EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

05.10.10

Symantec Lies About GNU/Linux

Posted in GNU/Linux, Security, Windows at 9:56 am by Dr. Roy Schestowitz

Kent Hovind mug shot
Symantec: the Kent Hovind of security?
(mug shot of Kent Hovind courtesy of Escambia
County Sheriff’s Office after his arrest)

Summary: In order to sell some products, Symantec spreads GNU/Linux fear based on misinformation

EVERY once in a while Symantec aims its FUD pistol at some innocent element of computing which Symantec claims has a problem (and Symantec of course offers a solution to this problem). We have already explained this business strategy (using examples that misuse Free software [1, 2]), which characterises many quacks and pseudo-science. That’s why we put Kent Hovind at the top, for those who still wonder.

An issue which we discussed earlier today in IRC is the latest stunt from Symantec, which is probably best deconstructed and explained by Slashdot user “superapecommando” who submits:

The latest MessageLabs Intelligence Report from Symantec Hosted Services is filled with interesting and useful information regarding the current state of malware and e-mail borne threats as well as the trends over time. Of particular interest to me is the assertion in the report that “any given Linux machine is five times more likely to be sending spam than any given Windows machine.”

A pretty clear case of sensationalist metrics from a company which wants to sell their hosted security solutions to Linux box admins. But one interesting thing that comes out of the story is that many of the security researchers believe that misconfigured POSTFIX and SENDMAIL installations are cloaking the actual amount of spam coming from infected Windows hosts.

Desktops that unleash vast amounts of SPAM actually run Windows and one in two Windows PCs is believed/estimated to be a zombie (either active or not). GNU/Linux drives many mail servers, so if it obeys a request from a Windows zombie, then it will deliver SPAM. Should GNU/Linux therefore be blamed? Of course not. It’s just very good at delivering mail.

“GNU/Linux drives many mail servers, so if it obeys a request from a Windows zombie, then it will deliver SPAM.”Quoting Symantec a little further from its ‘report’ (which assumes bogus numbers about the market share of GNU/Linux), “by calculating a ratio of spam from a given operating system compared to the market share, we can get a “spam index” which shows relative to its market share, the likelihood that a particular computer is sending spam, based on its operating system. In the current spam climate, this index shows that relative to its market share, any given Linux machine is five times more likely to be sending spam than any given Windows machine…”

Another translation was sent to us by a reader who says: “Despite a total lack of evidence and being unable to detect the source OS of spam, we conclude that Linux machines are sending more SPAM because there are less of them.”

As our IRC logs will show later today (fragment posted below), there are even better explanations for that.


Techrights logo

IRC: #boycottnovell @ FreeNode: May 9th, 2010

Join us now at the IRC channel.

tessier__ http://www.v3.co.uk/v3/news/2262681/botnets-exploit-linux-owners May 10 09:29
tessier__ Someone is smoking crack. May 10 09:29
tessier__ crap May 10 09:31
schestowitz Windows is not used much for E-mail May 10 09:31
tessier__ There is something fishy about that website May 10 09:31
schestowitz Which one? May 10 09:31
schestowitz V3? May 10 09:31
tessier__ Not intentionally, no. But that’s what the botnets are doing with Windows: sending mail May 10 09:31
tessier__ Yeah May 10 09:31
schestowitz VNUNEt? May 10 09:31
tessier__ Have you heard of v3 before? May 10 09:31
tessier__ I never have. May 10 09:31
schestowitz Yes May 10 09:31
schestowitz Linux relays spam May 10 09:32
schestowitz It runs mail servers May 10 09:32
schestowitz It does what it’s supposed to do May 10 09:32
schestowitz Which is to relay requests May 10 09:32
tessier__ I cannot post a comment on that site. The captcha does not work. No matter what you put in there it does not accept it. May 10 09:32
tessier__ Linux by default is not an open relay. May 10 09:32
schestowitz I wonder what sends those requests though May 10 09:32
tessier__ No distro ships their mail servers that way. May 10 09:32
schestowitz It’s spammers May 10 09:32
tessier__ it will deliver the spam to you that someone injected via a Windows box though. May 10 09:33
schestowitz They use open relays May 10 09:33
schestowitz Running Linux because it’s better May 10 09:33
tessier__ Open relays are hard to find these days. May 10 09:33
schestowitz They get blacklisted May 10 09:33
tessier__ And spammers don’t run open relays either. They don’t want other spammers stealing their resources. May 10 09:33
schestowitz What was that list that gather IPs of spam relays? May 10 09:33
schestowitz many services used to look it up and in 2008 it had sustainability issues May 10 09:33
tessier__ Whenever I have investigated IP addresses that were sending me spam it was Windows boxes. May 10 09:33
tessier__ There are lots of DNSBLs May 10 09:34
tessier__ And they operate quite successfully May 10 09:34
tessier__ SORBS is one of the big ones these days May 10 09:34
schestowitz I can’t recall the one I think about. Articles about it were widespread 2 years ago. May 10 09:34
*schestowitz creates http://techrights.org/wiki/index.php/Facebook May 10 09:35
Techrights Title: Facebook – Techrights .::. Size~: 12.91 KB May 10 09:35
tessier__ There have been quite a few May 10 09:35
-BNtwitter/#boycottnovell-[popey] Mark proposes that 10.10 is released on Sunday 10th October 2010. Where 101010 = 42 = Meaning of Life / Universe / Everything! May 10 09:37
-BNtwitter/#boycottnovell-[nsisodiya] need a student volunteer for modifying C++ book #schoolos May 10 09:40
*benJIman has quit (Ping timeout: 252 seconds) May 10 09:42
-BNtwitter/#boycottnovell-[popey] There will be no public ISO of #Ubuntu Light with Unity, but will be tailored specifically for OEMs. May 10 09:49
-BNtwitter/#boycottnovell-[davidgerard] From @cracked – 5 Insane File Sharing Panics from Before the Internet – http://tinyurl.com/2ubthnw May 10 09:53
Techrights Title: 5 Insane File Sharing Panics from Before the Internet | Cracked.com .::. Size~: 81.74 KB May 10 09:53
-BNtwitter/#boycottnovell-[satipera] Liberal Democrat negotiations with Labour look likely if Brown goes quickly. May 10 09:55
*narendra (~79f5e1b0@gateway/web/freenode/x-xaqdkqksysommyyc) has joined #boycottnovell May 10 10:08
narendra where I can upload secrect document anonymousy ? May 10 10:08
narendra wikileaks is not working i think !! May 10 10:08
tessier__ http://موقع.وزارة-الاتصالات.مصر/Default.aspx May 10 10:16
tessier__ Awesome. May 10 10:16
*benJIman (~benji@benjiweber.co.uk) has joined #boycottnovell May 10 10:17
MinceR i’m not so enthusiastic about it. May 10 10:17
*benJIman has quit (Client Quit) May 10 10:17
tessier__ Why not? May 10 10:17
*benJIman (~benji@benjiweber.co.uk) has joined #boycottnovell May 10 10:17
MinceR because it allows even more domains that are difficult to type, read and compare May 10 10:18
MinceR IDN already lets you create identical-looking but distinct domains that can confuse users trying to check whether a certificate really applies to a supposedly secure connection. May 10 10:18
MinceR domain names used to be easy to handle (as such names should be) May 10 10:19
MinceR 7bit US-ASCII should have been enough. May 10 10:19
tessier__ SSL CA was broken from the beginning anyway. This doesn’t make things any worse. May 10 10:21
tessier__ Everyone just clicks ok regardless. May 10 10:21
tessier__ Although I am curious to know how you would work that sort of thing into a bind zone file. May 10 10:21
MinceR no, not everyone. May 10 10:26
Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

A Single Comment

  1. your_friend said,

    May 11, 2010 at 11:03 pm

    Gravatar

    It is worth quoting Paul Wood, a senior analyst for Symantec Hosted Services, in full. This is so dumb, the Windows people will have to take if far from the source to make it stick.

    We found that more than 90 per cent of spam comes from Windows machines, which is not surprising. But if you look at Linux, it has only a one per cent market share but is responsible for more than five per cent of spam. So in a sense you’re more likely to get spam from a Linux than a Windows machine.

    There is not true in any sense. It is difficult to see how Phil Muncaster, the article’s author, could have taken this out of context and there is no forgiving Muncaster’s lack of critical thinking. If more than 90% of all spam comes from Windows, virtually all spam comes from Windows. Alternate interpretations have been debunked above, but the original statement was even dumber than its following missinterpretation by Muncaster.

    There are many good explanations mentioned above for what Symantic saw when they looked at, “the passive fingerprinting signatures of spam email traffic for the first time in this month’s report, in order to learn the type of operating system running on the infected spam-sending machines.” The most obvious are that GNU/Linux is efficient and well placed in networks. Windows’ poor network stack and zombie load mean that any Windows machine will only be able to do about 10% of a comparable GNU/Linux box. The later explanation, that most of the traffic comes because GNU/Linux is acting as a relay is even more damning for Windows – this means that GNU/Linux is just doing its job on networks where the administrators have made the mistake of using Windows on the desktop. The conclusion, backed by reasonable estimates of Windows infection rates and the fact that default GNU/Linux setting that preclude the bogus “open relay” explanation, is that all spam comes from Windows.

What Else is New


  1. EPO Busy Distracting From Miscarriage/Abuse of Justice at the EPO (Both Office and Organisation)

    The European Patent Organisation continues to be a vassal of the Office (Christoph Ernst is defending Battistelli) and justice is not being honoured; it's being discarded in the darkness (in secret meetings)



  2. Bristows LLP/IP Kat Carrying on With Dead UPC Jingoism

    The same old tune from Bristows not only gets played in Bristows' 'alternate reality' blog but also in other blogs where Bristows staff is 'contributing' (to confusion and misconceptions)



  3. Links 16/12/2017: Mesa 17.2.7, Wine 3.0 RC2, Kdenlive 17.12.0, Mir 0.29

    Links for the day



  4. Patrick Corcoran is Innocent, Yet Battistelli Will/May Have the Power to Sack Him Next Month (in DG1)

    The EPO's Administrative Council does not want to even mention Patrick Corcoran, as merely bringing that up might lead to the suggestion that Benoît Battistelli should be fired (yes, they can fire him), but to set the record straight, at the EPO truth-tellers are punished and those whom they expose are shielded by the Administrative Council



  5. Patent Trolls Are Going Bust in the United States (Along With the 'Protection' Racket Conglomerates)

    RPX continues its gradual collapse and patent trolls fail to find leverage now that software patents are kaput and patent opportunists struggle to access Texan courts



  6. IBM's Manny Schecter is Wrong Again and He is Attempting to Justify Patent Trolling

    In yet another dodgy effort to undermine the US Supreme Court and bring back software patents, IBM's "chief patent counsel" (his current job title) expresses views that are bunk or "alternative facts"



  7. EPO Administrative Council Disallows Discussion About Violations of the Law by Benoît Battistelli

    The EPO crisis is not ending for the Administrative Council does not want to tackle any of the obvious problems; Patrick Corcoran is a taboo subject and Ernst is coming across as another protector of Benoît Battistelli, based on today's meeting (the second meeting he chairs)



  8. Links 13/12/2017: GIMP 2.9.8, Fedora 25 End Of Life, AltOS 1.8.3

    Links for the day



  9. Judge Corcoran Got His User ID/Desk Back (as ILO Asked), But Cannot Perform Actual Work

    The latest update regarding Patrick Corcoran, whose 3-year ordeal is far from over in spite of ILO's unambiguous rulings in his favour



  10. The End of Software Patents and PTAB's Role in Enforcing That End

    Software patents are fast becoming a dying breed and the appeal board (PTAB) of the USPTO accelerates this trend, irrespective of patent immunity attempts



  11. No, China Isn't Most Innovative, It's Just Granting a Lot of Low-Quality Patents

    Patent extremists are trying to make China look like a role model or a success story because China grants far too many patents, spurring an explosion in litigation



  12. Battistelli-Campinos Transition Will Be a Smooth One as the Administrative Council Remains the Same and the Boards Still Besieged

    A rather pessimistic (albeit likely realistic) expectation from tomorrow's meeting of the Administrative Council, which continues to show that no lessons were learned and no strategy will be altered to avoid doom (low-quality patents and stocks running out)



  13. Links 12/12/2017: New BlackArch ISO and Stable Kernels

    Links for the day



  14. German Media Helps Cover Up -- Not Cover -- the Latest EPO Scandal

    EPO-Handelsblatt attention diversion tricks may be effective as German media barely shows interest in one of the EPO's biggest scandals to date



  15. PTAB Haters Fail to Guard Bogus Patents, But They Still Try

    Three Affiliated Tribes probably won't enjoy sovereign immunity from PTAB, Dennis Crouch won't manage to slow down PTAB, and patent litigation will stagnate as bad patents perish before they even land in a lawsuit



  16. Team UPC's Tilmann Defends Rogue Vote at 1 AM in the Morning With Just 5% of Politicians (Those With Vested Interests) Attending

    Just when German democracy is being stolen by a legislative coup (in the dead of night when 95% of politicians are absent/asleep) there's someone 'courageous' enough to rear his ugly head and attempt to justify that coup



  17. The Mask Falls: Lobbyist David Kappos Now Composes Pieces for the Patent Trolls' Lobby (IAM)

    David Kappos, a former USPTO Director who is now lobbying for large corporations that derive revenue from patent extortion, is writing for IAM even if his views are significantly biased by his aggressive paymasters (just like IAM's)



  18. The EPO Protest Tomorrow Isn't Just About Judge Corcoran But About the EPO as a Whole

    PO staff is about to protest against the employer, pointing out that "Battistelli is still showing a total and utter lack of respect not only for his staff and their rights but also for the Administrative Council and for the Tribunal"



  19. Claim: Judge Corcoran to Be Put Under Benoît Battistelli's Control in DG1

    Benoît Battistelli, who openly disregards and refuses to obey judges (while intervening in trials and delivering 'royal decrees' whenever it suits him), may soon gain direct control over the judge he hates most



  20. The European Patent Organisation Refrains (For Nearly a Week) From Speaking About Battistelli's Abuses as Judged by ILO Tribunal

    The EPO's silence on the matter of Patrick Corcoran is deafening; to make matters worse, the EPO continues to pollute media and academia with money of stakeholders, with the sole intention of lobbying and misleading news coverage (clearly a disservice to these stakeholders)



  21. Carl Josefsson Lets Judge Patrick Corcoran Come Back to Work at the EPO

    After initial reluctance to obey/respect the rulings from the ILO (security staff declining access) there is official permission for Patrick Corcoran to enter and resume work (following 3 years of injustice against him)



  22. Bristows is Being Hammered With Negative Comments For Its Unitary Patent (UPC) Lies

    The Unified Patent Court (UPC) is practically dead in the UK and Ireland; Bristows, nevertheless, continues with its desperate spin



  23. Links 11/12/2017: Linux 4.15 RC3, Debian 8.10 and Debian 9.3

    Links for the day



  24. Judge Corcoran Turns to His Government for Help and EPO 'House Ban' is Finally Lifted

    Sources that are very reliable say that Patrick Corcoran is coming back to work, however it's now clear when and how long for



  25. Raw: Battistelli's Control/Domination Over the Boards of Appeal

    An old EPO document internally voicing concerns about the lack of independence at the Boards of Appeal



  26. Raw: Conflicts of Interest of EPO Vice-President

    An old EPO concern regarding structural collisions and mixed loyalties



  27. Microsoft-Connected Patent Trolls Are Increasingly Active and Microsoft is Selling 'Protection' (Azure Subscriptions)

    There are several indications that Microsoft-connected shells, which produce no products and are threatening a large number of companies, are inadvertently if not intentionally helping Microsoft sell "indemnification" ("Azure IP Advantage," which echoes the Microsoft/Novell strategy for collecting what they called "patent royalties" one decade ago)



  28. Yes, RPost is Definitely a Patent Troll and Its Software Patents Are at Risk Thanks to Alice

    The latest whitewashing (or reputation-laundering) pieces from Watchtroll, which tries to justify patent-trolling activities with software patents, typically in the Eastern District of Texas



  29. The Latest Scams in the Patent World

    Examples of 'dirty laundry' of the patent microcosm, which it understandably does not like covering (as it harms confidence in their services/advice)



  30. Patents Are Becoming a Welfare System for the Rich and Powerful

    A culture of litigation and more recently the patenting of broad industry standards may mean that multi-billion dollar corporations are cashing in without lifting a finger


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts