Re (tilly) 2: Obfuscation and viruses

Please don't be complacent about the ability of different operating system to make viruses a non-problem.

IIRC try this on Linux:

#! /bin/sh
$0 &
perl -e 'push @big, 1 while 1' &
while true
do
  $0
  sleep 1
done
[download]

Yes this is fixable with the right set of rlimits. But crafting that set is surprisingly hard to do, and is hard to do without getting in the way of having a usable desktop. (FWIW Windows NT does far better with this particular DoS. I have heard that that is partly because its memory management subsystem is designed after what VMS does.)

Also on any OS you care to name, if you keep content you care about as yourself, a nasty virus can cause a problem for you.

Plus often the malicious just want access to resources. For instance that works fine for DDoS. Modify someone's .login so your zombie starts up routinely, that is enough to waste bandwidth and improve your ability to lay waste to someone else's site.

Plus on any Unix-like OS I know of except OpenBSD, it isn't that hard to find, install, and execute a rootkit given local access. This process can even be automated.

And, of course, with access to CPAN (which was just compromised...) you can put up code that many people will run as root. Gosh, darn.

Now the Unix world has improved since the days when Robert Morris accidentally shut down the Internet. But too many now no longer remember that lesson, and Windows definitely does not. Personally a couple of years ago I became convinced that it was a matter of time until a virus or worm came around that can do the same thin that the Morris worm did - be able to hit a large fraction of machines it encounters and have a generation time that does not depend on human error - and shut down the Internet again. (The example I like to give is a virus that can propagate itself through a buffer overflow in a TCP/IP stack.)

The EROS people claim that the problems are inherent in the security model we all use. I accept their arguments that the commonly used security model is inherently flawed. I find their arguments that their model fixes the issue to be plausible, but I would need to see it put to the test before I am persuaded.

However more fundamentally than that, security is a cost center for businesses. The immediate response in any healthy business to costs is to ask how to offload the cost to someone else, or failing that to find the minimum that can be paid without harming revenue. As you will discover if you read your license agreements, that has been definitely going on in the software industry for a long while. All too often closed source is used as an excuse to ignore dealing with basic security mistakes. Like backdoors.

And the open source zealots can stay quiet as well. The economic realities are the same. According to Honeynet the expected lifetime of a default Red Hat 6.2 server online is under 72 hours. As Sourceforge found out, open source developers cheerfully walk up to public access terminals and type critical passwords into ssh. Public access terminals whose security they know nothing about. Also it isn't a secret that a significant portion of open source projects are written in C and submissions are not closely audited for security mistakes like buffer overflows. Or at least are not audited by the project maintainer and not for a long time by anyone with a white hat. But if you were discovered to have had a buffer overflow in a patch, do you think people would suspect you of anything...?

Gah, I should stop ranting about (in)security before I depress myself. :-(

Comment on Re (tilly) 2: Obfuscation and viruses Download Code

Replies are listed 'Best First'.
Re(Jepri) 2: Obfuscation and viruses by jepri (Parson) on Jun 20, 2001 at 17:01 UTC
No need to depress youself :) We live in an imperfect world, and do the best we can. Often, our best is enough. There are many subleties to security mangament, and I am no expert in these affairs. But I can spot that your post is very focussed on technical problems and solutions. Some of the numbers you quote seem a little off to me, but I respect the depth and breadth of your knowledge on matters technical. If you say there's a problem, there is a problem. However technical issues are only one part of proper security management, which is just part of ordinary risk management. Looking at the whole situation shows that the situation is not so bad. I'd like to mention the risk-damage-payoff matrix. You've probably seen it, so I'll just mention it here for completeness, and for any other readers who haven't. You can make it very complicated, but it looks kind of like this (excuse ascii text): `\|harmless\| mild \|catastrophic\| ----------+--------+------+------------+ h.unlikely\| 0 .2 .7 unlikely \| 0 .3 .8 maybe \| .2 .5 .9 likely \| .3 .7 1 certain \| .4 .9 1` [download] The table is filled out with some values representing the amount of time/attention/effort you should spend safeguarding against the threat. Filling out the matrix is a difficult thing to do, and depends on the situation. You can almost ignore threats that are harmless and unlikely. If you are faced with any threats that are certain and catastrophic you should eliminate them, or find someone to blame. In between, you should be deploying an appropriate response. Now I can evaluate security threats more effectively. I'll go through a few scenarios that tilly mentions, and one he doesn't: * Crashes computers - The fork bomb Harmless and unlikely. At the worst I have to get up and power-cycle the server. I can cope with this. * Compromises data - The root kit Maybe and mild damage. A root kit means that somebody wants the machine to keep working. As long as it keeps serving, our business is not lost. I can cope with a root kit, and deal with it at my leisure. * Destroys servers - Fork bomb replaced with rm / -rf Catastrophic and unlikely (why do this when you've gone to the effort to hack my machines?). This would sink our business. Good thing I keep backups. With backups the damage is 'mild' - loss of business due to downtime and some data loss. Technical solutions always go hand in hand with management and procedural solutions. You tell me that my machine could be hacked once every three days? Fine, I'll hire someone to rebuild the machine every three days. I'm much more worried about network DoS attacks, because I can't control or minimise my risk there. Most security problems occur not because of technical flaws, but because people are intent on shooting themselves in the foot. They write their passwords on post-it notes and stick it to the monitor. They write their PIN numbers on their ATM cards. We will eventually have secure operating systems, but the idiots running them will manage to compromise security by ignoring procedures that could protect them because these procedures are inconvenient. The only way to really secure something is to set it in concrete and then dump it in the Grand Mariner trench. If you want people to actually use it, you have to accept the risks, and start working to cope with them. ____________________ Jeremy I didn't believe in evil until I dated it.	[reply] [d/l]
Re: Re(Jepri) 2: Obfuscation and viruses by arturo (Vicar) on Jun 20, 2001 at 17:44 UTC
* Compromises data - The root kit Maybe and mild damage. A root kit means that somebody wants the machine to keep working. As long as it keeps serving, our business is not lost. I can cope with a root kit, and deal with it at my leisure. Eh? If a root kit has been installed, how can you ensure the integrity of your data? If the cracker is smart enough to cover their tracks, this strikes me as closer to the catastrophic category ... now where are your customer's credit card numbers again? Is that a modified `ls` in your `/bin`, or are you just happy to be sending packets of crucial information to nasty.crackers.net that are going to be sold to the competition? Even if you restore from a known-good state, you still stand to lose any data collected between the time that state was saved and the time the rootkit was installed. OK, tripwire and the like can help with these issues, but my inclination would be to err on the side of caution were I to find a rootkit installed on any machine I admin. `perl -e 'print "How sweet does a rose smell? "; chomp ($n = <STDIN>); +$rose = "smells sweet to degree $n"; other_name = rose; print "$oth +er_name\n"'` [download]	[reply] [d/l] [select]
Re: Re: Re(Jepri) 2: Obfuscation and viruses by jepri (Parson) on Jun 20, 2001 at 18:26 UTC
This is so totally my point. Techs (and I prefer to think of myself as one) often react disproportionatly to threats. Everyone does. To be precise: people suck really hard at assesing risk/damage/reward situations. There are studies that demonstrate this. You paid no attention to the rest of my post, and focussed on one point that you got wrong anyway. How do you know I keep our clients credit card numbers on the server? Is that your rootkit I see before me? I don't keep credit card numbers, nuclear launch codes or the secret of the mysterious cities of gold on my webserver. I keep webpages that people wish to share with the world. Not their credit card numbers. That was the whole point of the security matrix - to evaluate the effort I need to expend to counter threats, based on the damage to my business. You argued my case much better than I could. You immediately created an example using the worst possible damage imaginable (severe damage to my client's businesses) and argued your case from there. What crucial information could be sent to nasty.crack.net from a webserver? The passwords is the best I can guess. I can change my passwords. And what is the value of the information lost since the last backup? Is it worth more or less than the cost of spending days making the server completely bulletproof, and the incovenience of working with a fully-secured system? It's a lot less. This arguement should be setting off flags in your memory. It is the reason why a certain large company we love to hate can flog crap OSs and get away with it. They are surfing the 'high risk' part of the matrix, but they are on the low damage side. Most information is less valuable than you might be led to believe. ____________________ Jeremy I didn't believe in evil until I dated it.	[reply]