Re: Anti Virus, now Anti Spy-ware

Steve Lamb wrote:
On Wed, June 18, 2008 10:11 am, Nils Kassube wrote:
While I don't generally disagree with this argument, I think on a
workstation it could be a big problem already if the malware would
"only" access the user area.

But this is hardly an issue compared to having system privileges.

If you look at it from the admin point of view, you are absolutely right.
But Ubuntu is often installed on a single user's machine where the
valuable data are inside the home directory of that user. So the valuable
part isn't protected from an attack.

A malicious program could be accidentally installed
by the user and run at login with the user's privileges.

Which login? As I posted elsewhere I have XFCE, Gnome, KDE3 and
KDE4 all installed. Just taking Ubuntu's make variants, any malicious
software that is limited to user space would have to somehow inject
itself into 4 different "logins" to cover a user since it can't touch
the system boot-up scripts in /etc.

Right - that's the advantage of not haveing a monoculture.

It wouldn't be a great problem to reinstall the OS within a
reasonable time.

This is where you make the mistake of equating Windows threats with
Linux. If one's user space is infected one doesn't need to reinstall
the OS.

Sorry, I think I didn't write it clear enough. I know it isn't necessary
to reinstall the OS if only a user account is compromised. For me it
would be more trouble to restore my user data than to reinstall the OS.
In this regard the better security model of Linux wouldn't necessarily
help me.

One simply need a different user account, elevate to root,
remove the infection. I only say a different user account because one
has to presume the current one is compromised. One of the pitfalls of
Ubuntu's policy of a non-functional root password. No way to get into
root without a non-compromised normal user.

No problem: Boot into recovery mode.

But if a malicious program only modifies my personal files it would
probably take some time until I notice. Then I can only hope that I
still have a backup of the files from before the malicious program
was somehow installed.

That is a user process and one many people fail at. Myself
included. My point isn't that it couldn't happen. It can. It might
yet still happen. My point was that since there is such a strong
division between user and system privileges any such infection is
trivial to remove because simply logging in from a different user
prevents the infection from running and engaging in any self-defense
measures that are now so common with malicious code on Windows. It
also prevents the infection from burrowing itself into the system's
core. To do all of that requires obtaining elevated privileges which
is several magnitudes harder than on Windows.

Agreed, it is easy to clean up an infection if only a user account is
compromised.


Nils

--
ubuntu-users mailing list
ubuntu-users@xxxxxxxxxxxxxxxx
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users

Relevant Pages

  • Re: Anti Virus, now Anti Spy-ware
    ... But this is hardly an issue compared to having system privileges. ... Ubuntu's policy of a non-functional root password. ... user and system privileges any such infection is trivial to remove ... common with malicious code on Windows. ...
    (Ubuntu)
  • Re: Win2K Infected??
    ... You need to reinstall or do a repair on IE. ... >It sounds like some sort of infection or corruption ... >> hyperlink requires a new popup window. ... >> restarting the computer if I run the antivirus, ...
    (microsoft.public.win2000.security)
  • Missing dll files in Temp folder
    ... The user account was infected on 2 April, ... temporary folders, especially exe and dll files modified at the time ... of infection. ... Everything seems to work after acknowledging the alerts so I'm hoping ...
    (microsoft.public.windowsxp.basics)
  • Re: Anti Virus, now Anti Spy-ware
    ... On Wed, June 18, 2008 10:51 am, Steve Lamb wrote: ... One simply need a different user account, elevate to root, ... remove the infection. ... Ubuntu's policy of a non-functional root password. ...
    (Ubuntu)
  • Re: Antivirus 2008/2009
    ... system became infected - Use System Restore and go back to a day or two ... might lose are a couple of MS updates to reinstall - Takes about 15 min total. ... I normally clean the infection first. ... Install OS, update it, install Apps., apply settings and then image the ...
    (microsoft.public.security.virus)