5 ms·

Serious question -- I don't intend to troll -- I've heard lots of people claim that as soon as OpenOffice et al. get more popular, more malware will target them

Serious question -- I don't intend to troll -- I've heard lots of people claim that as soon as OpenOffice et al. get more popular, more malware will target them. It's not as if Microsoft has a monopoly on bugs. Do you think there's ay truth to this line of thinking?

danielweber 13y ago
From a security situation, the worst situation is everyone running different mail clients, because then if any one of them has a vulnerability someone can send in a crafted mail to take over their box and gain access to your private company docs. "Monoculture" isn't always bad.
- niels_olson 13y ago
  I don't understand this theory that monoculture is safer in a corporate environment. Any interesting organization has more than one secret recipe. Virtually everyone has different access to different systems. If they are all vulnerable to the same bug, the attacker quickly gains control of everything. If they gain control of a single segment, then they can be detected. The odds of the attack being identified once that segment is compromised is much higher, since everyone else has the opportunity to identify the bad behavior.
  - mpyne 13y ago
    I think the theory is that once you have any beachhead onto a system, that existing local priv escalation exploits and network mapping techniques are almost always sufficient to complete the exploitation of your corporate network. So if you have 5 people using 5 different email clients, all 5 of those must be kept secure from spear phishing or email-viewing vulnerabilities to avoid having a hacker get a beachhead on your network. But if those 5 people are using 1 email client, you only have to keep that 1 safe (and you'd have to keep it safe anyways). Monocultures are probably bad for drive-by automated hacking though, so I suppose it's a matter of deciding what threat model you're most at risk from.
    - niels_olson 13y ago
      > you only have to keep that 1 safe This argument may appeal to the self-indulgent system administrator who believes he alone knows perfection. In reality, there is no perfection. One must know there are things one does not know. If China is stock-piling zero days against Outlook, how are you to know? In fact, if there is anything we have learned from biological systems, surely it is that when a monoculture falls, it falls harder and faster than any other variation.
      - danielweber 13y ago
        I know it's appealing, but don't try too hard to apply biological analogies to computers. If you are trying to mitigate against all your computers being taken down at once, diversify. If you are trying to keep intruders out of your network, reduce your surface area.
      - mpyne 13y ago
        Well, let me reiterate: "(and you'd have to keep it safe anyways)". You're right that no one is perfect, but that's no reason to expand the number of directions threats can come from.
- lawnchair_larry 13y ago
  This is the opposite of the commonly held belief in security.[1] As an attacker, I would invest all of my efforts into finding a 0day in one application, knowing it would work on any machine I choose. If everyone uses different software, say for browsers, there are 3 or 4 major options and a fully reliable exploit (which is rare, but for the sake of argument) will still fail on 25% of targets. Now I need four 0days to know that I can compromise my target. If you're running multiple OSes, the same vulnerability requires a different exploit, so the number goes up even more. I also need a high quality rootkit that works on all of them. It's not as though I only have to compromise a single box in an entire network to get what I need. Though I don't need to compromise every single box either, so in practice it's somewhere in the middle. [1] http://en.wikipedia.org/wiki/Monoculture_%28computer_science%29 http://en.wikipedia.org/wiki/Monoculture_%28computer_science...
  - npizzolato 13y ago
    Do you need 4 0days or 4 targets? I would assume the latter would be the easier thing to get. If that's true, the GPs point has some merit. You just need to find one person running some insecure software and choose him as your target. (I will fully admit I know little about how security works in practice, and would be glad to be proven wrong!)
    - rbanffy 13y ago
      > just need to find one person running some insecure software and choose him as your target. The more options they use, the less likely it is the right person will be running the right exploitable client. You need all vulnerabilities aligned to succeed.
    - danielweber 13y ago
      Right, if I want into your network, I just need in. I don't need to compromise every single person. Now if you were discussing resistance to worms, everyone being different helps. It depends on your threat model.
lawnchair_larry 13y ago
I don't think they'll ever get that popular. Malware still isn't targeting Word and Outlook for Mac, despite them being vulnerable, so OpenOffice has a long way to go.

danielweber 13y ago

From a security situation, the worst situation is everyone running different mail clients, because then if any one of them has a vulnerability someone can send in a crafted mail to take over their box and gain access to your private company docs. "Monoculture" isn't always bad.

niels_olson 13y ago
I don't understand this theory that monoculture is safer in a corporate environment. Any interesting organization has more than one secret recipe. Virtually everyone has different access to different systems. If they are all vulnerable to the same bug, the attacker quickly gains control of everything. If they gain control of a single segment, then they can be detected. The odds of the attack being identified once that segment is compromised is much higher, since everyone else has the opportunity to identify the bad behavior.
- mpyne 13y ago
  I think the theory is that once you have any beachhead onto a system, that existing local priv escalation exploits and network mapping techniques are almost always sufficient to complete the exploitation of your corporate network. So if you have 5 people using 5 different email clients, all 5 of those must be kept secure from spear phishing or email-viewing vulnerabilities to avoid having a hacker get a beachhead on your network. But if those 5 people are using 1 email client, you only have to keep that 1 safe (and you'd have to keep it safe anyways). Monocultures are probably bad for drive-by automated hacking though, so I suppose it's a matter of deciding what threat model you're most at risk from.
  - niels_olson 13y ago
    > you only have to keep that 1 safe This argument may appeal to the self-indulgent system administrator who believes he alone knows perfection. In reality, there is no perfection. One must know there are things one does not know. If China is stock-piling zero days against Outlook, how are you to know? In fact, if there is anything we have learned from biological systems, surely it is that when a monoculture falls, it falls harder and faster than any other variation.
    - danielweber 13y ago
      I know it's appealing, but don't try too hard to apply biological analogies to computers. If you are trying to mitigate against all your computers being taken down at once, diversify. If you are trying to keep intruders out of your network, reduce your surface area.
    - mpyne 13y ago
      Well, let me reiterate: "(and you'd have to keep it safe anyways)". You're right that no one is perfect, but that's no reason to expand the number of directions threats can come from.
lawnchair_larry 13y ago
This is the opposite of the commonly held belief in security.[1] As an attacker, I would invest all of my efforts into finding a 0day in one application, knowing it would work on any machine I choose. If everyone uses different software, say for browsers, there are 3 or 4 major options and a fully reliable exploit (which is rare, but for the sake of argument) will still fail on 25% of targets. Now I need four 0days to know that I can compromise my target. If you're running multiple OSes, the same vulnerability requires a different exploit, so the number goes up even more. I also need a high quality rootkit that works on all of them. It's not as though I only have to compromise a single box in an entire network to get what I need. Though I don't need to compromise every single box either, so in practice it's somewhere in the middle. [1] http://en.wikipedia.org/wiki/Monoculture_%28computer_science%29 http://en.wikipedia.org/wiki/Monoculture_%28computer_science...
- npizzolato 13y ago
  Do you need 4 0days or 4 targets? I would assume the latter would be the easier thing to get. If that's true, the GPs point has some merit. You just need to find one person running some insecure software and choose him as your target. (I will fully admit I know little about how security works in practice, and would be glad to be proven wrong!)
  - rbanffy 13y ago
    > just need to find one person running some insecure software and choose him as your target. The more options they use, the less likely it is the right person will be running the right exploitable client. You need all vulnerabilities aligned to succeed.
  - danielweber 13y ago
    Right, if I want into your network, I just need in. I don't need to compromise every single person. Now if you were discussing resistance to worms, everyone being different helps. It depends on your threat model.

lawnchair_larry 13y ago

I don't think they'll ever get that popular. Malware still isn't targeting Word and Outlook for Mac, despite them being vulnerable, so OpenOffice has a long way to go.