Subject: RE: viruses on UNIX vs. Windows

From: "Gian-Pietro Saggioro" <[email-masked]>
Date: Sat, 6 May 2000 15:30:13 +0100

Keith (& all),

Very interesting considerations, I subscribe your point of view. You can
imagine when MS will be splitted (may be not in the near future, let's say
within 3/4 years), the new company, let's call it "GateSoft", will release
"GateSoft Office 2003 for 
L-I-U-nix (Linux + Unix HP and Solaris)". 
The Visual Basic engine will be available also in the "protected" and
"perfect" world. How many time you installed software on a Linux/Unix
machine and instead of getting the very famous error messages, the
application was simply not working ... 
core dumped !
( I just got another example two days ago!!! Don't ask me witch is the
program ! I have the answer!!)
Everybody knows the difference in terms of pricing between Win-based system
and Unix environment, I mean globally Hardware and Software.
Linux is, in this aspect, not involved; it is just the lack of Software
limiting the diffusion; talking about the Hardware there requirements are
quite convenient.

The alternative will appear not the ideal solution when it will use the MOST
COMMON SOFTWARE SOLUTION diffused on this planet: this is the "cruel"
reality.

I have a question you all: 
Is the JAVA environment ideal for creating worms and horses ? 
Are there any security holes ? 
If the programmer build a nice windows asking the user if they would like to
continue or not, is it possible to manipulate files on the Computer or
attach into the System scripts/registry malicious lines ?

If the answer are all YES, Java is the ideal tool for creating viruses for
the Linux/Unix world. The complexity, in terms of programming, of Java is
not really far from the VB Scripting. The last one is the method used by
millions of PC users in the 
Internet Community.

\GianPietro

-----Original Message-----
From: Keith Moore [mailto:[email-masked]]
Sent: Saturday, May 06, 2000 12:00 AM
To: Randall Stewart
Cc: Michael H. Warfield; [email-masked]; Scot Mc Pherson;
[email-masked]
Subject: viruses on UNIX vs. Windows 

it might be useful to further examine the differences between UNIX-like
systems (including Linux) and Windows systems regarding their 
susceptibility to viruses.  

1. it should first be noted that UNIX-like systems are not immune to 
worms or viruses.  the Morris worm propagated itself via buffer
overflow bugs in sendmail and finger, and similar vulnerabilities are
probably still available to a would-be attacker.  over the years many 
more security holes like these have been found in UNIX systems and 
exploited.  we'll keep seeing such holes as long as people write 
servers in C.  but for some reason such attacks tend not to be viruses,
we just haven't seen many worms/viruses use these techniques since the 
Morris worm.

2. the Morris worm worked with both vax and sun3 platforms presumably
because these were the most  popular platforms then in use on the 
Internet.  today most viruses target Windows boxes presumably because
they are so popular.

3. the attacks that have been successful against UNIX tend to be specific 
to a particular platform - its CPU instruction set, memory layout,
system traps, and library routines.  Windows boxes are also vulnerable 
to hardware-specific attacks, but they also support things like vbscript.  
so there are multiple languages by which one can attack a windows box, 
and many of those are commonly bundled with Windows.  so in addition
to windows being more popular, in some ways you it has a more 
predictable target environment (i.e. a given windows box is likely to
have more facilities you can exploit than a UNIX box) this makes Windows 
a more predictable platform for software developers, but virus writers 
are software developers too.

4. email-borne viruses have somewhat greater ability to penetrate 
private networks because email tends to not be filtered by firewalls
(and even firewalls that scan for viruses generally are limited to
scanning for known viruses)

UNIX-based email clients are less vulnerable than their Windows
counterparts because

a) UNIX-like systems do not come with an extensive registry of content-type 
   -to- program mappings.  nor, in general, do mail readers for these 
   platforms.  so if a mail reader receives an object with an unusual 
   content-type it is unlikely to know what to do with it (other than 
   to offer to save it to a file)

b) UNIX based mail readers tend to rely on the MIME content-type
   label and are less likely than Windows readers to "guess" how to
   handle a file based on the file name suffix.   MIME content-type
   registrations are required to contain a security considerations 
   section.  it may be that as a result, the content-type registry 
   on a UNIX system is less likely to contain definitions for 
   dangerous objects, than on a windows system...and therefore
   UNIX mail readers are less likely to try to interpret such things.

c) UNIX systems have fewer interpreters for content-types that
   can cause harmful side-effects, and such as do exist (such
   as PostScript) are more likely to be invoked in a "safe" mode.  

   script attacks are certainly possible on UNIX - most UNIX systems
   support script languages with destructive power similar to vbscript.
   but it is very unlikely that a UNIX mail reader would be configured
   to, say, automatically execute a perl script received in mail.

d) UNIX has not traditionally had a point-and-click interface,
   so the notion that there is some action implicitly associated
   with a file type, so common in the Windows and Mac worlds,
   does not hold for UNIX.  Indeed, UNIX has much the opposite
   notion - that arbitrary tools can be applied to arbitrary files.

5. unlike many Windows-ish boxes, UNIX is a multi user operating
   system with file protections.  thus there is a layer of isolation 
   between user processes and the operating system, which limits the 
   degree of damage that is likely to happen.  to be sure, a lot of 
   harm can be done by trashing or altering a single user's files, 
   and there may are often security holes which can be exploited 
   to elevate an ordinary user's privileges.  but this is still an 
   additional barrier that must be overcome.  Windows is an easier
   target.

6. there is a great deal more history with security exploits,
   and thus with countermeasures, on UNIX-like systems.

   there seems to be greater awareness of the potential for harm
   among the UNIX community than among Windows developers.
   this may be because UNIX is primarily used by computer experts.

conclusion:

to some degree Windows is inherently more vulnerable because it
is a more popular platform.  however it should be possible to make 
Windows much less vulnerable than it currently is merely by a few 
countermeasures.

- don't automatically evaluate content unless it is KNOWN to be safe
  from harmful side-effects.  either that or evaluate the content
  only within a sandbox which prevents such harm.  (this means
  that you limit the content that you're willing to automatically
  evaluate to a few well-understood types)

- don't offer to execute content that can cause harm unless 
  (a) the recipient okays it, (b) the sender's identity is
   known and the integrity of the file can be assured
  (via verifiable digital signatures), and (c) the recipient
  is warned *each time* that the content can cause harm.

Keith