IIRC try this on Linux:

#! /bin/sh
$0 &
perl -e 'push @big, 1 while 1' &
while true
do
  $0
  sleep 1
done
[download]

Also on any OS you care to name, if you keep content you care about as yourself, a nasty virus can cause a problem for you.

Plus often the malicious just want access to resources. For instance that works fine for DDoS. Modify someone's .login so your zombie starts up routinely, that is enough to waste bandwidth and improve your ability to lay waste to someone else's site.

Plus on any Unix-like OS I know of except OpenBSD, it isn't that hard to find, install, and execute a rootkit given local access. This process can even be automated.

And, of course, with access to CPAN (which was just compromised...) you can put up code that many people will run as root. Gosh, darn.

Now the Unix world has improved since the days when Robert Morris accidentally shut down the Internet. But too many now no longer remember that lesson, and Windows definitely does not. Personally a couple of years ago I became convinced that it was a matter of time until a virus or worm came around that can do the same thin that the Morris worm did - be able to hit a large fraction of machines it encounters and have a generation time that does not depend on human error - and shut down the Internet again. (The example I like to give is a virus that can propagate itself through a buffer overflow in a TCP/IP stack.)

The EROS people claim that the problems are inherent in the security model we all use. I accept their arguments that the commonly used security model is inherently flawed. I find their arguments that their model fixes the issue to be plausible, but I would need to see it put to the test before I am persuaded.

However more fundamentally than that, security is a cost center for businesses. The immediate response in any healthy business to costs is to ask how to offload the cost to someone else, or failing that to find the minimum that can be paid without harming revenue. As you will discover if you read your license agreements, that has been definitely going on in the software industry for a long while. All too often closed source is used as an excuse to ignore dealing with basic security mistakes. Like backdoors.

And the open source zealots can stay quiet as well. The economic realities are the same. According to Honeynet the expected lifetime of a default Red Hat 6.2 server online is under 72 hours. As Sourceforge found out, open source developers cheerfully walk up to public access terminals and type critical passwords into ssh. Public access terminals whose security they know nothing about. Also it isn't a secret that a significant portion of open source projects are written in C and submissions are not closely audited for security mistakes like buffer overflows. Or at least are not audited by the project maintainer and not for a long time by anyone with a white hat. But if you were discovered to have had a buffer overflow in a patch, do you think people would suspect you of anything...?

Gah, I should stop ranting about (in)security before I depress myself. :-(

No need to depress youself :) We live in an imperfect world, and do the best we can. Often, our best is enough.

There are many subleties to security mangament, and I am no expert in these affairs. But I can spot that your post is very focussed on technical problems and solutions. Some of the numbers you quote seem a little off to me, but I respect the depth and breadth of your knowledge on matters technical. If you say there's a problem, there is a problem. However technical issues are only one part of proper security management, which is just part of ordinary risk management. Looking at the whole situation shows that the situation is not so bad.

I'd like to mention the risk-damage-payoff matrix. You've probably seen it, so I'll just mention it here for completeness, and for any other readers who haven't. You can make it very complicated, but it looks kind of like this (excuse ascii text):

          |harmless| mild |catastrophic|
----------+--------+------+------------+
h.unlikely|   0        .2        .7
unlikely  |   0        .3        .8
maybe     |   .2       .5        .9
likely    |   .3       .7        1
certain   |   .4       .9        1
[download]

The table is filled out with some values representing the amount of time/attention/effort you should spend safeguarding against the threat. Filling out the matrix is a difficult thing to do, and depends on the situation. You can almost ignore threats that are harmless and unlikely. If you are faced with any threats that are certain and catastrophic you should eliminate them, or find someone to blame. In between, you should be deploying an appropriate response.

Now I can evaluate security threats more effectively. I'll go through a few scenarios that tilly mentions, and one he doesn't:

* Crashes computers - The fork bomb
Harmless and unlikely. At the worst I have to get up and power-cycle the server. I can cope with this.

* Compromises data - The root kit
Maybe and mild damage. A root kit means that somebody wants the machine to keep working. As long as it keeps serving, our business is not lost. I can cope with a root kit, and deal with it at my leisure.

* Destroys servers - Fork bomb replaced with rm / -rf
Catastrophic and unlikely (why do this when you've gone to the effort to hack my machines?). This would sink our business. Good thing I keep backups. With backups the damage is 'mild' - loss of business due to downtime and some data loss.

Technical solutions always go hand in hand with management and procedural solutions. You tell me that my machine could be hacked once every three days? Fine, I'll hire someone to rebuild the machine every three days. I'm much more worried about network DoS attacks, because I can't control or minimise my risk there.

Most security problems occur not because of technical flaws, but because people are intent on shooting themselves in the foot. They write their passwords on post-it notes and stick it to the monitor. They write their PIN numbers on their ATM cards. We will eventually have secure operating systems, but the idiots running them will manage to compromise security by ignoring procedures that could protect them because these procedures are inconvenient. The only way to really secure something is to set it in concrete and then dump it in the Grand Mariner trench. If you want people to actually use it, you have to accept the risks, and start working to cope with them.

____________________
Jeremy
I didn't believe in evil until I dated it.

* Compromises data - The root kit
Maybe and mild damage. A root kit means that somebody wants the machine to keep working. As long as it keeps serving, our business is not lost. I can cope with a root kit, and deal with it at my leisure.

Eh? If a root kit has been installed, how can you ensure the integrity of your data? If the cracker is smart enough to cover their tracks, this strikes me as closer to the *catastrophic* category ... now where are your customer's credit card numbers again? Is that a modified ls in your /bin, or are you just happy to be sending packets of crucial information to nasty.crackers.net that are going to be sold to the competition?

Even if you restore from a known-good state, you still stand to lose any data collected between the time that state was saved and the time the rootkit was installed.

OK, tripwire and the like can help with these issues, but my inclination would be to err on the side of caution were I to find a rootkit installed on any machine I admin.

perl -e 'print "How sweet does a rose smell? "; chomp ($n = <STDIN>); 
+$rose = "smells sweet to degree $n"; *other_name = *rose; print "$oth
+er_name\n"'
[download]