In search of a Linux Virus Scanner
Hi all,
With the Nimba virus/worm and the Code Red worm breaking Windows around the globe, I am nervously waiting for the next Linux Worm.
It would be more work to make a Linux virus or worm because the designer would have to take care creating 2 programs as opposed to one.
What is being done to protect against this ? Are there any Linux virus/ worm scanners for Debian?
---------------------------------------------
Over-Simplified Hypothetical Linux Worm Design
---------------------------------------------
The first program would have to be a transport or vector.
The second program would be the virus or worm.
The vector would open the door to the unpatched machine and then send the buffer overflows for known vunerablities.
During the Linux World in NYC Feb. 2001, Bruce Perens gave a high level presentation where he presented a little C program that could be used as a vector to open a door to an unpatched machine.
1. Vector (transport)
C code that emulates a legal connection to a host machine.
This C code could try opening all the following connection to a remote host (open ports 21,22,23,25,53,80).
After connecting, the C code would call the worm.
2. Worm (known exploits)
While (port open)
Send_Exploit_for_Wget to port 21
Send_Exploit_for_Sendmail to port 25
Send_Exploit_for_Telnet to port 23
Send_Exploit_for_SSH to port 22
Send_Exploit_for_Bind to port 53
Send_Exploit_for_Apache to port 80
Other Hypothetical Threats Articles:
http://lwn.net/1998/1119/Trojan.html
Existing exploits for Linux machines:
http://www.google.com/search?q=cache:a7Rlxpy-qPg:www.insecure.org/sploits/INND.1.6.overflow.html+exploit+%22%23include%3Cstdio.h%3E%22&hl=en
http://www.google.com/search?q=cache:dI3dvxVTUoo:www.insecure.org/sploits/routed.tracefile.html+exploit+%22%23includ
http://www.google.com/search?q=cache:P2i_y4xKLY0:oliver.efri.hr/~crv/security/bugs/Linux/krnl220.html+exploit+%22%23include%3Cstdio.h%3E%22+linux&hl=en
http://www.google.com/search?q=cache:slTym0c2sGo:www.nmrc.org/files/unix/cxterm.exploit+exploit+%22%23include%3Cstdio.h%3E%
http://www.google.com/search?q=cache:8YybojTeyf4:security-archive.merton.ox.ac.uk/bugtraq-199909/0104.html+exploit+%22%23include%3Cstdio.h%3E%22+linux&hl=en
----------------------
GNU PGP public key
http://www.annapolislinux.org/docs/public_key/GnuPG.txt
---------------------
Reply to: