O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 11] Protecting Against Programmed Threats
[1] For a detailed account of one such virus, see "Experiences with Viruses on UNIX
Systems" by Tom Duff in Computing Systems, Usenix, Volume 2, Number 2, Spring 1989.
The increased popularity of World Wide Web browsers and their kin, plus an increased market for
cross-platform compatibility of office productivity tools, lead to an environment where macro viruses
and Trojan horses can thrive and spread. This environment in UNIX includes:
●
●
●
●
PostScript files that are FTP'd or transferred via WWW and automatically interpreted. PostScript
can embed commands to alter the filesystem and execute commands, and an interpreter without a
safety switch can cause widespread damage.
WWW pages containing applets in languages such as Java that are downloaded and executed on
the client host. Some of these languages allow the applets to open network connections to arbitrary
machines, to spawn other processes, and to modify files. Denial of service attacks, and possibly
others, are trivial using these mechanisms.
MIME-encoded mail can contain files designed to overwrite local files, or contain encoded
applications that, when run, perform malicious acts, including resending the same malicious code
back out in mail.
PC-based productivity tools that have been ported to UNIX. Many large companies want to
transition their PC users to UNIX using the same software that they use on PCs. Thus, there is a
market for firms who make PC software to have identical behavior in a UNIX-based version of
their code. The result is software that can exchange macro-based viruses with PCs through sharing
of data and macro source files.
There is also the rather interesting case now of versions of UNIX (and UNIX-like systems, such as
Linux) that run on PC hardware. Some PC-based viruses, and boot-sector viruses in particular, can
actually infect PCs running UNIX, although the infection is unlikely to spread very far. The computer
usually becomes infected when a person leaves an infected floppy disk in the computer's disk drive and
then reboots. The computer attempts to boot the floppy disk, and the virus executes, copying itself onto
the computer's hard disk. The usual effect of these viruses is to make the UNIX PC fail to boot. That is
because the viruses are written for PC execution and not for UNIX.
You can protect yourself against viruses by means of the same techniques you use to protect your system
against back doors and crackers:
1.
2.
3.
4.
5.
6.
Run integrity checks on your system on a regular basis; this practice helps detect viruses as well as
other tampering. (See Chapter 9.)
Don't include nonstandard directories (including .) in your execution search path.
Don't leave common bin directories (/bin, /usr/bin, /usr/ucb, etc.) unprotected.
Set the file permissions of commands to a mode such as 555 or 511 to protect them against
unauthorized alteration.
Don't load binary code onto your machine from untrusted sources.
Make sure your own directories are writable only by you and not by group or world.
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch11_01.htm (7 of 9) [2002-04-12 10:44:46]