So you think Linux is safe?

For discussions about security.
Post Reply
Message
Author
2byte
Posts: 353
Joined: Mon 09 Oct 2006, 18:10

So you think Linux is safe?

#1 Post by 2byte »

Special Report: U.S. cyberwar strategy stokes fear of blowback

http://www.reuters.com/article/2013/05/ ... EL20130510
Reuters reviewed a product catalogue from one large contractor, which was made available on condition the vendor not be named. Scores of programs were listed. Among them was a means to turn any iPhone into a room-wide eavesdropping device. Another was a system for installing spyware on a printer or other device and moving that malware to a nearby computer via radio waves, even when the machines aren't connected to anything.
There were tools for getting access to computers or phones, tools for grabbing different categories of data, and tools for smuggling the information out again. There were versions of each for Windows, Apple and Linux machines.


nooby
Posts: 10369
Joined: Sun 29 Jun 2008, 19:05
Location: SwedenEurope

#2 Post by nooby »

Good that you told us. We have to encourage the devs
to look into it and see if there is any way to improve Puppy
if it is vulnerable in same way or worse. Due to how different it is
maybe their general ways to approach standard Linux maybe their
script has not inclided Puppy on the other hand if we are number ten
most popular they include Puppy differences in the script.

If standard Linux do this.
If Puppy Linux ask for help from operator :)
I use Google Search on Puppy Forum
not an ideal solution though

User avatar
8-bit
Posts: 3406
Joined: Wed 04 Apr 2007, 03:37
Location: Oregon

#3 Post by 8-bit »

I recently visited a web site that downloaded a partial file to /tmp before I caught it.
It was an EXE file and I assume it was an attempt to infiltrate Windows.
I cannot remember the site. But the appearance of an unrequested file got to me.

Also, at a site called 4Shared, I tried to download a game tar.gz file.
The site wanted me to download and run a file downloader that happened to be an EXE file.

And when I did a search of their site for the game file name, I was told it did not exist!

So what has happened to you lately that you would consider suspicious?

Sylvander
Posts: 4416
Joined: Mon 15 Dec 2008, 11:06
Location: West Lothian, Scotland, UK

#4 Post by Sylvander »

8-bit wrote:So what has happened to you lately that you would consider suspicious?
See:
Was I hacked?

jpeps
Posts: 3179
Joined: Sat 31 May 2008, 19:00

#5 Post by jpeps »

Sylvander wrote:
8-bit wrote:So what has happened to you lately that you would consider suspicious?
See:
Was I hacked?
Just remember that we're all on the network, so it's important to look, sound, and smell good at all times.

Sylvander
Posts: 4416
Joined: Mon 15 Dec 2008, 11:06
Location: West Lothian, Scotland, UK

#6 Post by Sylvander »

jpeps wrote:Just remember that we're all on the network, so it's important to look, sound, and smell good at all times.
Huh?! :?
I don't understand.
Which network are we all on?

jpeps
Posts: 3179
Joined: Sat 31 May 2008, 19:00

#7 Post by jpeps »

Sylvander wrote:
jpeps wrote:Just remember that we're all on the network, so it's important to look, sound, and smell good at all times.
Huh?! :?
I don't understand.
Which network are we all on?
wireless

http://www.csmonitor.com/Science/2010/0 ... mell-phone

Incidentally, this same chip is being developed for marketing data by tracking physiological responses.

linuxbear
Posts: 620
Joined: Sat 18 Apr 2009, 20:39
Location: Las Vegas, Nevada, USA

#8 Post by linuxbear »

... might be true, but it is not that easy to get in my system. My router does not broadcast it's name and protected by a complex password.

my user account is protected by a complicated password
my important personal files are encrypted and my machines are turned off daily

Edwardo
Posts: 42
Joined: Wed 26 Jun 2013, 07:17

#9 Post by Edwardo »

linuxbear wrote:... might be true, but it is not that easy to get in my system. My router does not broadcast it's name and protected by a complex password.

my user account is protected by a complicated password
my important personal files are encrypted and my machines are turned off daily
LB wifi has 5 methods to broadcast identification. Disabling SSID is a waste of a cycle. Did you address the other 4?

Further, passwords cannot resist the efforts of a skilled attacker with good cracking tools. 12 digit passwords yield in seconds. It's almost trivial.

linuxbear
Posts: 620
Joined: Sat 18 Apr 2009, 20:39
Location: Las Vegas, Nevada, USA

#10 Post by linuxbear »

I am aware that someone with good skills can get in. That's why everything important is encrypted and the machine is completely scrubbed with bleachbit at least 3 times a week.

User avatar
Moose On The Loose
Posts: 965
Joined: Thu 24 Feb 2011, 14:54

#11 Post by Moose On The Loose »

8-bit wrote: So what has happened to you lately that you would consider suspicious?
1) On a Windows-7 machine, I installed the latest updates by leaving it on with that process going for the night. The next morning, the machine ran really .... really .... slow and would not get on a network no matter what I tried. I rolled back to a restore point and it was back to normal. It makes me suspect someone has figured out how to pretend to be Microsoft.

2) I have had quite a few cases of seeing something like a picture with a link that said "something.jpg" or an audio file that says it is "something.wav" that in fact leads to a something.exe. I think that is above "suspicious" and more like "obviously"

3) A while back there was a "political add" that pretended to be a local news story. It qualifies as a mind virus but is worth mentioning because it showed a method. It used one of the IP to location services and some javascript to make it always dated yesterday and be from the (your town) Express. It contained links that it invited you to click on that it claimed where to the newspaper's site but in fact took you to a server run by the political group. The same method could be used to make it appear some local folks want you to click on the thing that put the virus on your computer.

redandwhitestripes
Posts: 179
Joined: Fri 02 Jan 2009, 06:49

#12 Post by redandwhitestripes »

Edwardo wrote:
linuxbear wrote:...
Further, passwords cannot resist the efforts of a skilled attacker with good cracking tools. 12 digit passwords yield in seconds. It's almost trivial.
Not the full picture. You need to define "skilled attacker" and "good tools". Brute force attacks can be resisted with a password mixing case, numbers and punctuation.

In the same way anyone's property can be broken into with enough resources, I guess the same holds true for networks, but if you follow simple steps such as using a decent firewall, WPA2 encryption if possible and using strong passwords and up to date software, you have a good chance of holding out against most hackers IMHO.

User avatar
wibble
Posts: 76
Joined: Thu 11 Jul 2013, 03:48

#13 Post by wibble »

If someone with the skills and tools and time wants to then sure its possible. But consider how often that will happen... The probability unless you are a political dissident, or subject to a government or corporate investigation are pretty slim.

now improving security to prevent everyday exploits from script kiddies and mail-ware that makes a whole lot of sense. Linux is pretty secure as long as precautions are taken, firewall ect..

I would sweat more on a windows box to be honest. There is a lot more development of exploits for that platform just because of the shear amount of users.

If you think 12 character password strings are bad... IBM mainframes have a maximum length of 8... and also cannot contain spaces or special characters. So from a security point of view they are far more vulnerable platforms when connected to the Internet.

The really scary one for me is wireless, there are so many potential holes and exploits that are inbuilt into the standard. I would not trust it for my sensitive data. And once the 'Internet of things' takes off you will have an even larger problem.

That said I think as time goes on and Linux gets more acceptance there will be more tools and exploits developed for the platform - look at Zeus you don't even need to have a great deal of technical skill to use it.

However I really would like to be able to password the system, I noticed I could do that with attack puppy. would be nice to have that ability with precise.

User avatar
Sky Aisling
Posts: 1368
Joined: Sat 27 Jun 2009, 23:02
Location: Port Townsend, WA. USA

So you think Linux is safe?

#14 Post by Sky Aisling »

“Hand of Thief
Last edited by Sky Aisling on Thu 08 Aug 2013, 16:35, edited 1 time in total.

Ibidem
Posts: 549
Joined: Wed 26 May 2010, 03:31
Location: State of Jefferson

Re: So you think Linux is safe?

#15 Post by Ibidem »

https://blogs.rsa.com/thieves-reaching- ... inth3wild/
Secondly, since Linux is open source, vulnerabilities are patched relatively quickly by the community of users. Backing this up is the fact that there aren’t significant exploit packs targeting the platform. In fact, in a conversation with the malware’s sales agent, he himself suggested using email and social engineering as the infection vector.

User avatar
L18L
Posts: 3479
Joined: Sat 19 Jun 2010, 18:56
Location: www.eussenheim.de/

#16 Post by L18L »

wibble wrote:... I really would like to be able to password the system, I noticed I could do that with attack puppy. would be nice to have that ability with precise.
I don't know what is attack puppy but I do know to use the command

Code: Select all

passwd

Post Reply