Side-grading from XP to Linux.

[Blue Mountain]

Tell me, what damage could a virus do on a Linux machine when you are running as a user and not as root?

First, it could scan your files for things like credit card numbers, SSNs, passwords, etc, and email them (or connect to a host on the internet and send them via FTP/SFTP or some custom-rolled transfer protocol) to people you don't want to know that information.

Second, it could wipe all the files that are owned by you, and those are the ones you care about ... your email, your documents, your photo album, your oggs and MP3s, your pr0n ...

Finally, running only as a user it can participate in a botnet by listening on higher numbered ports and sending out spam. Although I note that a hardware firewall will prevent packets destined for the listening port from getting through.

 

[~enigma~]

First, it could scan your files for things like credit card numbers, SSNs, passwords, etc, and email them (or connect to a host on the internet and send them via FTP/SFTP or some custom-rolled transfer protocol) to people you don't want to know that information.

Second, it could wipe all the files that are owned by you, and those are the ones you care about ... your email, your documents, your photo album, your oggs and MP3s, your pr0n ...

Finally, running only as a user it can participate in a botnet by listening on higher numbered ports and sending out spam. Although I note that a hardware firewall will prevent packets destined for the listening port from getting through.

So you think a trojan can install and run a "virus" and do that on a non-root account? You want to buy some swampland in Florida?

 

[Dogbreath]

AgeGap, you said "My computer is very low-spec."
If your system is less the 1 Ghz and low ram, you may want to try xubuntu. It uses a window manager that consumes fewer resources.

 

[Blue Mountain]

So you think a trojan can install and run a "virus" and do that on a non-root account? You want to buy some swampland in Florida?

That's not the question I was responding to. You asked what harm a program could do when running as a non-root user. Assuming it's running as your user (and not as, for example, "nobody" or "uucp"), it can do everything I described.

With regards to the question you just posed ("Can a trojan install and run a "virus" and do that on a non-root account?") you'll need to clarify what you're thinking about when you use the term "virus." But my take on that is a trojan (that is, a program that sneaks past your system's defenses and starts running) does not have to run as root. Sure, as root it can do a lot more damage and can set up a TCP daemon that can listen on privileged ports (those below 1024, where all the important services are).

If it's not running as root, it can still listen on any TCP port above 1024. It can also go out on to the net and connect to pretty much any computer, anywhere. If it uses ssh to do that, it would probably sail right through your firewalls unless you're running SElinux.

As a non-root user it would have some difficulty attaching itself to the system so it would survive a reboot, but I can think of a way or two it could do that.

 

[~enigma~]

That's not the question I was responding to. You asked what harm a program could do when running as a non-root user. Assuming it's running as your user (and not as, for example, "nobody" or "uucp"), it can do everything I described.

With regards to the question you just posed ("Can a trojan install and run a "virus" and do that on a non-root account?") you'll need to clarify what you're thinking about when you use the term "virus." But my take on that is a trojan (that is, a program that sneaks past your system's defenses and starts running) does not have to run as root. Sure, as root it can do a lot more damage and can set up a TCP daemon that can listen on privileged ports (those below 1024, where all the important services are).

If it's not running as root, it can still listen on any TCP port above 1024. It can also go out on to the net and connect to pretty much any computer, anywhere. If it uses ssh to do that, it would probably sail right through your firewalls unless you're running SElinux.

As a non-root user it would have some difficulty attaching itself to the system so it would survive a reboot, but I can think of a way or two it could do that.

So now your story is that it "can" do all that but as a non-root user it wouldn't be able to without the user's help. So now you think Linux is susceptible to a social engineering attack but windows isn"t? Tell you what, if you are absolutely positive that Linux is so susceptible to "hacking", I will gladly create a text file and place it in my home directory to see if you can "hack" in and steal the information. Deal or are you afraid?

 

[Blue Bubble]

[...snip...]

If you want security, there's no better system than OpenBSD. It's not perfect ("Only two remote holes in the default install, in more than 10 years!", as they say), but it's damn close. And that's because there's no software written more securely, and more audited than OpenBSD.

Ahem, the systems I work with day-in, day-out I'd consider to have better security than OpenBSD. They run VMS. You can have a (non-privileged) username on my home VMScluster if you want to try breaking its security.

 

[Blue Mountain]

So now your story is that it "can" do all that but as a non-root user it wouldn't be able to without the user's help. So now you think Linux is susceptible to a social engineering attack but windows isn"t? Tell you what, if you are absolutely positive that Linux is so susceptible to "hacking", I will gladly create a text file and place it in my home directory to see if you can "hack" in and steal the information. Deal or are you afraid?

Strawman argument: I said nothing about the susceptibility of Linux or Windows to social engineering attacks.

You originally asked what harm a program could do when running as a non-root user, on the apparent assumption a hacker needs root privileges to do damage. I answered that: if a program is able to run at all, it can use standard system services to connect to the internet and transmit information to third parties.

If it is able to run with your privileges, it can steal your information and transmit it over the internet, and delete your files. (And I think you'll agree your files are pretty important to you.) I didn't say it requires the user's help to run the program; I said it has to run with your privileges to do significant harm to your personal data. There are known ways for programs to gain those privileges without you being involved.

Now, a cracker trying to get that program to run without you knowing it faces a considerable challenge. But if you think it's impossible to sneak past Linux's defenses, take a look at the Security page over at LWN.net. Do the terms "privilege escalation," "information leakage," and "insecure temp file handling" mean nothing to you?

As to your challenge, I personally don't have the programming skills to exploit these bugs. That requires knowledge in the C programming language, and my languages of choice these days are perl and bash. But just because I don't doesn't mean others on the net don't.

Having said all that, I agree with general consensus that Linux is inherently more secure than Windows. *NIX machines connected to the Internet have a double whammy that crackers have to contend with in order to cause damage:

• They have to be able to get past whatever defenses are currently in place on the daemons that are listening on net-facing ports, or exploit bugs in those daemons, and Linux/BSD/Unix programmers have been diligent in their programming. (These can be defeated if the cracker can convince a Linux user to connect to a site in order to exploit, for example, a browser bug or something in, say, wget or curl.)
• These daemons are usually running with their own user privileges. In order to do harm, a program spawned by these daemons has to be able to get the privileges of another user or (best case for the cracker), root.

In addition, modern Linux distributions are much more parsimonious about the daemons they start up, and many come with firewalls that prevent packets from getting through ... which can make for frustrating times when trying to get something like an FTP server running on your system.

 

[~enigma~]

Strawman argument: I said nothing about the susceptibility of Linux or Windows to social engineering attacks.

You didn't? That's funny because you indicated that for the damage you theorize to be done a program of some sort must be run by the user. That in any sense of the term is a social engineering attack and nothing to do with the security of the system. IOW, your accusation that I am building a strawman is wrong as is your recently overturned idea that Linux is just as susceptible to attacks as windows. Glad you realized Linux is much more secure than windows.

 

[Wudang]

http://news.zdnet.co.uk/security/0,1000000189,39219637,00.htm

 

[~enigma~]

http://news.zdnet.co.uk/security/0,1000000189,39219637,00.htm

Did you look at the date on the article or are you just trying to get into a conversation so badly that you risk making yourself look foolish by posting an article from 2005. Besides, all current distros of Linux have a minimum version of Firefox 2 and a few even use Firefox 3. So now would you be so kind as to clarify why you posted an almost 3 year old article?

 

[Blue Mountain]

You didn't? That's funny because you indicated that for the damage you theorize to be done a program of some sort must be run by the user. That in any sense of the term is a social engineering attack and nothing to do with the security of the system. IOW, your accusation that I am building a strawman is wrong as is your recently overturned idea that Linux is just as susceptible to attacks as windows. Glad you realized Linux is much more secure than windows.

Ah, right ... you asked "what damage could a virus do on a Linux machine when you are running as a user ...". As an experienced Linux sysadmin, I read that as "when the process's effective uid and gid are the same as user X's uid and gid." That doesn't mean the process was started by user X. The process could have been started as different user such as daemon, printer, uucp, nobody, etc. After starting, a malicious process could use one of the privilege escalation bugs of the type documented on lwn.net to change its process uid and gid to user X's.

There are more ways to start processes on Linux than just clicking on an icon or typing something at a command line. Entries in the /etc/cron.d directories are one way; 'at' is another, overloading startup scripts is another. Fortunately, on typical *NIX systems all of those are protected by being in directories normally writable only by root, so non-root users don't have a chance to change things there.

An old favourite for running malicious code is the buffer overflow attack, but those are getting fewer as programmers and languages improve. In that respect Linux has much better security than Windows, and BSD is probably better than Linux.

 

[~enigma~]

Ah, right ... you asked "what damage could a virus do on a Linux machine when you are running as a user ...". As an experienced Linux sysadmin, I read that as "when the process's effective uid and gid are the same as user X's uid and gid." That doesn't mean the process was started by user X. The process could have been started as different user such as daemon, printer, uucp, nobody, etc. After starting, a malicious process could use one of the privilege escalation bugs of the type documented on lwn.net to change its process uid and gid to user X's.

There are more ways to start processes on Linux than just clicking on an icon or typing something at a command line. Entries in the /etc/cron.d directories are one way; 'at' is another, overloading startup scripts is another. Fortunately, on typical *NIX systems all of those are protected by being in directories normally writable only by root, so non-root users don't have a chance to change things there.

An old favourite for running malicious code is the buffer overflow attack, but those are getting fewer as programmers and languages improve. In that respect Linux has much better security than Windows, and BSD is probably better than Linux.

Ok...explain slowly. How does a process start with the users uid and or gid without being first installed (a user can't install a program without either root access or using sudo with password)? Again you are speaking social engineering. Now if the process is "hacked" in and set to run on reboot, they will not survive a reboot unless they were installed as root. Please, you are making yourself look very petty by agreeing linux is more secure than windows yet continuing to argue that it can be exploited "easier" than a windows machine.

 

[GodMark2]

Ok...explain slowly. How does a process start with the users uid and or gid without being first installed (a user can't install a program without either root access or using sudo with password)?

By exploiting a flaw in a program that was written by humans.

A recent security advisory announced today by Rapid7 explains, "the NVIDIA Binary Graphics Driver for Linux is vulnerable to a buffer overflow that allows an attacker to run arbitrary code as root. This bug can be exploited both locally or remotely (via a remote X client or an X client which visits a malicious web page). A working proof-of-concept root exploit is attached to this advisory." The advisory goes on to note that the FreeBSD and Solaris binary drivers are also likely vulnerable to the same flaw and cautions, "it is our opinion that NVIDIA's binary driver remains an unacceptable security risk based on the large numbers of reproducible, unfixed crashes that have been reported in public forums and bug databases."

link

A vulnerability has been identified in Linux Kernel, which could be exploited by local attackers to cause a denial of service or gain elevated privileges. This issue is caused by a buffer overflow error in the "isdn_net_setcfg()" [drivers/isdn/i4l/isdn_net.c] function when processing specially crafted IIOCNETSCF requests, which could be exploited by malicious users to panic an affected system or execute arbitrary code with elevated privileges.

link

Note: "RUN ARBITRARY CODE AS ROOT" and "gain elevated privileges". That means the program doesn't need to be run as root to begin with, it can bootstrap itself to a higher priority. Flaws exist, even in your holier than thou Linux.

Tell me, what damage could a virus do on a Linux machine when you are running as a user and not as root?

Using the above exploits? Copy and send every file on your drive to a remote source then delete them.

continuing to argue that it can be exploited "easier" than a windows machine.

He made no such argument. You are a liar.

You are one of those people that think windows is the answer to the problems of the world.

I made no such claim. You are a liar.

 

[~enigma~]

By exploiting a flaw in a program that was written by humans.

link
link

Note: "RUN ARBITRARY CODE AS ROOT" and "gain elevated privileges". That means the program doesn't need to be run as root to begin with, it can bootstrap itself to a higher priority. Flaws exist, even in your holier than thou Linux.

Actually if you read carefully we were talking about code run AS A USER. Guess you can call this a problem but tell me, does everybody use Nvidia drivers? On second thought, don't bother replying since you are rude and obnoxious enough to make such a stupid statement about my "holier than thou" Linux.

 

[Wudang]

Did you look at the date on the article or are you just trying to get into a conversation so badly that you risk making yourself look foolish by posting an article from 2005. Besides, all current distros of Linux have a minimum version of Firefox 2 and a few even use Firefox 3. So now would you be so kind as to clarify why you posted an almost 3 year old article?

Where there is one bug there can be another. You are the one who is not making themselves look foolish, you are in fact a fool. If you knew the slightest thing about computers we wouldn't even be having this argument.

 

[Blue Mountain]

Actually if you read carefully we were talking about code run AS A USER. Guess you can call this a problem but tell me, does everybody use Nvidia drivers? On second thought, don't bother replying since you are rude and obnoxious enough to make such a stupid statement about my "holier than thou" Linux.

~enigma~, perhaps this conversation can improved by answering some questions for me and Wudang:
1) Do you write programs, either professionally or as a serious hobby?
2) If the answer to #1 is yes, what languages are you familiar with?
3) In Linux, what do 'cron' and 'at' do?

 

[Blue Mountain]

Ok...explain slowly. How does a process start with the users uid and or gid without being first installed (a user can't install a program without either root access or using sudo with password)?

That's only 90% correct. Most software can't be installed without going root because the installation process wants to create shared libraries in /usr/lib and write configuration files in /etc, which require root permissions in order to write to them. But simple programs, the type that can e-mail your personal files all over the internet and delete your personal files, can be set up and run with only user permissions.

And by exploiting bugs in the system, these programs could gain root privileges.

Again you are speaking social engineering. Now if the process is "hacked" in and set to run on reboot, they will not survive a reboot unless they were installed as root.

Not necessarily so. Again, what do 'cron' and 'at' do?

Please, you are making yourself look very petty by agreeing linux is more secure than windows yet continuing to argue that it can be exploited "easier" than a windows machine.

I don't think I've made the argument that it can be exploited "easier" than Windows. I'm arguing that it's possible to exploit bugs in Linux, and as a user you should be aware that it is possible.

Writing hacks like this is difficult no matter what OS you're running. Linux has advantages in that it doesn't open as many ports to the internet (making it harder to gain access from the internet at large) and a smaller user base (making it a less tempting target.)

 

[Wudang]

Oh, the fun we had as students adding a little something to someone else's .profile or .kshrc

 

[~enigma~]

That's only 90% correct. Most software can't be installed without going root because the installation process wants to create shared libraries in /usr/lib and write configuration files in /etc, which require root permissions in order to write to them. But simple programs, the type that can e-mail your personal files all over the internet and delete your personal files, can be set up and run with only user permissions.

And by exploiting bugs in the system, these programs could gain root privileges.


Not necessarily so. Again, what do 'cron' and 'at' do?


I don't think I've made the argument that it can be exploited "easier" than Windows. I'm arguing that it's possible to exploit bugs in Linux, and as a user you should be aware that it is possible.

Writing hacks like this is difficult no matter what OS you're running. Linux has advantages in that it doesn't open as many ports to the internet (making it harder to gain access from the internet at large) and a smaller user base (making it a less tempting target.)

Did you read post #34?

 

[Wudang]

Did you read post #34?

Did you read and understand post #33? Because it doesn't seem like it.

BTW while googling I found this http://www.pcworld.idg.com.au/index.php/id;1857673165;fp;2;fpid;2
which I found an interesting read.
"A recent Linux security hole allows local users to seize the power of root. Here's how three separate bugs came together to create one big vulnerability"