Active Topics
-
Camera phone competition March 2023 "Endless" (35)
to General by Maemish - 1 day, 13 hrs ago -
TLS 1.2 for N9 is ready (28)
to MeeGo / Harmattan by smartblu9 - 1 day, 14 hrs ago -
Maemo repository (3)
to Community by torsen - 2 days, 6 hrs ago -
Error after installing Leste on sdcard (11)
to Maemo 7 / Leste by Maemish - 3 days, 4 hrs ago -
Introducing ubiboot N9 (multiboot OS loader) (1,393)
to Alternatives by smatkovi - 4 days, 10 hrs ago - more...
|
2008-04-14
, 10:45
|
|
Posts: 3,841 |
Thanked: 1,079 times |
Joined on Nov 2006
|
#12
|
A keylogger trojan would just push the data out through the email program. Can't block that in any easy way.
I know Windows firewalls (at least the good ones) can specify not only port, but also application, and say "the browser can go out to port 80, any other app can't". And so on. This isn't easy to do on Linux or Unix. It wouldn't be that useful either, even if iptables could do it, because on Windows it's much more common that every application do their input/output directly, while on *nix you can often just communicate through the daemon or service that usually handles that kind of traffic (e.g. for sending email you almost never try to send data directly on port 25, instead you use the sendmail (or equivalent) program)).
Out of the box there's almost nothing listening to any TCP/IP or UDP port on the NIT, so someone breaking their way into your NIT isn't much of an issue. However, if you install something that happens to be a trojan there's very little you can do to avoid it doing whatever harm it wants. This is such a serious situation that the only thing that helps is "don't do that". On any platform.
I know Windows firewalls (at least the good ones) can specify not only port, but also application, and say "the browser can go out to port 80, any other app can't". And so on. This isn't easy to do on Linux or Unix. It wouldn't be that useful either, even if iptables could do it, because on Windows it's much more common that every application do their input/output directly, while on *nix you can often just communicate through the daemon or service that usually handles that kind of traffic (e.g. for sending email you almost never try to send data directly on port 25, instead you use the sendmail (or equivalent) program)).
Out of the box there's almost nothing listening to any TCP/IP or UDP port on the NIT, so someone breaking their way into your NIT isn't much of an issue. However, if you install something that happens to be a trojan there's very little you can do to avoid it doing whatever harm it wants. This is such a serious situation that the only thing that helps is "don't do that". On any platform.
__________________
N800/OS2007|N900/Maemo5
-- Metalayer-crawler delenda est.
-- Current state: Fed up with everything MeeGo.
N800/OS2007|N900/Maemo5
-- Metalayer-crawler delenda est.
-- Current state: Fed up with everything MeeGo.
|
|
2008-04-14
, 12:18
|
|
Posts: 244 |
Thanked: 10 times |
Joined on Jan 2007
|
#13
|
Lets also look at it this way.
Coding is complex. The internet tablet is a custom kernel on an armel processor. A very very very very small nitch of the linux users out there. Some one would have to write, or compile the app to run, you would have to install it... its actually a much rarer thing than most people imagine.
Coding is complex. The internet tablet is a custom kernel on an armel processor. A very very very very small nitch of the linux users out there. Some one would have to write, or compile the app to run, you would have to install it... its actually a much rarer thing than most people imagine.
 |
|
2008-04-14
, 12:59
|
|
Posts: 868 |
Thanked: 474 times |
Joined on Oct 2007
@ Capital District, NY, USA
|
#14
|
Originally Posted by schmots
I would say it's a lot easier than people say. All I need to do is make a new build of pidgin or firefox and post them here. I would have several hundred installs within a few days.
Lets also look at it this way.
Coding is complex. The internet tablet is a custom kernel on an armel processor. A very very very very small nitch of the linux users out there. Some one would have to write, or compile the app to run, you would have to install it... its actually a much rarer thing than most people imagine.
That said it's all about risk. I have a pre-school daughter. Do I fret about "sexual predators"? Not really, day to day I'm more worried about her falling down the stairs or running into the street. In the case of the NIT's there are much bigger fish to fry before I'm going to become worried about malware.
Oh and iptables can block by process, uid, gid, and other criteria. If it's blocking is not good enough it can shunt the connections through a userspace daemon to do more complex actions.
|
|
2008-04-14
, 14:35
|
|
Posts: 3,841 |
Thanked: 1,079 times |
Joined on Nov 2006
|
#15
|
iptables can do that, yes, but if you send your emails through sendmail/exim/whatever, as is easiest anyway, it won't help..
__________________
N800/OS2007|N900/Maemo5
-- Metalayer-crawler delenda est.
-- Current state: Fed up with everything MeeGo.
N800/OS2007|N900/Maemo5
-- Metalayer-crawler delenda est.
-- Current state: Fed up with everything MeeGo.
 |
|
2008-04-14
, 15:40
|
|
Posts: 4,930 |
Thanked: 2,272 times |
Joined on Oct 2007
|
#16
|
Installing packages is done as root; no matter what you set up (other than rejecting packages before installation), a malicious package can disable or circumvent the firewall. Same as on any UNIX system; if you don't trust the software, don't do a system-wide install.
After installing, you can check sudoers, as it's reasonably likely that malware would put itself in there to permit any malicious activities that require root. All depends on the payload, of course. A keylogger can get by quite fine by itself, as long as some usable process (ssh, mail, etc.) is able to access the outside world.
Things you can do to check software you're considering installing:
Check the file-list.
Check the install scripts.
That should make the scope of things it can do clear; but even with no SUID or sudoers entries, you can do a lot.
After installing, you can check sudoers, as it's reasonably likely that malware would put itself in there to permit any malicious activities that require root. All depends on the payload, of course. A keylogger can get by quite fine by itself, as long as some usable process (ssh, mail, etc.) is able to access the outside world.
Things you can do to check software you're considering installing:
Check the file-list.
Check the install scripts.
That should make the scope of things it can do clear; but even with no SUID or sudoers entries, you can do a lot.
|
|
2008-04-14
, 18:20
|
|
Posts: 3,841 |
Thanked: 1,079 times |
Joined on Nov 2006
|
#17
|
Yep, if malicious software gets installed, no firewall or anything else would help. So, this is what must be avoided.
__________________
N800/OS2007|N900/Maemo5
-- Metalayer-crawler delenda est.
-- Current state: Fed up with everything MeeGo.
N800/OS2007|N900/Maemo5
-- Metalayer-crawler delenda est.
-- Current state: Fed up with everything MeeGo.
|
|
2008-04-14
, 18:48
|
|
Posts: 66 |
Thanked: 17 times |
Joined on Apr 2008
|
#18
|
Originally Posted by TA-t3
No, that's just wrong. A decent firewall will stop applications sending data (your passwords, credit card numbers, confidential email) outside your machine without your permission.
Yep, if malicious software gets installed, no firewall or anything else would help.
Wait: TA's post makes MUCH more sense when I look at one of his earlier ones too:
I know Windows firewalls (at least the good ones) can specify not only port, but also application, and say "the browser can go out to port 80, any other app can't". And so on. This isn't easy to do on Linux or Unix. It wouldn't be that useful either, even if iptables could do it, because on Windows it's much more common that every application do their input/output directly, while on *nix you can often just communicate through the daemon or service that usually handles that kind of traffic (e.g. for sending email you almost never try to send data directly on port 25, instead you use the sendmail (or equivalent) program)).
Out of the box there's almost nothing listening to any TCP/IP or UDP port on the NIT, so someone breaking their way into your NIT isn't much of an issue. However, if you install something that happens to be a trojan there's very little you can do to avoid it doing whatever harm it wants. This is such a serious situation that the only thing that helps is "don't do that". On any platform.
Last edited by meanwhile; 2008-04-14 at 19:05.
|
|
2008-04-14
, 19:00
|
|
Posts: 66 |
Thanked: 17 times |
Joined on Apr 2008
|
#19
|
Originally Posted by brontide
If was a Linux programmer in a low wage economy, with the connections to use credit card numbers and paypal, I'd see the Nit's as a god send. Three months programming would get the machine the decent PIM it lacks; 2000 downloads (the most any Nit app seems to get) might get me 1000 compromised individuals. Say I get $1000 from each, of which I keep $500 - I don't have to work again for the rest of my life.
I would say it's a lot easier than people say. All I need to do is make a new build of pidgin or firefox and post them here. I would have several hundred installs within a few days.
I'm tempted to do it myself.
That said it's all about risk. I have a pre-school daughter. Do I fret about "sexual predators"? Not really, day to day I'm more worried about her falling down the stairs or running into the street. In the case of the NIT's there are much bigger fish to fry before I'm going to become worried about malware.
Oh and iptables can block by process, uid, gid, and other criteria. If it's blocking is not good enough it can shunt the connections through a userspace daemon to do more complex actions.
Nokia do seem have to have designed an inherently insecure device, unfitted for most users. If I was them, I'd have firewalled the machine and given it a virtual machine with a sandbox mode, and required special effort and passwords to install apps that bypassed this.
Btw, is there a mode that stops users from being able to install apps?
|
|
2008-04-14
, 19:03
|
|
Posts: 66 |
Thanked: 17 times |
Joined on Apr 2008
|
#20
|
Originally Posted by cvmiller
Wait - there IS a firewall??? All they had to do was add a GUI???
There is the built in linux firewall which is controlled by /sbin/iptables. Very powerful, and very difficult to configure, if you have never used it before. It is an excellent way to block tcp/udp ports.
I hope this helps,
Craig...
Anyway, very useful - or at least very interesting, as I don't know if I'll make that much effort. Might be much simpler to carry out my extra email account plan and limit my use of the N800 to fun stuff.
I hope this helps,
Craig...
N800, Think Outside Kbd, 8GB SDHC Card (OCZ, ext2), and 8GB SD Card (Patriot formatted as VFAT)
Zaurus SL-6000, IR Keyboard, 1GB SD Card