407
top 50 comments
sorted by: hot top controversial new old
[-] Warl0k3@lemmy.world 154 points 8 months ago* (last edited 8 months ago)

As much as I loathe m$, the one thing they got right was forcing casual users (windows home) to install security updates as top priority, whether they like it or not. I know we all hate on windows, and rightly so, but that policy does nullify this particular vector and that is great for the consumer-level users.

(... for the sake of argument lets just pretend windows doesnt have 10,000 other vulns the malware devs can just exploit instead)

[-] halcyoncmdr@lemmy.world 99 points 8 months ago

Also keep in mind that the main reason Windows is targeted for so many exploits is because of the consumer market share. If Linux consumer market share goes up, so will general malware targeting it. We already saw it happen when OSX share increased and Apple had to abandon the whole "Macs don't get viruses" schtick.

[-] Chozo@fedia.io 51 points 8 months ago* (last edited 8 months ago)

We already saw it happen when OSX share increased and Apple had to abandon the whole "Macs don't get viruses" schtick.

It's kinda crazy that Apple got away with spinning "Our products don't sell well enough for this to be a problem" into a marketing point for as long as they did.

[-] Bimbleby@lemmy.world 14 points 8 months ago

I assume they said it was due to other reasons than obscurity, although we know better.

[-] GenderNeutralBro@lemmy.sdf.org 10 points 8 months ago

It was due to other reasons, too.

One of the main malware vectors back then was Internet Explorer (and specifically ActiveX), Outlook Express, and MS Office macros. That's not just a matter of obscurity; it's because Microsoft specifically wrote very shitty software with no regard for security. Netscape was not nearly as exploited as IE even when it was the leading browser.

[-] bamboo 4 points 8 months ago

Apple always does that. After iAds failed, they pivoted into advertising a privacy focused ad campaign to counter Google. Had iAds succeeded, they'd be perfectly fine into getting into that business.

load more comments (1 replies)
[-] rbos@lemmy.ca 12 points 8 months ago* (last edited 8 months ago)

Linux has had a long history of worms and viruses, fortunately (sorta) thanks to its server legacy. Dumb and lazy server admins have given it pretty good 'secure by default' behaviours and cultures.

Desktop users though: whole different set of challenges.

[-] Molecular0079@lemmy.world 42 points 8 months ago

I mean, I don't think I would mind forced updates if they didn't take so damned long and fail half the time. And then, just when you think you've finished installing all updates, you reboot and there's more updates! Why can't they just install it all at once?

Plus, after each major update, Microsoft wastes your time by advertising to you about Edge, Office 365, and OneDrive before they even let you get back into the desktop.

Forced security updates is addressing a symptom but not addressing the root cause, which is that the Windows update process is just painful for a myriad of reasons. In Linux, I run one command, wait 5 minutes, reboot, and I am back to work.

[-] KairuByte@lemmy.dbzer0.com 19 points 8 months ago

I legitimately haven’t had a windows update take more than 5 minutes during the reboot phase for years. Most of the time it’s about 30 seconds.

[-] halcyoncmdr@lemmy.world 7 points 8 months ago* (last edited 8 months ago)

Same here. I don't know what people that have all these issues are doing, but none of my systems or those of my friends and family have these issues.

We also aren't fucking around with the various random guides to "debloat", mess with telemetry, eetc. however, so I can only assume that it's things in those guides and programs that cause issues. For the people with enough technical knowledge to look for the guides but not enough knowledge to know what they do, or care enough to find out.

The longest update I've had took about 15 minutes. My system never restarts in the middle of use to install updates, with the only exception when I was actively hitting the delay button for several days to see if I could force it to. And it finally did, after several days of it asking and me telling it no, and it still gave me a countdown to save my work. It did not randomly restart while in use without warning.

Programs like candy crush, that had install links that were preinstalled (it's not the full game, just a link to install it) I uninstalled like any regular app and they never returned. I use my system like a regular user, not mucking about blindly in the registry, and never run into these weird issues people complain about. I block telemetry I don't want at the network level. The OS never knows and I don't have to blindly trust random guides telling me to mess with things that aren't intended to be messed with. The OS seems to work just fine with telemetry connections working but failing to connect, as would be expected and tested by MS. People messing with those things manually is not something they'd likely spend much, if any, time on testing.

From my experience, many so-called "power user" complaints are caused by the user doing things they don't understand, outside of what would be expected and tested.

[-] MrScottyTay@sh.itjust.works 4 points 8 months ago

It's people who had a single bad experience 15-20 years ago, or heard second hand of such issues. Or if they've experienced it recently then they were probably running a very slow hard drive rather than an ssd.

load more comments (1 replies)
load more comments (11 replies)
[-] Molecular0079@lemmy.world 3 points 8 months ago

I legitimately haven’t had a windows update take more than 5 minutes during the reboot phase for years.

I wasn't just talking about the reboot phase...

Downloading gigabytes worth of updates, waiting for them to install, rebooting, see more updates, reboot again takes WAY more than 5 minutes.

[-] KairuByte@lemmy.dbzer0.com 5 points 8 months ago

But why are you paying attention to a process that a) doesn’t need supervision and b) is done automatically in the background? It’s such a weird thing to complain about.

Not to mention, the vast majority of windows updates are tiny. The only large updates are the yearly major updates. If you’ve got multi gig downloads happening even weekly, you might want to look into what’s wrong with your system.

load more comments (5 replies)
load more comments (1 replies)
[-] LadyAutumn 10 points 8 months ago

I love that on my arch setup, I update every single day, usually more than once, and doing so almost never requires me to powercycle my computer.

[-] Molecular0079@lemmy.world 13 points 8 months ago

There is occasional weirdness if you don't powercycle though. In particular, certain KDE updates will make the desktop misbehave until you reboot. I get where you're coming from though. Quick updates and the ability to decide when you want to restart means that I have no qualms about updating frequently.

I am on Arch too and pacman -Syu is usually a snack I have with my morning tea.

[-] XTL@sopuli.xyz 3 points 8 months ago

If the desktop misbehaves, just restart the desktop (log out and in again)?

load more comments (2 replies)
[-] trolololol@lemmy.world 3 points 8 months ago

Reboot? What for, most updates don't need reboot.

load more comments (1 replies)
[-] jlh@lemmy.jlh.name 24 points 8 months ago

Linux has good security updates too. Fedora installs pending updates on restart, and I believe flatpaks are updated automatically in the background.

The virus discussed in the article doesn't affect Linux PCs, only servers. Windows-style forced reboots wouldn't make sense in a server environment, and it's up to the server administrators to implement good update policies for their nodes and containers.

load more comments (1 replies)
[-] root@precious.net 18 points 8 months ago

The problem with Windows Updates is that they force new 'features' on you along with the patches.

With Linux you get to choose how bleeding edge you want to be, and can generally avoid the monetization crap.

load more comments (1 replies)
load more comments (8 replies)
[-] octopus_ink@lemmy.ml 60 points 8 months ago

Did I miss the bit where they said how it was delivered?

[-] UnityDevice@startrek.website 74 points 8 months ago

Seems it's exploiting vulnerabilities in some software called "Ivanti Connect Secure VPN", so unless you're running that, you're safe I guess. Says in the past they used vulnerabilities in "Qlik Sense" and Adobe "Magento". Never heard of any of those, but I guess maybe some businesses use them?

[-] Macros@feddit.de 37 points 8 months ago* (last edited 8 months ago)

Ivanti Connect Secure VPN

So its spreading via a closed source VPN software. Why should you even use that when there is great VPN software available on Linux which works reliable for decades?

Well of course you miss zero trust connections, multi-cloud readiness, award‑winning security and proven secure corporate access ...

[-] rolling_resistance@lemmy.world 4 points 8 months ago

Because someone built an easy-to-use solution for organisations to charge money for. The same thing with Cisco VPN that every other software company seems to use.

[-] TonyTonyChopper@mander.xyz 36 points 8 months ago

My university has us use Ivanti to connect to our network from offsite...

[-] Faresh@lemmy.ml 22 points 8 months ago

These vpns seem to be quite a good target since at least the one my university uses is run as a setuid executable, so if there is a vulnerability in there, you can execute code as root that wasn't intended to be executed as root.

[-] ComradeKhoumrag@infosec.pub 20 points 8 months ago

Hmmm... Nice, nice, that's nice,

Which university??

[-] LodeMike@lemmy.today 35 points 8 months ago

"Linux isn't more secure than Windows! It has vulnerabilities"

The Linux vulnerability: ^

[-] Zozano@lemy.lol 14 points 8 months ago

I pay for ProtonVPN, and I still run my traffic through OpenVPN.

Hate to victim blame, but unless you're going to audit every line of code yourself, don't use obscure software.

[-] Faresh@lemmy.ml 21 points 8 months ago* (last edited 8 months ago)

As TonyTonyChopper this thread said, sometimes that obscure software is what you are required to use in your institution, or they don't offer support for anything else.

load more comments (2 replies)
[-] LordKitsuna@lemmy.world 5 points 8 months ago

To be fair you should be using wire guard then. Because multiple of the largest and most well-known security auditing firms in the world have said that openvpn is impossible to truly audit. It's too large, you can audit individual parts of it, and you can audit individual interactions between parts. But it's not possible to fully audit.

Meanwhile wireguard is quite small so it can be fairly easily audited by a small team and has been multiple times

load more comments (2 replies)
[-] kingorgg@feddit.uk 9 points 8 months ago

Magento is the e-commerce platform. Adobe acquired it in 2018. Quite a few businesses use it.

load more comments (1 replies)
[-] peak_dunning_krueger@feddit.de 40 points 8 months ago

That's not good, but it's not like we can switch to a more secure alternative. ;)

[-] Rooki@lemmy.world 20 points 8 months ago

If your distro is affected distro hop to a secure distro and hop back if it is patched ;D

[-] BeigeAgenda@lemmy.ca 32 points 8 months ago

Arch! Too much work, then I have to invest in long socks and shave my legs.

[-] Rooki@lemmy.world 52 points 8 months ago
[-] THE_ANTIHERO@lemmy.today 5 points 8 months ago

Where can i get other instance silvers or golds ?

[-] Rooki@lemmy.world 6 points 8 months ago

Just ask your admins to add them, those arent LWs property ;) just let the admins add them as emojis

load more comments (1 replies)
[-] jlh@lemmy.jlh.name 20 points 8 months ago

The vulnerability isn't even with linux anyways, it's just for PHP servers that run on top of linux.

[-] Rooki@lemmy.world 14 points 8 months ago

Ahhh, wow what a clickbait title then.

[-] qaz@lemmy.world 7 points 8 months ago

There is a difference in terms of security between distro's. SELinux profiles, proper policykit policies, etc.

[-] Kbobabob@lemmy.world 4 points 8 months ago

Or, don't use the affected software?

[-] Chocrates@lemmy.world 35 points 8 months ago

Damn, the end of security through obscurity on my Linux box?

load more comments (2 replies)
[-] autotldr@lemmings.world 20 points 8 months ago

This is the best summary I could come up with:


Researchers have unearthed Linux malware that circulated in the wild for at least two years before being identified as a credential stealer that’s installed by the exploitation of recently patched vulnerabilities.

Last Friday, Checkpoint Research revealed that the Linux version has existed since at least the same year, when it was uploaded to the VirusTotal malware identification site.

Checkpoint went on to conclude that Magnet Goblin—the name the security firm uses to track the financially motivated threat actor using the malware—has installed it by exploiting “1-days,” which are recently patched vulnerabilities.

“Magnet Goblin, whose campaigns appear to be financially motivated, has been quick to adopt 1-day vulnerabilities to deliver their custom Linux malware, NerbianRAT and MiniNerbian,” Checkpoint researchers wrote.

In the past, Magnet Goblin has installed the malware by exploiting one-day vulnerabilities in Magento, Qlink Sense, and possibly Apache ActiveMQ.

In the course of its investigation into the Ivanti exploitation, Checkpoint found the Linux version of NerbianRAT on compromised servers that were under the control of Magnet Goblin.


The original article contains 453 words, the summary contains 168 words. Saved 63%. I'm a bot and I'm open source!

[-] sleepmode@lemmy.world 14 points 8 months ago

Arstechnica looking like a malware proliferating site itself on mobile.

[-] FrankTheHealer@lemmy.world 6 points 8 months ago

It's one of those ones where you have to install niche software and then not keep an eye on what your system is actually doing, isn't it?

[-] nyan@lemmy.cafe 4 points 8 months ago

Actually, that's pretty much it. According to the article, it attacks a specific piece of ecommerce software (Magento), and I get the impression the attack isn't viable if the software has all the latest fixes. So it's dangerous only to a subset of servers.

load more comments
view more: next ›
this post was submitted on 12 Mar 2024
407 points (100.0% liked)

Technology

59554 readers
2755 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS