Running ready-made downloaded programs

For discussions about security.
Post Reply
Message
Author
User avatar
8-bit
Posts: 3406
Joined: Wed 04 Apr 2007, 03:37
Location: Oregon

Running ready-made downloaded programs

#1 Post by 8-bit »

I just had a thought and was wondering.
How many of us download a program and then just run it without checking the code.
Let us just say that a program is downloaded, not checked for content, and run.
Now, lets imagine that the new on-line-once contributor has evil intentions.
He includes in the code code to gain access to the computer or intercept commands to be used by his program.

What I am getting at here is the Windows type attitude of a new user of Puppy.
They read of a great program they want to try.
They download it and run it without ever checking it out.
It crashes Puppy or their present OS.
The blame then falls on Puppy.
Is this right?
NO!
But it is not the first post that said "Puppy broke my computer"
So....
Do you check the code of a program before you run it.
Do you even know how?

I am guilty of running programs without checking them out first.
I will admit it.
But it sure makes you think.
With Puppy, you have a chance to check that code.
Windows, fat chance!

User avatar
Flash
Official Dog Handler
Posts: 13071
Joined: Wed 04 May 2005, 16:04
Location: Arizona USA

#2 Post by Flash »

I don't bother checking. I wouldn't know what to look for if I tried. :lol: I don't worry though, because I run Puppy from a multisession DVD in a computer without a hard disk drive. If I try something that borks Puppy, or that I suspect might have compromised it, I simply shut down without saving to the DVD. If I find that I nevertheless managed to save some malware, I can tell multisession Puppy to ignore the contaminated session when it boots.
[url=http://www.murga-linux.com/puppy/viewtopic.php?t=69321][color=blue]Puppy Help 101 - an interactive tutorial for Lupu 5.25[/color][/url]

User avatar
Pizzasgood
Posts: 6183
Joined: Wed 04 May 2005, 20:28
Location: Knoxville, TN, USA

#3 Post by Pizzasgood »

If I find that I nevertheless managed to save some malware
Devil's Advocate: How do you find that you managed to save malware? Because if the person who wrote it was anything like me, it wouldn't do anything obvious like pop up windows going "I own your computer now punk". It would just sit there in the background, disguised as some legitimate process, using very little CPU time and very little network usage. Slowly spying on you from the shadows. And that's assuming the person was just too lazy to actually infect a legitimate program, which would have let the malware not even have a separate process entry. For example, if X or JWM were to be infected, the malware would run pretty much all the time, and you'd see nothing funny at all in the process list. (Of course, the malware could just modify the system so that it isn't reported in the process list in the first place, which would let it run whenever it wants without arousing suspicion, so long as it doesn't do anything intensive.)



One answer is that you could analyze your network traffic periodically at a low level to see what's going on, and hopefully notice if anything is out of whack. Or maybe have a separate box that your computer's network connection has to run through to get to the outside world. That box could then inspect your traffic looking for patterns and then display the patterns and some overall statistics for all traffic in general. Then if you start frequently sending small amounts of data to some weird IP address, you might notice.
[size=75]Between depriving a man of one hour from his life and depriving him of his life there exists only a difference of degree. --Muad'Dib[/size]
[img]http://www.browserloadofcoolness.com/sig.png[/img]

User avatar
Lobster
Official Crustacean
Posts: 15522
Joined: Wed 04 May 2005, 06:06
Location: Paradox Realm
Contact:

#4 Post by Lobster »

Where do we get these wonderful devils advocate programmers?

A low CPU, data collecting (perhaps key logger) trojan, morphing
etc would be great fun. Is the source code available?

Strangely you would not know if such a system
did not exist on your computer

FUD is the real trojan. :roll:
Puppy Raspup 8.2Final 8)
Puppy Links Page http://www.smokey01.com/bruceb/puppy.html :D

User avatar
Pizzasgood
Posts: 6183
Joined: Wed 04 May 2005, 20:28
Location: Knoxville, TN, USA

#5 Post by Pizzasgood »

People who are afraid of FUD should probably stay away from topics like network security, espionage, and healthy eating.

Or perhaps they should become very close to those topics to get over their fear of FUD. That leaves UD, and if they spend time learning, they can eliminate most of the doubt too, leaving them with just Uncertainty, which is omnipresent and eternal. I think.
[size=75]Between depriving a man of one hour from his life and depriving him of his life there exists only a difference of degree. --Muad'Dib[/size]
[img]http://www.browserloadofcoolness.com/sig.png[/img]

User avatar
Lobster
Official Crustacean
Posts: 15522
Joined: Wed 04 May 2005, 06:06
Location: Paradox Realm
Contact:

#6 Post by Lobster »

Tronkel is one of the people who seems to compile most of the programs he uses.

At the moment I believe the biggest security problem is Flash
and its action script language.

Previously it was javascript.
I ain't going to turn either off.

I am going to download and use pets and sfs
Maybe that is the geek version of living dangerously?

Image
Puppy Raspup 8.2Final 8)
Puppy Links Page http://www.smokey01.com/bruceb/puppy.html :D

User avatar
Pizzasgood
Posts: 6183
Joined: Wed 04 May 2005, 20:28
Location: Knoxville, TN, USA

#7 Post by Pizzasgood »

The important thing is to know of the risks. You can still take them, just realize you are taking them. It makes a difference.

For example, take two people who always cross the street without looking. They both attempt to cross a particular street that has occasional traffic. The first person believes there is no traffic, and the second knows there is. Despite that neither looks, the first will be more likely to be struck down. The second guy will be more aware - even though he doesn't use his eyes, his ears can pick up the noise of an oncoming vehicle, and it can happen even if he isn't consciously listening for one. And his subconscious will be prepared for the possibility of needing to dodge a bus, so his reaction time will be better than the first person's.
[size=75]Between depriving a man of one hour from his life and depriving him of his life there exists only a difference of degree. --Muad'Dib[/size]
[img]http://www.browserloadofcoolness.com/sig.png[/img]

kirk
Posts: 1553
Joined: Fri 11 Nov 2005, 19:04
Location: florida

#8 Post by kirk »

How do you find that you managed to save malware?
Devil's Devil's Advocate: You could check /initrd/pup_rw and look for the modification of any start-up scripts or programs that seem suspicious. If you haven't installed a lot of stuff it's pretty quick. It's a real nice feature of Puppy.

I agree, it's about risk assessment, if you have little to lose then you tend to take bigger risks. The inverse is true as well.

PaulBx1
Posts: 2312
Joined: Sat 17 Jun 2006, 03:11
Location: Wyoming, USA

#9 Post by PaulBx1 »

Also, any time you install programs, back up the pupsave first. That won't help with detection, but if you do detect a problem, your recovery is simple.

I have a mod to my /etc/rc.d/rc.shutdown file which makes pupsave backups automatic, so this is even easier than it normally would be.

I always thought it would be a good idea to generate and record a checksum of /initrd/pup_rw, and then to compare the current checksum with the one from the previous boot, giving a warning if they are different. But there might be enough written to the pupsave just in the ordinary course of events to make this unworkable. You'd have to exclude mail files and other similar things. I never got concerned enough to look into this.

Post Reply