I did have used Microsoft Windows since Windows 98 to Windows 7. I have found lots of security vulnerabilities by myself about how viruses, worms, spyware etc. compromises the system.
Microsoft Windows Vista & Windows 7
UAC (User Account Control) system and Drives Autorun
prompts in Windows Vista and Windows 7 can prevent some vulnerabilities.
Linux
I am using Ubuntu 11.10 now, and I realized that the most (except one) vulnerabilities does not exist in Linux because of multi-user system.
The Problem
People (even I) used to store *.exe
, *.cmd
, *.deb
, *.sh
and other executable and script files (Installers, Portable Browsers, scripts, etc.) in pen drives (flash memories) and other removable media.
When in Windows 7 (also in older Versions)
If the target removable media connect to an infected system,
then connect back to a fresh system,
and run a*.exe
,*.cmd
or*.bat
(unsigned executable or script) file
that may prompt a UAC dialog
and user pressYes
this may execute malware code as Administrator, injected to the unsigned executable or script file
I don't know about the signed executable files. Never tested.
I think, they cannot not be infected or infected file cannot be executed.What if, when in Linux?
Will the same may happen in
*.deb
,*.sh
or any other executable or script files in Linux?I mean
Can the
*.deb
& other files be infected? (I think they can)Is there a mechanism in Linux to verify the contents in
*.deb
files?Should I not keep the root access required executable and script files in removable media? If I should not then what is the easiest way to manually verify if the file content was changed or not?
What about the repositories and packages from Internet?
by usinghttp
,ftp
(nothttps
) the repositories and packages can be infected by an attacker while transporting or over proxies (if used).Also is there any thing similar to Windows
Autorun
in Linux? (I think it isn't)
I just want the Linux to be better secured in any condition (even from small mistakes from users).
I will ask about further possible security issues I found.