Simple question about Windows .......

Peter Hayes <not_in_use.RemoveThis@btinternet.com> writes:

> In <dcc2vmxysbfa$.dlg@funkenbusch.com> Erik Funkenbusch wrote:
>> On 28 Sep 2006 15:27:25 GMT, Peter Hayes wrote:
>>
>>>> You're inability to follow Eriks explanation is frightening. And
>>>> your last paragrpah made no sense. Maybe you're talking about
>>>> something else?
>>>
>>> I'm talking about Erik's comment, quoted at the top of this post,
>>> that " Hell, a few years back, there were these streams of very
>>> complicated hoaxes going around that asked users to delete various
>>> files from their hard drive, because they were claimed to be
>>> viruses." And I responded that if viruses didn't exist these "delete
>>> virus msvc60.dll" or whatever spoof e-mails wouldn't exist because
>>> nobody would believe them, or even understand them. Now what's
>>> simpler than that?
>>
>> The point was simply that complexity is no deterent.
>
> I know what the point was. I made a slightly flippant observation that
> got blown up out of all proportion.
>
>> Suppose the list
>> of instructions were to instead install a cool screen saver, or view
>> naked pictures of paris hilton, or a great e-card from your grandson,
>> or to show your patriotic support of the troops. Social engineering
>> works because it convinces them to do things they normally wouldn't do.
>
> It works in Windows because there's few if any road blocks in place to
> stop the user following instructions.
>
> It's less likely to work for Linux or OS X because these OSs include
> road blocks like the sudo command. Without the appropriate password sudo
> brings the exploit to a grinding halt no matter how desperate the user
> is to view pictures of paris hilton naked.

sudo generally shares the same password as the user in home
installations. It is no deterrent in that configuration. And when its a
rogue script, the use of sudo totally negates why sudo is used - to
avoid the need to go into an interactive root shell where the user
might inadvertently do things with root privileges.

Also, thankfully, Köhlmann supported me by saying that sudo doesnt exist
in other Linux versions ( no surprise there : distro hell once more) so
the user must go into su mode. Which they will. Because you have to in
order to install stuff.

>
> Hopefully Vista will include similar safeguards, but not if RC1 is
> anything to go by. It pops up boxes at every opportunity asking if I
> really want to do x, y or z, but I've never been asked for a password
> yet. Worrying, that.

--
perfect woman, n.:
Four feet tall, no teeth and a flat head so you can rest
your drink.

[Pistol-grip ears? Ed.]

Richard Rasker <spamtrap.RemoveThis@linetec.nl> writes:

> Op Thu, 28 Sep 2006 17:57:11 -0500, schreef Erik Funkenbusch:
>
>> On 28 Sep 2006 15:27:25 GMT, Peter Hayes wrote:
>>
>>>> You're inability to follow Eriks explanation is frightening. And your
>>>> last paragrpah made no sense. Maybe you're talking about something
>>>> else?
>>>
>>> I'm talking about Erik's comment, quoted at the top of this post, that "
>>> Hell, a few years back, there were these streams of very complicated
>>> hoaxes going around that asked users to delete various files from their
>>> hard drive, because they were claimed to be viruses." And I responded
>>> that if viruses didn't exist these "delete virus msvc60.dll" or whatever
>>> spoof e-mails wouldn't exist because nobody would believe them, or even
>>> understand them. Now what's simpler than that?
>>
>> The point was simply that complexity is no deterrent.
>
> In my experience, it absolutely is. When users call me with networking
> problems, I often have to make them enter CLI commands to quickly figure
> out what's wrong (as I have no remote access an more due to the networking
> trouble).
> And boy oh boy, you should see it. It's more often than not like training
> a dog to jump through hoops, requiring endless patience, several attempts
> at every command, often rephrased in different ways. And with every
> error

Shh. We are assured by the regulars here that CLI is obvious to all but
the most "retarded" users.

But most Linus users will have to use them at some time : a brief glance
at the thousands of "how tos" to get sound, opengl, video, multiple
desktops etc working will show you. All it needs is one hack of a
"howto" script which is run using sudo or its equivalent and *bang*.

Script kiddies like scripts.

> message, they get more uncertain too, ready to give up totally. Most are
> very glad when this "geeky stuff" is over. And those who are competent
> enough to carry out the instructions, wouldn't dream of doing it if I
> wasn't explicitly instructing them over the phone.
>
>> Suppose the list of instructions were to instead install a cool screen
>> saver, or view naked pictures of paris hilton, or a great e-card from
>> your grandson, or to show your patriotic support of the troops. Social
>> engineering works because it convinces them to do things they normally
>> wouldn't do.
>
> I don't say it's impossible that people actually fall for these schemes.
> But complexity still is a very good deterrent - and with Linux, there is a
> rather nice gap between the normal, super-easy GUI stuff which offers
> relatively little opportunity to do harm, and the deeper mechanisms which
> *can* cause trouble. People are used to just click on stuff to see *any*
> kind of pictures, or visit a web site displaying e-cards. They click a
> package manager or desktop setup option to install stuff or select a
> screensaver. In Linux, there simply isn't a culture of sending executables
> by mail, as there is/was with Windows. And why is that? Indeed: because
> executing mailed files is rather bothersome. And because there's no need
> at all.
> Add to that the fact that unasked-for stuff is always regarded with more
> suspicion, and no, I don't see your social engineering viruses taking off
> under Linux. Even on bug-infested Windows, the hoaxes of this style are
> few and far between, and to my knowledge, there hasn't been even one
> succesful self-replicating virus of this kind.
>
> Again: it's not impossible to get people to hose their machines, but it's
> tricky all the same. And also as long as Windows doesn't get any better
> than "one click from hell", the malware you describe simply won't come
> into existence on any significant scale. There are vastly more and easier
> ways to crack Windows machines; it's by far the softest target around. And
> that's why Windows will remain the platform of choice for hackers, script
> kiddies and criminals.
>
> Richard Rasker

--
perfect woman, n.:
Four feet tall, no teeth and a flat head so you can rest
your drink.

[Pistol-grip ears? Ed.]