If you are using the term "virus," it usually refers to a piece of code that can be made to run on your machine by virtue of simply being exposed to it. A "trojan" is a program that is required to be installed by the user, using some form of social engineering. Linux is relatively immune to the former, less so to the latter. However, it is worth noting that NO malware attack on Linux environments has ever reached the epidemic proportions of an attack on Windows.

Usually, attacks on Linux systems are hacker attacks. They are specifically targeted at those systems.

2 members found this post helpful.

hello,

How about a comment on Barry Kauer's Puppy Linux (5.x).
Have run this from CD, HD, PenDrive for five years, seven versions/distros.
Am not a Linux engineer, just an educated & curious geek type.

Background for Puppy OS (as best I can figure it):
* OS can be run from a Live-CD, with OS residing only on CD.
* OS usually is copied to HD or PenDrive at the /home level.

* OS files are extracted from 4 squash files, which are read-only.
* OS files are RAM loaded at runtime.
* OS files are NEVER written to, at any time.
* User changes to the virtual/RAM OS runtime
are saved in a special 'savefile'
and the 'savefile' is layered on top of the RAM-loaded OS.
* The password is defaulted, running as 'root' normally.
* The Kauer group suggests that booting from a Live-CD on each bootup, and having the 'savefile' residing on the HD as a 'best methods' approach.


My method of restore:
* Have a copy of the 4 OS squash files, on different media.
* Have a daily backup of the 'savefile', incrementally dated, on different media.

This is an interesting subject, and your comments above
go into the good point of OS security.
So, I Welcome your comments, critiques, etc.

The live-CD approach has some unique advantages and disadvantages. Oftentimes, the live-CD method is recommended for applications like banking where a critical exploit would be something like a Trojan key logging application(*). With the live-CD, assuming one starts with a signed and verified source distribution, non writable media has the advantage of ensuring that nothing can modify the binary applications, such as the web browser. This means that a key logger or counterfeit SSL certificate can not be introduced into the system. Additionally, if any form of malware were picked up, it would be removed with a power down or reset as it would be confined to RAM. On the downside, write only media has the disadvantage of not being able to update which means you may be susceptible to known exploits that have been patched in subsequent releases. Therefore, the user has a higher degree of responsibility to monitor for critical updates and rebuild their platform when appropriate.

1 members found this post helpful.

Unfortunately that is not the only downside, see this post.

But it is also very important to understand why this is so. Literally millions of Windows machines on the Internet are "Home Edition" boxes, run by administrators with no passwords. Most of the system administration tools needed to properly secure the system are omitted. There is no knowledge-transfer about what to do. But the "anti-virus" stuff is very prominent, encouraging a false sense of security. When the system's defenses are disabled(!), you don't even have to "attack" it.

It's really a matter of percentages: you shoot for the easiest target, knowing that the odds are in your favor that you'll find it. Meaningful protection is simply a matter sometimes of locking your door.

The story of the "pizza-box thief" is actually not an urban legend: walking through expensive neighborhoods with a pizza-box (and a pizza!), trying the front door and, frequently, finding it unlocked and the alarm turned off. Step inside, grab a handful of jewelry off the dresser, drop it into the box. The missus is likely as not to imagine that she "lost" it. Strictly an opportunistic strategy.

You can update read only media by using a "secure" bootloader to change it to a read/write mount state,... That's how Android and other embedded devices do it...

That's not going to save you from a local attack or an attack vector based on cracking any keys issued for an update process. It's also not going to save you from attacks to the user space, where all the important data resides, anyway.

You can build a better fortress,... but if a thing can be built, it can be torn down. I am often reminded of a quote from one of the experienced members of my Linux users' group (back in the day when I attended those),... "Security is a process, not a product." You can't engineer a perfect system. It's impossible.

That said,... 99.999% safe is better than 99.9%, 95% or 85% safe...

Thanks.
It appears that the Live-CD, virtually in RAM, with a "change-save-file" on the HD
is a good way to go. I have one computer booting off a Live-CD (Puppy 525) , running with NO hard-drive, and having a pendrive (micro USB) plugged in for storage. This works OK.
Jasp said it very well
"Security is a process, not a product."

My regular computer runs Puppy Linux, from a Pendrive,
with grub4dos options to reboot into XP, Parted-Magic, and TinyCore.
Backup/Restore is extremely easy and quick,
so I backup the "change-save-file" daily to a different partition hard-drive.

My only problem thus far,
is that I must allow extra 'write-time' for the USB hard-drives,
even after I think the write is finished.
Calling for a "Un-Mount" is one way to let the system check for any write activity.

Thanks again for discussing this subject.
After 30 years from CP/M through DOS and then M$ Windows
I can really say
that "Puppy Linux is more fun than a barrel of M$ monkeys ! "

The major issue with live cd's is that they are not secure by design. Live cd's are meant to be useful and not secure. Just because you can't write to the cd (usually but not always true) it doesn't mean that your use is secure. It also doesn't prevent a hacker from mounting your local disks. There are a few more secure live cd's out there. Generally live cd's are totally open and running on root user.

One thing that I wanted to add to my earlier post, that I forgot, and why I put a * by Trojan Key Logging is to relate an experience I recently had. The reason I believe that this is pertinent is that it cuts to a lot of the discussion points raised by Sundialsvcs with regards to Windows security. Based upon my recent experience, I find that I have to disagree that Windows has satisfactorily addressed their vulnerability issues and that the problems can be attributed to user negligence. While I am certain that there is a fair degree of this to be found, it doesn't explain my recent troubles.

Using a fully patched, routinely updated copy of XP-SP3, with commercial antivirus, Firefox web browser with ad block (didn't go with no script because of the hassle factor) and running as a non privileged user, while visiting sites that I routinely view (no dirty places), I picked up a key logging Trojan that installed itself into a privileged location, registered as a Firefox plugin that scanned for URLs associated with a known list of banks, would activate upon visiting these sites, record the credentials and email home. Somehow this nasty was able to write itself down into the privileged section of the application data as well as some other hidden location that allowed replication and restoration. Antivirus software would remove the local copy, but it would recure. Combofix ultimately killed the nasty, but several key Windows components, such as the updater and remote desktop had been destroyed. The ultimate answer required a complete wipe and rebuild of the OS.

Again, to emphasize, this all occurred while operating as a low privilege user, but somehow the malware was able to elevate privilege through an exploit on an up to date system. You don't normally hear of this sort of thing happening on Linux.

Problems with that approach:
1. Puppy 5.2.5 is outdated, the latest versions are 5.2.8 (Lucid) and 5.3.3 (Slacko). The version you run probably has known security holes that can be used to compromise your system. When running a live-system you have constantly to check for the newest version if you are doing it for security reasons.
2. In Puppy you are root by default, which makes possible attacks even easier.
3. The use of a save-file negates all possible security advantages of running a live system, since it can be used to install software, which includes all kinds of malware.

To be fair, the problems with Linux have historically been with usability, and for Windows it has been security. So using an outdated Windows OS from 2001 as an example of Windows poor security is like using a version of Linux from 2001 as an example of Linux's poor usability. Not really fair.

There have been quite a few improvements to Windows since XP.

AppLocker
User Account Control
Mandatory Integrity Control
Kernel Patch Protection
Windows Resource Protection
Service Hardening
Volume Shadow Copy
BitLocker
...

That's for Windows 7. Here's some Windows 8 security improvements. MS has given people some effective tools to resist malware, but it's up to the users to take advantage of them.


BTW With all the 3rd party applications (Java, Qucktime, Adobe Reader, Flash, etc.) that run within modern web browsers now, web browsers are pretty much a secondary OS. So it's entirely possible that both Windows and Firefox were full patched, but some third party browser plugin wasn't, so it may have not been the fault of MS.

Yes, so-called "privilege escalation" attacks do exist, and I am of a mind to say that neither Windows nor Linux nor any other system is demonstrably "more or less vulnerable" to such things. But I am of the opinion that most crimes are crimes of opportunity ... simply because they are by far easiest to do. You walk through the neighborhood with your pizza box in hand, and you don't have to defeat the door-lock or the burglar alarm because, although both exist, both are turned-off. You can have millions of replicas of that sort of thing going on in the time that it would take you to engineer one privilege escalation attack.

I had a commercial (hosting center) Linux box get thoroughly "root-kitted," and the root (ahem...) cause of the problem was simply that I was too-lazy and too-hurried to reformat the drive to one of the "minimal Linux" configurations that the company did offer. I just used the Plesk-based system that was their default. I should have known better, and in fact did know better than to let anything-of-value get within one hundred miles of Plesk, so it's my own damm fault but I just didn't consider that it could really happen to me. There was nothing to be done but to move the data out of the way and then rebuild the system like I should have done it in the first place. So ... security is, indeed "a process."

And that's the key point that all of us just have to keep hammering home: no system is "magically protected" just by virtue of what it is.

Most of us, I daresay, routinely work in "mixed" environments in which Windows, Linux, and gawd-knows what else must all work seamlessly together. Since "the chain is only as strong as its weakest link," that means that we have to approach system security with a very broad brush and a very clear head.

i would add to my previous comment, that on single user systems, the difference between the entire system being compromised vs just the home directory is relatively negligible, the difference being malware in a home directory can be more easily cleaned out (yes you can still be used as a spam factory to some degree if your home directory is compromised, but not as easily, and more easy to detect and undo the damage)
the difference however comes on multi-user systems where re-building one profile is much easier than re-building a system, THEN re-building SEVERAL profiles.

Guys,
As SunDial wrote:
" no system is "magically protected" just by virtue of what it is. "

I have always been interested building "Restorability" into my system installs.
Having dealt with relational database systems most of my career, I see it as important.

An OS install that is designed to be "Restorable" is a real plus !
This is just a major part of the "Process of Security"

Very important and well-balanced thread.

As is clear from the responses in this thread the real difference is in using that argument as a reason to succumb to a defeatist attitude or to use it as impulse to keep looking for security improvements...