Is Linux Secure?

Is Linux Secure? Mackenzie Morgan Southeast LinuxFest 2010 12 June 2010 Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 1 / 35

Introduction Outline 1 Introduction 2 Vocabulary 3 What can still hurt me? 4 What protection is there? Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 2 / 35

Introduction Me Mackenzie Morgan Computer Science student Ubuntu Developer Kubuntu user http://ubuntulinuxtipstricks.blogspot.com ← ﬁnd slides here Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 3 / 35

Introduction This Talk Linux Zealot: Try Linux! It doesn’t get viruses! Average Person: No viruses? I’m invincible! Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 4 / 35

Vocabulary Outline 1 Introduction 2 Vocabulary 3 What can still hurt me? 4 What protection is there? Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 5 / 35

Vocabulary Malware Malware (or “badware”) is an umbrella term for viruses, trojans, worms, rootkits, etc. Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 6 / 35

Vocabulary Virus Viruses infect individual ﬁles. They spread when people share those ﬁles. Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 7 / 35

Vocabulary Social Engineering Social Engineering is tricking people into doing something that is bad for security. Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 8 / 35

Vocabulary Trojan Trojans are malware that get installed via social engineering. . . or, well, lying. “I’m a fun game and totally safe! but not really, I’m actually going to steal your passwords. . . ” Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 9 / 35

Vocabulary Worm A worm infects other systems, automatically, usually over a network. Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 10 / 35

Vocabulary Botnet A botnet is a group of systems infected by malware which operate as a collective and are controlled by a erm. . . jagoﬀ. Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 11 / 35

Vocabulary Botnet A botnet is a group of systems infected by malware which operate as a collective and are controlled by a erm. . . jagoﬀ. Yes, I’m from Pittsburgh. How’d you guess? Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 11 / 35

Vocabulary Rootkit A rootkit keeps the activities of an unauthorised user hidden so that you can’t tell your system has been owned. Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 12 / 35

Vocabulary Keylogger A keylogger tracks everything you type. Yes, including passwords. It could be hardware (see ThinkGeek), but usually software. There are legitimate(-ish) uses. Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 13 / 35

Vocabulary Browser-based Attack A browser-based attack is any attack that takes place inside the web browser. They are usually not limited to a speciﬁc OS. Examples: Cross-site Scripting (XSS) – using Javascript on one webpage to steal data from another Tracking cookies – harvests the information stored in your browser by other websites Cookie jacking – stealing credentials for other websites from your browser’s cookies Click jacking – hiding clickable objects on a webpage on top of other objects so that you’re not clicking what you think you’re clicking Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 14 / 35

Vocabulary Phishing Phishing is social engineering aimed at making you believe you are interacting with someone else whom you trust Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 15 / 35

What can still hurt me? Outline 1 Introduction 2 Vocabulary 3 What can still hurt me? 4 What protection is there? Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 16 / 35

What can still hurt me? What’s still a problem? All of those Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 17 / 35

What can still hurt me? But what about no viruses? Windows ones usually won’t run, even in Wine Several hundred for Linux Only ∼30 in the wild ever No known viruses exploiting current vulnerabilities Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 18 / 35

What can still hurt me? Email Trojans “Check out this cool new game! http://example.com/foo.desktop” Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 19 / 35

What can still hurt me? Untrusted Software .deb for “screensaver” on gnome-look.org Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 20 / 35

What can still hurt me? Untrusted Software .deb for “screensaver” on gnome-look.org . . . and now you’re on a botnet http://ubuntuforums.org/showthread.php?t=1349678 Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 20 / 35

What can still hurt me? Browser-based attacks Unless only for Internet Explorer Firefox? Opera? Chrome? Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 21 / 35

What can still hurt me? Phishing There’s no patch for gullibility Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 22 / 35

What can still hurt me? Rootkits If any of the previous work, you can get one Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 23 / 35

What protection is there? Outline 1 Introduction 2 Vocabulary 3 What can still hurt me? 4 What protection is there? Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 24 / 35

What protection is there? Trusted software sources Stick to your distro’s repos Otherwise, source directly from upstream Avoid non-software in .deb or .rpm format Heed your package manager’s warnings Grrr @ Arch Linux Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 25 / 35

What protection is there? Launchers You get a .desktop from web/email. . . Do you know what it’ll run? Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 26 / 35

What protection is there? Launchers You get a .desktop from web/email. . . Do you know what it’ll run? Could be anything Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 26 / 35

What protection is there? Launchers in KDE Kubuntu’s & openSUSE’s KDE: Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 27 / 35

What protection is there? Launchers in GNOME Fedora’s & openSUSE’s GNOME: Ubuntu’s GNOME: Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 28 / 35

What protection is there? Browser - Javascript If you use Firefox, get NoScript extension Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 29 / 35

What protection is there? Browser - Encryption Don’t send passwords unencrypted Look for the lock Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 30 / 35

What protection is there? Browser - Phishing How do you know it’s the site it claims to be? Look at everything before the ﬁrst slash Check out this green thing Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 31 / 35

What protection is there? Minimal privileges Don’t login graphically as root! Why? Malware gets full access Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 32 / 35

What protection is there? Don’t need it? Don’t use it! Don’t login remotely with command line or push ﬁles to it? Uninstall your SSH and S/FTP servers Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 33 / 35

What protection is there? Detecting problems Find rootkits: rkhunter chkrootkit Warn of changes: tripwire You probably don’t need these Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 34 / 35

What protection is there? Questions? Mackenzie Morgan (SELF 2010) Is Linux Secure? 12 June 2010 35 / 35