🚀 go-pugleaf

In article <eronald.726016050@ruble> eronald@fml.tuwien.ac.at (Edmund Ronald) writes:
>  Several people remarked that virues on Unix machines were "impossible"
>because of the access control separating accounts.

Yes, and all these folks are just plain wrong.  Viruses are easy to
write for UNIX.  What's hard is (1) getting them to propagate, (2)
hiding them, and (3) making them do more than trivial things.  In
particular, (2) and (3) tend to be somewhat mutually exclusive.

See Tom Duff's "Viral Attacks on UNIX System Security" in the Winter
'89 USENIX Proceedings, and Doug McIlroy's "Virology 101" in the Spring
1989 issue of Computing Systems.  (Or buy a copy of my UNIX security
book, which has summaries of them both.  :-)

>No one bothered to 
>remember that the past ten years have proven Unix system security to be an
>oxymoron, a topic that keeps graduate students entertained nights.

While this is a semi-true statement, it does not answer the claims
about viruses being "impossible" on UNIX.  Although there have been
numerous security problems discovered in UNIX in the last ten years,
*none* of them have been related to viruses.  (Sorry, Morris' little
excursion was not a virus.)  I would challenge you to cite a single
instance of a successful virus attack on UNIX outside of the
laboratory.

>In fact,
>if I may venture some sarcasm, if administrators and vendors did not make
>such exagerated claims about Unix security, then there would probably be
>fewer attacks :)

If I may venture some sarcasm in return, if people did not make such
irresponsible statements as, "UNIX security is an oxymoron," we might
not have so many newbie sys admins who don't even bother to read the
security section in their vendors' manuals, thinking the situation
hopeless.

UNIX security is *not* an oxymoron, and the careful sysadmin can do
some very simple things to make his system relatively difficult to
penetrate.  There are two good, comprehensive books on UNIX security
out there (Spafford/Garfinkel and Curry); buy one of them, *read* it,
and *do* what it says!

>PS. I personnally use a NeXT computer, a Unix box with a wysiwyg GUI built
>on top of a Display Postscript server that handles screen and keyboard, and
>mouse. Mail on these can contain embedded Postscript, which is executed at
>read-time by the server. Need I say more about how un-security can be buit
>into a system?

Yes, you need say more.  It should also be pointed out that this has
nothing to do with the UNIX-ness of the NeXT.  Put the same Display
PostScript and embedded-PS mail on an MS-DOS or Mac box, and you have
the same problem.  In fact, the problem is probably *worse* than on a
UNIX box, because of UNIX's file access permissions.

Dave Curry