[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

In search of a Linux Virus Scanner

Hi all,

With the Nimba virus/worm and the Code Red worm breaking Windows around the globe, I am nervously waiting for the next Linux Worm. 

It would be more work to make a Linux virus or worm because the designer would have to take care creating 2 programs as opposed to one.

What is being done to protect against this ?  Are there any Linux virus/ worm scanners for Debian?

Over-Simplified Hypothetical Linux Worm Design 

The first program would have to be a transport or vector. 
The second program would be the virus or worm. 
The vector would open the door to the unpatched machine and then send the buffer overflows for known vunerablities. 
During the Linux World in NYC Feb. 2001, Bruce Perens gave a high level presentation where he presented a little C program that could be used as a vector to open a door to an unpatched machine.

1. Vector (transport)
        C code that emulates a legal connection to a host machine. 
	This C code could try opening all the following connection to a remote host (open ports 21,22,23,25,53,80).
	After connecting, the C code would call the worm.

2. Worm (known exploits)
	While (port open) 
		Send_Exploit_for_Wget       to port 21
		Send_Exploit_for_Sendmail   to port 25
		Send_Exploit_for_Telnet     to port 23
		Send_Exploit_for_SSH        to port 22
		Send_Exploit_for_Bind       to port 53
		Send_Exploit_for_Apache     to port 80

Other Hypothetical Threats Articles:

Existing exploits for Linux machines:

GNU PGP public key

Reply to: