3 ms·
Nope. The major difference between your common Windows user and Linux user is that Windows users are often logged in as Administrator. So if arbitrary-code-exe
by smtddr 13y ago
Nope.
The major difference between your common Windows user and Linux user is that Windows users are often logged in as Administrator. So if arbitrary-code-execution happens that code owns the whole system - checkmate.
The typical Linux user is not running their Windows Manager or browser as root. The worse that can happen is stuff to your home dir(which can be very bad too). Even this article title calling this a "userland rootkit" is kinda odd, since
"/etc/ld.so.preload"(and the whole /etc dir) is a root-only writable. No matter how secure your OS is, if you're tricked into running an evil program as root/admin... it's game over.
The usage-pattern for this happening on Windows is much, much higher than Linux since Windows users are already admin to start off with. Also, from my observation of Windows users over my 10+ year career, they always click "Ok" on every pop-up dialog box without even reading it. I think that UAC thing from Windows Vista enforced that behavior even more.
- nitrogen 13y agoThe nice thing about sudo is that it asks for a password, thereby mitigating the involuntary click OK reflex that affects Windows.
- yuhong 13y agoI think you can set Windows to do it too.
- pferde 13y ago"Userland" as opposite of "kernelland". I only had a quick skim of the article, but there doesn't seem to be any kernel module loaded by this rootkit. Hence, an userland rootkit, because everything happens outside of kernel.