linux security myth

Linux Security Myth

Mackenzie Morgan

Ohio LinuxFest 2010

11 September 2010

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 1 / 35

Introduction

Outline

1 Introduction

2 Vocabulary

3 What can still hurt me?

4 What protection is there?

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 2 / 35

Introduction

Me

Mackenzie Morgan

Computer Science student

Ubuntu Developer

Kubuntu user

http://ubuntulinuxtipstricks.blogspot.com ← find slides here

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 3 / 35

Introduction

This Talk

Linux Zealot: Try Linux! It doesn’t get viruses!

Average Person: No viruses? I’m invincible!

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 4 / 35

Vocabulary

Outline

1 Introduction

2 Vocabulary

3 What can still hurt me?

4 What protection is there?

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 5 / 35

Vocabulary

Malware

Malware (or “badware”) is an umbrella term for viruses, trojans, worms,rootkits, etc.

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 6 / 35

Vocabulary

Virus

Viruses infect individual files. They spread when people share those files.

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 7 / 35

Vocabulary

Social Engineering

Social Engineering is tricking people into doing something that is bad forsecurity.

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 8 / 35

Vocabulary

Trojan

Trojans are malware that get installed via social engineering. . . or, well,lying.“I’m a fun game and totally safe! but not really, I’m actually going to steal your

passwords. . . ”

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 9 / 35

Vocabulary

Worm

A worm infects other systems, automatically, usually over a network.

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 10 / 35

Vocabulary

Botnet

A botnet is a group of systems infected by malware which operate as acollective and are controlled by a erm. . . jagoff.

Yes, I’m from Pittsburgh. How’d you guess?

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 11 / 35

Vocabulary

Botnet

A botnet is a group of systems infected by malware which operate as acollective and are controlled by a erm. . . jagoff.Yes, I’m from Pittsburgh. How’d you guess?

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 11 / 35

Vocabulary

Rootkit

A rootkit keeps the activities of an unauthorised user hidden so that youcan’t tell your system has been owned.

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 12 / 35

Vocabulary

Keylogger

A keylogger tracks everything you type. Yes, including passwords.It could be hardware (see ThinkGeek), but usually software. There arelegitimate(-ish) uses.

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 13 / 35

Vocabulary

Browser-based Attack

A browser-based attack is any attack that takes place inside the webbrowser. They are usually not limited to a specific OS.Examples:

Cross-site Scripting (XSS) – using Javascript on one webpage to stealdata from another

Tracking cookies – harvests the information stored in your browser byother websites

Cookie jacking – stealing credentials for other websites from yourbrowser’s cookies

Click jacking – hiding clickable objects on a webpage on top of otherobjects so that you’re not clicking what you think you’re clicking

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 14 / 35

Vocabulary

Phishing

Phishing is social engineering aimed at making you believe you areinteracting with someone else whom you trust

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 15 / 35

What can still hurt me?

Outline

1 Introduction

2 Vocabulary

3 What can still hurt me?

4 What protection is there?

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 16 / 35

What can still hurt me?

What’s still a problem?

All of those

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 17 / 35

What can still hurt me?

But what about no viruses?

Windows ones usually won’t run, even in Wine

Several hundred for Linux

Only ∼30 in the wild ever

No known viruses exploiting current vulnerabilities

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 18 / 35

What can still hurt me?

Email Trojans

“Check out this cool new game! http://example.com/foo.desktop”

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 19 / 35

What can still hurt me?

Untrusted Software

.deb for “screensaver” on gnome-look.org

. . . and now you’re on a botnethttp://ubuntuforums.org/showthread.php?t=1349678

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 20 / 35

What can still hurt me?

Untrusted Software

.deb for “screensaver” on gnome-look.org

. . . and now you’re on a botnethttp://ubuntuforums.org/showthread.php?t=1349678

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 20 / 35

What can still hurt me?

Browser-based attacks

Unless only for Internet Explorer

Firefox? Opera? Chrome?

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 21 / 35

What can still hurt me?

Phishing

There’s no patch for gullibility

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 22 / 35

What can still hurt me?

Rootkits

If any of the previous work, the attacker might install one

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 23 / 35

What protection is there?

Outline

1 Introduction

2 Vocabulary

3 What can still hurt me?

4 What protection is there?

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 24 / 35

What protection is there?

Trusted software sources

Stick to your distro’s repos

Otherwise, source directly from upstream

Avoid non-software in .deb or .rpm format

Heed warnings about failed signature checks

Arch Linux does not sign packages

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 25 / 35

What protection is there?

Launchers

You get a .desktop from web/email. . .Do you know what it’ll run?

Could be anything

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 26 / 35

What protection is there?

Launchers

You get a .desktop from web/email. . .Do you know what it’ll run?Could be anything

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 26 / 35

What protection is there?

Launchers in KDE

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 27 / 35

What protection is there?

Launchers in GNOME

Fedora’s & openSUSE’s GNOME:

Ubuntu’s GNOME:

Ubuntu has a policy against “ignore this security warning” buttons

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 28 / 35

What protection is there?

Browser - Javascript

Use NoScriptUsers might not be equipped to know what to allow, but it blockscross-site scripting & click-jacking

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 29 / 35

What protection is there?

Browser - Encryption

Don’t send passwords unencrypted!Lock icon:Means connection is encrypted and probably no man-in-the-middle

NOT necessarily a sign that all is good!

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 30 / 35

What protection is there?

Browser - Phishing

But how do you know it’s the site it claims to be?Look at everything before the third slash—that’s the domain

Check out this green thing

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 31 / 35

What protection is there?

Minimal privileges

Don’t login graphically as root!Why?Malware gets full access

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 32 / 35

What protection is there?

Don’t need it? Don’t use it!

Don’t login remotely with command line or push files to it?Uninstall your SSH and S/FTP servers

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 33 / 35

What protection is there?

Detecting problems

Find rootkits:

rkhunter

chkrootkit

Warn of changes:

tripwire

Warn of attacks:

snort

These are advanced tools

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 34 / 35

What protection is there?

Questions?

Slides will be posted:http://ubuntulinuxtipstricks.blogspot.com

Mackenzie Morgan (OLF 2010) Linux Security Myth 11 September 2010 35 / 35