[ILUG] Porting MyDoom to Linux

[kevin lyda]

On Tue, Feb 03, 2004 at 04:49:23PM +0000, Frank Boehme wrote:
> I was just wondering how difficult it would be to port MyDoom to Linux.
> Sorry for imposing my thoughts..

several people - paulj and chriss higgens have pointed out the
technology of why it's easy.  i'll point out the social reasons why it
is not.  the social reason is that there is no standard "linux" and
there is no standard mua on linux.  and most distros are setting up a
linux world w/o a standard mta too.

there are attempts to make standard interfaces.  but the implementations
themselves might be different.

what linux kernel are you running, and what security holes does it have?
what mua are you running and what security holes does it have?  what
libs/tools does your mua use (if any) to process attachments and what
security holes do they have?

the problem for virus/worm viruses is that it is quite
likely that there will be a unique answer for each of us -
linux-2.4.18:mutt-1.2.5.1-1:gnupg-1.0.6-5:netpbm-9.24-3:lots more.  and in
the case of folks using certain mail clients (mutt, mh, others?) the
configs will wildly affect what tools are used to parse mime.

as linux becomes more common on the desktop, there will be more
similarities.  but then companies like redhat and lindows and others are
doing things to get security fixes sent out to users in an automated way.
yes, ms is beginning to do this, but they're working hard to stamp
out piracy at the same time which works against getting all users to
get updates.

so yes, technically linux shares some of the same potential faults.
however i can think of only two times unix/linux had a worm spread
rampently from system to system - the morris worm in 1988 on bsd/vax
systems and a few years back on linux/apache/x86 systems (code red
i think?).  neither of those exploited any mua.

kevin

-- 
kevin at ie.suberic.net ....... financial math: if bill gates & 10,000 homeless
http://ie.suberic.net/~kevin/cgi-bin/blog .. guys are in a room, the average
net worth of each of them is over $1,000,000.  now, why do you care what the
average bush tax "cut" was again? ........... http://www.deanforamerica.com/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 232 bytes
Desc: not available
Url : http://mail.linux.ie/pipermail/ilug/attachments/20040203/3002b4f3/attachment.pgp