What We Talk About When We Talk About Love Bugs

Phil adds his two cents--and a cautionary note--to the Linux community's conversation about the love bug virus.

While it is fun to pick on Microsoft about the love bug virus, those of us in the Linux community should ask ourselves: are we clean? The answer is: not at all. We are just a combination of not having a high enough visibility and pure luck. The visibility issue has to do with the fact that if you are going to write a virus, then writing it for MS-Windows is the best target. There are just more of those systems out there.

The other part of the story is that the average MS-Windows user doesn't know what a computer is. The average MS-Windows user just knows that he or she can write letters and, most importantly, do e-mail. Their MS-Windows system is configured so that the type of e-mail attachment is identified and the appropriate action is taken. One choice may be to execute a program that is written, say, in Visual Basic.

Now, let's say that Linux has won the desktop war, thus making Linux the best (as in most popular) target for viruses. And, just to make things a little better (or more portable), let's say all those users have their systems configured so that attachments in Java are executed automatically.

Would it take a lot of work to find everything that looked like an e-mail address in the user's mail or Mail subdirectory? How about removing all files in their home directory and subdirectories that ended with .jpg and .gif? I think not.

We are being so smug talking about systems being secure because we have user IDs and file permissions, because sendmail can screen messages and so forth. Well, we can be secure, but at the cost of making it harder for users to do their work. We could--and probably should--make every user manually deal with attachments. We could configure sendmail to screen incoming mail for various patterns. We could do a lot of things.

Fundamentally, what happened with the love bug virus was that MS-Windows systems were configured to offer insecure capabilities to its users. Specifically, the ability to point and click to execute code. If, even using the mime.types file, the average Linux desktop was configured to execute a program (Java, Tcl, binary ...), the Linux system is in the same situation.

If Linux was the #1 desktop, then Linux would become the optimal target for such a virus. Why write something that could only attack 1% of the computers available when, with the same effort, you could make it attack-capable on 90%?

We could brag about running as a user vs. root, but again, that wasn't an issue. This virus looked in the user's address book (something that Pine, Elm and Mutt all have) and deleted files in the user's directory.

We are Linux people. If we succeed in world domination, we will be the target. Clearly, it is time for us to work on some innovation.

______________________

Phil Hughes

White Paper
Linux Management with Red Hat Satellite: Measuring Business Impact and ROI

Linux has become a key foundation for supporting today's rapidly growing IT environments. Linux is being used to deploy business applications and databases, trading on its reputation as a low-cost operating environment. For many IT organizations, Linux is a mainstay for deploying Web servers and has evolved from handling basic file, print, and utility workloads to running mission-critical applications and databases, physically, virtually, and in the cloud. As Linux grows in importance in terms of value to the business, managing Linux environments to high standards of service quality — availability, security, and performance — becomes an essential requirement for business success.

Learn More

Sponsored by Red Hat

White Paper
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState