MESSAGE
| DATE | 2015-12-23 |
| FROM | Rick Moen
|
| SUBJECT | Re: [Hangout-NYLXS] Linux Viruses PROVEN by this guy
|
Quoting Ruben Safir (ruben-at-mrbrklyn.com):
> https://www.youtube.com/watch?v=y_lhqg_p21k
{one Matthew Moore bashing men smelling like straw}
Main bashing target is video clip 'Linux Does What Win Don't!',
https://www.youtube.com/watch?v=HD6nqQrJx78
Clip is kind of dumb. 'Spatry' states: 'Today, I looked on Wikipedia
just to see how many rootkits, trojans, viruses, and worms there are for
Linux, and counted only 47 of them. Combined!'
Something of a dumb argument, as detailed below. Speaker burbles about
kernels, 'secure by design', 'malware cannot harm your system files'...
Blah blah root password blah blah. Kinda mostly content-free. (I'm
going to skip the final 10 minutes because it's a bit painful. He's
blathering about drivers now, at the 2 minute mark.)
Secondary bashing target: 'A lot of people say that you don't have to
worry about malware on Linux. Including right here.' [Link is to
http://www.whylinuxisbetter.net/items/viruses/index.php?lang= ]
Page, by the way, is breezy and inexact, but decent as far as it goes.
Near the top it has the incautious statement 'Linux hardly has any
viruses', which it then semi-decently qualifies as meaning well, they
exist, but they're not a credible threat for some reasons that are then
briefly enumerated.
It is dumb and bad rhetoric to state that few viruses exist for Linux,
because (1) it's factually untrue, and (2) quantity of viruses is
irrelevant to any real-world concern.
In the several sections of http://linuxmafia.com/~rick/faq/, the Linux
malware portion of my person FAQ page, I list:
65 viruses
12 worms
1 buffer-overflow attack on a userspace app (the proprietary mpg123 utility)
320 other various things often erroneously called 'viruses' that are
usable only after compromising security by other means (rootkits,
attack tools)
So, don't claim 'Linux has hardly any viruses'. That's not only
mistaken, but irrelevant. Imagine for the sake of discussion that
you needed to add three zeroes to each of the above figures. OK, so
someone has written a number of codebases (though, in the real world,
this actually is a few codebases with a large number of very minor
and insignificant variations). And that shows...?
Threats are worth paying attention to if they are _credible_. Quantity
of alleged threats doesn't matter if they aren't credible.
The rest of my (long) page is mostly debunking this and other
misconceptions about malware -- and explaining why and to what degree
Linux malware isn't credible. Or rather, if there's malware, it
inevitably turns out to be not an attack but rather a minor secondary
aftereffect of a -real- security problem, and that, the administrator
had a lot more meaningful things than malware to worry about.
Moore: 'Well, you _do_ have to worry about malware on Linux. As a
matter of fact, I've got a malware infection on this very machine, at
this very moment, which I'll demonstrate for you right now. Sophos is
what I use on my Linux systems. This is Sophos Anti-Virus for Linux.
I've been using Sophos products since about about 2009, when I had my
Mac. I personally believe that Sophos has some of the very best
antimalware software for Unix-based operating systems out there. So, I
have Sophos installed on my Arch Linux system, and I will demonstrate
for you right now that I have a malware infection.' [skip tedious stuff
about how he doesn't have WINE, etc.] 'I found out that I had malware
when I tried to launch this application right here, "Imagination".
Didn't work. I tried to rebuild the program, still didn't work. So,
I opened up my terminal, and I scanned it, with Sophos. I narrowed it
down to a single directory -- if I can go back to my commands and find
it, OK -- "sudo savscan -v /var/tmp/Imagination". Oh, we don't need the
verbose mode. We can get rid of that. [reads directory path] So, one
of the Imagination temp files has malware in it, and I'm going to do
that right now.' [skip some fumbling around]
RM notes: Screen report says, in part:
>>> Virus 'Troj/Espion-AD' found in file /var/tmp/Imagination/tekdefense.dll
>>> Virus 'Troj/Farfli-Gen' found in file /var/tmp/Imagination/854137.exe/FILE:0000
>>> Virus 'Mal/FarFli-C' found in file /var/tmp/Imagination/854137.exe
'As you can see, that directory has malware in it. It has two trojans,
and... uh, OK. So, these two are listed as trojans, and this one is
listed as malware Far F L dash C. I don't know what that means, but....
Seven files were scanned, 3 viruses were discovered, 2 files out of 7
were infected. Hmm. Interesting. I didn't think Linux got viruses.
Hmmph. Heh-heh-heh. How do we fix this problem. Well, we do that
command again, and we just put a -remove behind it. That will
automatically prompt us to remove anything that it finds. So, we'll do
that.... OK.... Removal successful. Remove. Removal successful. OK.
Let's just go ahead and double-check that we're clean.... OK. We are
now clean.' [waves hands frenetically] 'So, Sophos antivirus cleaned
up the infection, and no viruses were discovered.'
Again, this is pretty painful, so I'll stop transcribing here.
'THe next thing I wanted to talk about is disk fragmentation.' (Goes on
to talk about the existence of three disk defragmenters in e2fsprogs,
and makes the non-sequitur assertion that the existence of defragmenter
utilities means fragmentation is a problem -- showing that he doesn't
understand the subject at all.
I'll note in passing that he then goes through a Wikipedia page about
e2fsprogs pointing out the three 'defragmenters', and never notices that
two of them are utilities that merely report on the degree of
fragmentation present. The third, e4defrag, is an actual filesystem
defragmenter.
He then runs a fragmentation check (on a SSD with 307,624 files in the
root filesystem), and fails to notice that there's
only a trivial degree of file fragmentation present -- five fragmented
files in total, two of them logfiles, one wtmp, one a Google Chrome
cache file, and a trasient Skype data file. He also fails to notice
that it says 'This directory (/) does not need defragmentation' at the
bottom.
Ugh, I'm sorry, I lasted to the 08:42 mark, but can't take more of this
drivel.
FWIW, Mr. Moore's 'Linux viruses' in /var/tmp/Imagination with the hilariously
MS-Windows-specific filenames were subject of some discussion on
linux.com and Reddit:
http://www.linux.org/threads/matthew-moore-gets-a-virus-on-arch.8011/page-2
https://www.reddit.com/r/linux/comments/33s60i/mythbusting_linux_guy_says_he_proofs_that_his/
However, Mr. Moore transported MS-Windows files onto his Arch Linux
system already bearing what Sophos claims to be MS-Windows malware
inside them, he is certainly correct that Linux permits you to do that.
Yeah, boy, that /bin/cp utility is _dangerous_, isn't it?
_______________________________________________
hangout mailing list
hangout-at-nylxs.com
http://www.nylxs.com/
|
|
