy Schestowitz said,

    January 18, 2009 at 4:40 pm

    Gravatar

    You can use binary/source code signatures for your programs and compilers. Assuming your digital signatures come from a good source like CERT, then you at least have some confidence.

    Over in China, I suspect the GNU/Linux distribution they force-feed has some China-only surveillance facilities strapped onto it.

What Else is New


  1. Links 30/11/2020: GhostBSD 20.11.28, Nitrux 1.3.5, Linux 5.10 RC6, GNOME Circle, Microsoft Collapses Again in Web Server Share

    Links for the day



  2. Alternatives to the World Wide Web, to HTML, to HTTP/S, and to the Internet

    Looking around the Web (yes, the Web) for alternatives to the Web (and the stack underneath the Web), we're finding that IPFS is mature and robust enough for our needs



  3. Management of the EPO Dragged to the International Labour Organisation Over Its Assault on the Right to Strike

    Opinion on strikes challenged by the Central Staff Committee of Europe's second-largest organisation; if strike rights are almost abolished there, what hope is there for the rest of Europe?



  4. [Meme] Management of the EPO Cannot Let the Staff Breathe or Smell Freedom

    Working for the EPO means giving up on one’s human rights; that’s the sort of conclusion many workers have reached



  5. “ViCo” is Nothing New (Not Even the Acronym), Done on 9/11 Last Year, Been Possible as Long as the EPO Has Existed

    Contrary to what many people are led to believe, the EPO isn't embracing innovation, it's just embracing COVID-19 and leveraging lock-downs (de facto house arrest to some) to impose an illegal practice on EPO staff and EPO stakeholders



  6. Release: Early Letters and Documents About Financial Hoax Disguised as EPO 'Study'

    It was over a year ago that staff representation at the EPO expressed concerns about what would later enrage workers — seeing that based on unscientific fabrications the EPO would take away what had been promised to them



  7. IRC Proceedings: Sunday, November 29, 2020

    IRC logs for Sunday, November 29, 2020



  8. Managing IP: Puff Pieces Galore for the EPO's Dictatorship (Complete With Buzzwords and PR Stunts)

    By giving a platform to notorious patent trolls and ‘engaging’ with the EPO‘s dictator (whom only 3% of EPO staff trusts) Managing IP is sort of giving away its real agenda, which isn’t journalism but conducting or assisting misinformation campaigns



  9. Links 29/11/2020: Genode OS Framework 20.11, Linux 5.11 Kernel Changes, and Latest in KDE Itinerary

    Links for the day



  10. Sincere Thoughts About Outreachy

    Outreachy's role in the Free software community and inclusion in the FSF's High Priority Projects, as seen from the eyes of a female coder from a minority group; she used to work for the Free Software Foundation (FSF) and she expresses concerns about what Outreachy has become



  11. Free Software Under Tyranny of Codes of Conduct as the Western Equivalent of Blasphemy Law (Corporations as the New Religion/Sponsors as Deities)

    The free speech crisis in Free software communities has enabled expulsion of opinionated people whose opinions truly matter; in their place we now have companies that bomb people, sometimes even kidnapping children and sterilising women because nothing says “Ethics” like naked fascism and corporate domination everywhere



  12. Release: 4 More Documents and Letters About the Financial Siege at Europe's Second-Largest Institution

    Documents disputing the accuracy of the "hoax" from António Campinos and the Mercers



  13. One Year Ago: The Last EPO Demonstration Before COVID-19

    About a year ago staff of the EPO apparently had its last protest (in front of the Isar building) before staff got ‘herded’ into homes, where workers became more isolated and even illegally spied on



  14. [Meme] Unified Patent Court Agreement (UPCA) is an Attack on Europe and the European Businesses That Don't Do Litigation

    Litigation lawyers and patent zealots want to set Europe ablaze with legislation that they themselves crafted; thankfully, however, they face constitutional obstacles, no matter how many politicians they bamboozle and buy



  15. Reasons EPO Staff Decided to Go on Strike This Year (Before or Until Coronavirus Prevented It)

    An year-old letter from the Staff Union of the European Patent Office (SUEPO) to the President of the EPO; 7 reasons for going on strike are enumerated



  16. EPO Can Save Money by “Dropping Events Like the Inventor of the Year, Reducing the Number of Managers, Throwing Less Money at Consultants or Bringing the Boards of Appeal Back into Office Buildings.”

    Constructive suggestions from EPO staff, made just over a year ago and assembled into a letter to their EPO colleagues



  17. The Real Fate of the UPC 'Stunt' in Germany Will be Known Next Month (or Next Year) and There Are Substantial Constitutional Barriers in the Way

    Contrary to what Team UPC wants people to think, UPC(A) isn’t a “done deal” in Germany; they never actually addressed the substance of complaints and with help from Benoît Battistelli‘s friends in the Commission they’re just attempting a blatant coup



  18. Microsoft Removes Free Software From GitHub Again, This Time for Motion Picture Association (MPA)

    GitHub is proving to be more of a censorship site than a code-sharing site; with the GitHub takeover Microsoft became a 'censorship police' or force of occupation against its ideological competition; just weeks after the YouTube-DL debacle and further take-downs seeking to 'protect' broken DRM schemes (by banning code) we can see that Microsoft isn't defending developers at all; it's just protecting the interests of MPA, RIAA and other Biden circles from the interests of the general population, which sometimes circumvents perfectly circumventable 'DRM' schemes



  19. IRC Proceedings: Saturday, November 28, 2020

    IRC logs for Saturday, November 28, 2020



  20. Help Make Techrights (and Other Technology-Centric Sites) More Robust to Censorship by Setting Up More IPFS Nodes

    We’re trying to improve the site’s availability (ensuring it can never be offline) and make it more censorship-resistant; people who adopt IPFS can make that happen while tackling the “bloated Web” and “centralised Internet” issues — all at the same time



  21. Microsoft Loves Linux and Android Apps Running on Windows Instead of GNU/Linux and Android Devices

    Microsoft loves Linux, they say; but as Microsoft's former VP James Allchin put it: "If you're going to kill someone there isn't much reason to get all worked up about it and angry -- you just pull the trigger [...] We need to smile at Novell while we pull the trigger."



  22. Links 28/11/2020: RenderDoc 1.11, GNOME 40 Scrolling Horizontally

    Links for the day



  23. Nine Documents About the Financial Siege Against EPO Staff (Past, Present, and Future)

    Today we release dozens of pages of letters and documents (internal to Europe's second-largest institution); they all focus on the betrayal and skulduggery, crushing staff in spite of what was originally promised (and what workers actually signed up for)



  24. EPO Senior Management (Cabal) “Essentially Deaf to the Proposals From Staff Representatives.”

    Representatives of EPO staff feel like the management of the EPO is "deaf" and uncaring; there's hardly any meaningful progress (or none whatsoever) when it comes to truly honest dialogue with real participation



  25. EPO Management, Led by António Campinos, Attempted to Stifle or Prevent Staff From Being Surveyed

    Battistelli's cabal, which covers up a lot of fraud and corruption, is attempting to prevent the staff from expressing an opinion (for insiders and perhaps outsiders to assess) because things are really bad and autocratic measures are seen as necessary to keep the lid on issues/abuses



  26. The European Patent Office's Central Staff Committee: Office Cannot Recruit Fit-for-Purpose Patent Examiners Anymore

    One third of EPO recruits are 'locals' (Germans), 0.2% are Swiss, 1% Scandinavian; the EPO as an employer became unattractive and it's unable to attract the staff it needs (as was projected and planned when the EPC was agreed upon)



  27. IRC Proceedings: Friday, November 27, 2020

    IRC logs for Friday, November 27, 2020



  28. Links 27/11/2020: Jolla is 7, Diffoscope 162, MNT Reform Production

    Links for the day



  29. The Time Coronavirus Helped EPO Management Prevent Staff From Protesting and Going on Strike (March 26th)

    "In view of the spreading of the New Corona Virus, the planned General Assemblies have to be cancelled," the Staff Union of the European Patent Office (SUEPO) wrote in the wake of the crisis across Europe back in March (weeks ahead of a planned strike)



  30. Guarding Your Privacy With E2EE: Primer

    "As with all security, there is assumed risk no matter how careful you are. There are no security guarantees but that doesn't mean you shouldn't try."


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts