Net Hazards - Find the right solutions to spyware and adware

Protection for Mac and Linux: genuine need or have?

The current threat

The number of desktops, laptops and Windows servers is a simple and readily available target for malware authors and spammers. Assessing the needs of an organization to protect against virus, spyware, trojans and worms, therefore tend to focus on the Windows environment. Meanwhile, the security risk of non-Windows computer networks sometimes unprotected have been minimized or ignored altogether.

The need to protect the gateway from malicious code – whatever the operating system – is very well accepted. Without But acceptance is not clear Endpoint Protection, as most malware continues to target Windows platforms, with only a small proportion are created specifically for the Mac and Linux.

The fact that most malware is being written for Windows computers on the grounds that encourages investment in the protection of non-Windows computers, the end is not necessary. Why is it important for organizations to protect computers that do not use Windows?

Essentially, there are four reasons:

Although there are no Windows viruses that relatively few, there are real threats.

Linux servers are target for hackers who use them as a way to connect to Windows computers attached.

Non-Windows computers can and do the port and implement Windows Malicious Software tool much more widespread.

Government regulations and industry increasingly require organizations to implement anti-malware software on all computers, whether or not this organization agrees is not a risk.

non-Windows malware

Vulnerabilities in any platform are likely to be exploited. This is more true than virus writers, hackers and spammers are joining forces to steal information and money from companies committed by spyware, phishing attacks and similar. Security provider issued patches to close loopholes in the system are also likely to be released for Mac and UNIX Operating as they are for Windows. Although currently less may be issued in response to an actual operation of vulnerability and as a proactive measure, the need review illustrates the fact that Windows operating systems do not have vulnerabilities. These can be – and were – used.

The fact that most malware is being written for Windows computers on the grounds that encourages investment in the protection of Windows-based computers not to the end point is not necessary

Therefore, the risk of infection in non-Windows platforms should not be dismissed out of hand. The relatively low number of viruses, trojans, worms and spyware in non-Windows does not reflect an inability to generate viruses for these operating systems, and no interest in targeting Windows with its broad user base.

However, as shown by the examples below, is a real interest in certain effects Mac and Linux

OSX / Leap-A's first piece of malware for Mac OS X came in February 2006 and uses the iChat instant messaging system to spread to other users – so similar to a letter e-mail, instant messaging worm on Windows.

Linux / Rst-B This virus was first detected time in February 2002 and is the virus that Linux users are more likely to encounter today, because it replicates updates to the distribution. Hacking tools used infected access to Linux servers. During a recent three-month period, approximately 70% of hacking tools downloaded by hackers to a honeypot has been found Linux/Rst-B.1 infection

OSX / RSPlug-A Trojan that, the first piece of financially motivated malware for Mac, change the configuration DNS server for HTTP traffic control in order to redirect Web traffic to malicious sites. It was first detected in November 2007.

OSX / Hovdy-A was discovered in June 2008, this Trojan can steal passwords, firewalls open for hackers to access and disable the security settings in Mac OS X.

The attraction of Linux servers

servers target of hackers as a way to gain control over a computer network, and is very common Windows networks to include a UNIX or Linux. SSH password vulnerability as a weak, can allow hackers to convert a Linux server on a network driver installation of bots and malware that could compromise Windows PCs. These botnets fun, zombie computers are used to steal information, send emails – in fact, 90% of spam comes from botnets – or launch denial of service.

In addition, a large part of the web servers Apache is hosted on Linux (or any flavor of UNIX). Increasingly, these servers are run by hackers as a means to place malicious code on websites legitimate. As shown in Figure 3, about 60% of infected sites in January and June 2008 Hosted on Apache – a significant increase of 49% in 2007.

The hidden threat to Windows computers

Because most corporate networks – including those classified as "non-Windows" – includes some Windows which makes the protection of all network computers general. Anyone who is on a computer can, by virtue of being connected to another, shall be transmitted to the other.

Basically a virus or any other piece of malware is simply a file, like any other file. Can be obtained from the positions of the organization and servers in a number of different ways. It can be downloaded from CD, DVD, USB drives, e-mail, Internet downloads, instant messaging, and so on. The fact that the file can not infect computers a particular operating system is irrelevant – you can save anywhere. Often, the user of the computer in which it stores the file is not aware that there is a virus, it is only when it is with Windows virus that becomes active.

Even if the design of UNIX and Mac makes them less vulnerable to viruses that early versions of Windows, there is always a major threat to network security because the teams hosting the malware can be quietly move to a Windows computer. For example, UNIX computers can easily transmit the virus to the Windows computer via Samba system for file sharing. In addition, only a network-aware worm to be sent by e-mail from a non-Windows to Windows, for the entire network of Windows to be infected.

The convenience of users of Mac and UNIX can be a danger in this case – as it was for "Typhoid Mary", a Cook New York City in early 1900 named Mary Mallon, who was a healthy carrier of typhoid fever, and refused to believe he was a danger by their employers, although many of them infected with the disease.

Increasing regulatory pressure

Indifferent regulatory organizations in the support platform to address the issue of point of view is completely different and have introduced a number of laws. Acts as the U.S. Sarbanes-Oxley Act (SOX) and HIPAA (Health Insurance Portability and Accountability Act), and the United Kingdom Data Protection Act, are designed to protect the directors and the rights of privacy of individuals – and any additional requirements on hand to maintain and protect the integrity of the data within their networks.

SOX establishes a legal obligation for listed companies to protect all machinery associated with financial records. HIPAA does the same with health data. Many managers assume that all acts of the file servers within a network to manage the financial or health information – regardless of platform –

by therefore require virus protection. Acts stipulates the need to:

information security, nothing should change the original data and there must be a clear warning if any attempt to modify or destroy data.

The test needs to be proved that the efforts compliance are working. Event logs, audit trails and reports are essential to achieving these objectives.

In addition, organizations recognized in the industry such as the Payment Card Industry, impose obligations on all computers containing personal data are adequately protected.

The last updated version of the PCI Data Security Standard, version 1.2, has extended the obligation to protect the platform by removing the exclusion of systems of UNIX-based operating systems or mainframes. Mac OS X is a system based on UNIX and Linux is a Unix-like system for these operating systems must also be protected by antivirus software.

In addition, this new version of Data Security Standard has also broadened its definition malware, and now includes a requirement to protect against rootkits – software that allows a person, whether lawfully or malice, take control of a Windows or UNIX machine undetected.

The threat of future

The threats that target the Windows operating environment will remain dominant because it is always easier to infect a large number of computers Windows, since it will remain a very Many Windows computers on the market.

However, while Microsoft will continue to dominate the final point in the coming years, there is reason to believe that non-Windows platforms is more attractive to virus writers, which attacks more than in the past. Improved Security in Windows systems and the changing nature of the threat, with financial gain rather than teenage bravado motivational force, is probably less common operating systems each more common.

It is also clear that in both Mac and UNIX / Linux are growing in popularity. Linux servers represented 12.7% of server market (1.6 million) in Q1 20,072. Mac – and much of the media and the education market – saw sales reach an all time record of 20,083 Q3, where nearly 2.5 million PCs were shipped, in part because of its increasing prevalence in the business.

It is likely that malware writers want to take advantage of this growth Mac and Linux users. In fact, a Sophos web survey conducted early in 2008, 93% of respondents (against 79% in 2006) reported that Macs thought is

future.4 more focused on the same survey, the percentage who think that Macs do not fall within the scope in terms of Windows-based computers has also decreased 59% in 2006 to 50%, as shown in Figure 4 on previous page.

There is also the future development threats on the Web to keep in mind. Malware is writing for specific operating systems to the Internet is used only as an enforcement mechanism. However, in the future, malware payloads can be delivered entirely in the browser environment, independent of any operating system. In this scenario, Mac, Linux and Windows are all equally at risk of malware infection.

Raising the security challenge

Users are always potentially the weakest link in security chain, OSX / Leap-A, for example, transmitted via instant messaging. Whatever the operating system – Mac, Linux, UNIX, NetWare, OpenVMS, Windows – what they have in common is that their users are also susceptible to social engineering than the other and can be tricked into downloading malware onto their computers. Facing the challenge of security is a solution two aspects that combines education classes throughout the organization on best practices and powerful reliable protection.

By including equipment running non-Windows operating systems as part of the overall security of the network, services will ensure that the very real risk of these computers to infect computers Windows is concerned. They should also ensure that the risk of non-Windows computers are infected is eliminated.

At the same time, a robust management anti-virus on all desktops endpoint, laptops and servers to ensure that organizations comply with the requirements of increasingly stringent laws to protect alert data and data modification. With the event logs and reports to meet the requirement of proof control and eliminate the risk of the consequences of not meeting compliance protocols.

Summary

Leaving Windows computers is not without protection against malicious software introduces another area of vulnerability in a landscape already rich with threats. Although the current risk infection on computers running non-Windows operating systems is low, especially outside the bastions for Mac education and the media is real and increased tendency to attack by white wolf virus writers to financial reasons, spammers and hackers. Equipment protection running Linux, UNIX, Mac and other organizations not only block malware than Windows and meet the growing demand for privacy laws. More importantly, prevent Windows malware that are stored and distributed through its network, significantly reducing risks to business continuity and integrity.

Users are always potentially weak link in the security chain.

About the Author

This article was provided by Sophos and is reproduced here with their full permission. Sophos provides full data protection services including: security software, encryption software, antivirus, and malware.

Program Review #5 – superantispyware