3 ms·

I might be wrong, but I don't think there exists and flyby worm/virus/rootkit for Linux where clicking a link will automatically get you infected, without any u

by pavs 13y ago

I might be wrong, but I don't think there exists and flyby worm/virus/rootkit for Linux where clicking a link will automatically get you infected, without any user input.

zurn 13y ago
They're about as easy to make as for Windows. It's just that Windows targeting is more profitable for mass malware, and the technical user base leads to shorter half life.
- ufmace 13y ago
  Any links/info on people making them? I was just looking for some, and didn't find any reports of such things in a few minutes of looking. Seems like the overall field is light, partly because there isn't any large company to pay out rewards for exploits, the huge variety of distros in the installed base, and the weak ecosystem as a result of the previous two. There probably are plenty of holes, but they might be only found by big-money efforts aimed at compromising particular computers, meaning essentially government spying.
- smtddr 13y ago
  Nope. The major difference between your common Windows user and Linux user is that Windows users are often logged in as Administrator. So if arbitrary-code-execution happens that code owns the whole system - checkmate. The typical Linux user is not running their Windows Manager or browser as root. The worse that can happen is stuff to your home dir(which can be very bad too). Even this article title calling this a "userland rootkit" is kinda odd, since "/etc/ld.so.preload"(and the whole /etc dir) is a root-only writable. No matter how secure your OS is, if you're tricked into running an evil program as root/admin... it's game over. The usage-pattern for this happening on Windows is much, much higher than Linux since Windows users are already admin to start off with. Also, from my observation of Windows users over my 10+ year career, they always click "Ok" on every pop-up dialog box without even reading it. I think that UAC thing from Windows Vista enforced that behavior even more.
  - nitrogen 13y ago
    The nice thing about sudo is that it asks for a password, thereby mitigating the involuntary click OK reflex that affects Windows.
    - yuhong 13y ago
      I think you can set Windows to do it too.
  - pferde 13y ago
    "Userland" as opposite of "kernelland". I only had a quick skim of the article, but there doesn't seem to be any kernel module loaded by this rootkit. Hence, an userland rootkit, because everything happens outside of kernel.

by pavs 13y ago

I might be wrong, but I don't think there exists and flyby worm/virus/rootkit for Linux where clicking a link will automatically get you infected, without any user input.

zurn 13y ago

They're about as easy to make as for Windows. It's just that Windows targeting is more profitable for mass malware, and the technical user base leads to shorter half life.

ufmace 13y ago
Any links/info on people making them? I was just looking for some, and didn't find any reports of such things in a few minutes of looking. Seems like the overall field is light, partly because there isn't any large company to pay out rewards for exploits, the huge variety of distros in the installed base, and the weak ecosystem as a result of the previous two. There probably are plenty of holes, but they might be only found by big-money efforts aimed at compromising particular computers, meaning essentially government spying.
smtddr 13y ago
Nope. The major difference between your common Windows user and Linux user is that Windows users are often logged in as Administrator. So if arbitrary-code-execution happens that code owns the whole system - checkmate. The typical Linux user is not running their Windows Manager or browser as root. The worse that can happen is stuff to your home dir(which can be very bad too). Even this article title calling this a "userland rootkit" is kinda odd, since "/etc/ld.so.preload"(and the whole /etc dir) is a root-only writable. No matter how secure your OS is, if you're tricked into running an evil program as root/admin... it's game over. The usage-pattern for this happening on Windows is much, much higher than Linux since Windows users are already admin to start off with. Also, from my observation of Windows users over my 10+ year career, they always click "Ok" on every pop-up dialog box without even reading it. I think that UAC thing from Windows Vista enforced that behavior even more.
- nitrogen 13y ago
  The nice thing about sudo is that it asks for a password, thereby mitigating the involuntary click OK reflex that affects Windows.
  - yuhong 13y ago
    I think you can set Windows to do it too.
- pferde 13y ago
  "Userland" as opposite of "kernelland". I only had a quick skim of the article, but there doesn't seem to be any kernel module loaded by this rootkit. Hence, an userland rootkit, because everything happens outside of kernel.