Re: [gentoo-user] Linux viruses

[shawn wilson]

I was present for a discussion about which is the most secure OS. I don't
remember the forum but the consensus was that the most secure OS is the one
you know. Anyone can wreck a system but not everyone has the ability to
maintain a system.

I'm not arguing that you can run Windows as tight as Linux (no SELinux,
tripwire costs $, etc). What I'm saying is if someone doesn't know Windows
they'll do more harm than good. (same Linux).

You can probably grep through a virus definition db and find an OS field.
Probably ClamAV is your best bet here (but any may work). There's also a
50+ gig torrent of all known viruses you can look for. You could also
figure out how to query vulns for the OS they're on (mitre or NIST) -
probably hard.

Reversing - as mentioned above, get a hex editor, and use strings. The
other option is that it could have debug symbols still.

Indicator lights is a piss poor way to see anything about what might be
running. It's like looking at the hdd light to see how much your computer
is processing.

Ps - the software you're talking about is Windows.
On Jul 6, 2013 5:22 AM, "Mick" <michaelkintzios@×××××.com> wrote:

> On Saturday 06 Jul 2013 07:57:38 the wrote:
> > On 07/06/13 02:21, Dale wrote:
> > > William Kenworthy wrote:
> > >> On 06/07/13 04:12, Dale wrote:
>
> > >>> While we was
> > >>> chatting, he said that Linux is just as prone to getting a virus as
> > >>> windoze and so is a Mac.  I think my laughing let him know I wasn't
> > >>> buying his comment.
>
> Well this is just FUD.  Linux and BSDs are much much less prone to virus
> infection due to their architecture and default authentication
> restrictions.
> Also your average Linux user, well at least your average Linux desktop
> user is
> more clued up than the MSWindows equivalent.  With the advent of Linux to
> mobile devices (Android) this statement is no longer true.
>
>
> > >> food for thought - some years back a member of the local lug picked up
> > >> that something was listening on a port that he didn't think should be
> in
> > >> use.  Turned out to be an infected windows binary running under wine
> ...
> > >>
> > >> I presume he had been using wine and this was left running, rather
> than
> > >> self starting.
> > >>
> > >> BillK
> > >
> > > Well, no Wine here.  So that won't happen.  Actually, I don't have a
> > > copy of windoze here at all.  Neither of my two rigs have ever had
> > > windoze installed on them at all.
>
> I'm sure some poster in 2003/04 posted in this same list about a MSWindows
> malware running in Wine.  That's indication of good code as far as I'm
> concerned, because most MSWindows programs that I tried would fall over
> themselves in Wine!  LOL!
>
>
> > > BTW, I have been known to open those attachments before. I usually open
> > > them with kwrite or something and try to see what is human readable in
> > > there.  Most is machine language but there is usually a small portion
> > > that is human readable.  They sent it and I'm nosy that way.  lol
> >
> > Perhaps it's easier to use strings?
>
>   hexdump -C <suspect_payload>
>
> You may have to unzip it first, because a lot of malware is zipped to
> escape
> detection from some simpler anti-virus checkers.  You can also use dd and
> pipe
> it to an antivirus to see if it finds anything known.
>
> All OS are susceptible to malware, but not all malware are viruses.  At
> least
> one virus has existed for Linux (in the 90s or early 00s), but it was
> patched
> overnight if I remember right.  Other than that I don't know of any
> programs
> which can be replicated on Linux machines.  I think this is because despite
> Lennart's efforts no two linux OS are exactly the same.  So, as the virus
> is
> trying to replicate itself it will fall down at the next box it tries to
> infect.
>
> However, rogue add-ons in browsers, increasingly sophisticated JavaScripts,
> and HTML 5 with all its cross-domain/cross-site-request potential could
> wreck
> at least some of your data and steal your information, just as easily as
> the
> adjacent MSWindows box.  Oh, before I forget, did I mention Java?
>
> Linux running on mobile devices is a different category because there is
> great
> uniformity of the OS across devices.  This is a big target for any malware
> writers and state actors who value their coding time:
>
>   http://techcrunch.com/2013/07/04/android-security-hole/
>
> --
> Regards,
> Mick
>