CryptoWall RansomWare: The Psychology of Mass Insanity

(Image Credit: Geek.com)

Albert Einstein once defined insanity as this, "Doing the same thing over and over again expecting different results."

Are you using Windows Legacy (x86) 8.1 and older?

If you answered yes, then, I am afraid you are technically insane. ;)

Oh.  That Anti-Virus software subscription tool you so diligently run?  It is money and time wasted.  The types of attacks now occurring simply fly 'below the radar' of AV scans and morph their signatures on a daily basis so as to not be seen.

If you aren't thinking about switching operating systems, you really need to have your head examined.  It has become child's play for global crime rings to perpetrate the kinds of attacks such as the one depicted at the top of this story (aka RansomWare) and they get away with it by a process known as 'Drive-By' Javascript DLL injection into Windows Legacy operating systems going all the way back from 8.1 to Windows 2000.  Why?  Because they all share the same legacy WinNT kernel design and because Enterprise has been thoroughly invested in Windows, they cannot change the code or it would break Enterprise systems.

This is their dilemma -- their personal nightmare.  And just as with the slow death of XP, Legacy won't go away any time soon -- it is entrenched and businesses are 'married' to it for better or for worse.

You, the consumer, have a choice.  Distance yourself from a known problem.  Research 'Stuxnet' and then ask yourself how that could possibly happen (cough backdoors).

As long as you insist on using Windows Legacy, you are assuming the role of a 'victim'.  Don't be a victim.  Own your privacy.  It's your right.

Reclaim it with Fedora Desktop Edition Linux: the safest operating system on the Planet.

I stake my reputation on it.

Get Free Fedora Desktop Edition here.

-- Dietrich

Related articles

• The Linux Distro Repository System Safety Assurance
• Sandbox? What Sandbox? -- Fedora Has You Covered
• Microsoft Windows 8.1 Legacy (x86) - UNSAFE FOR GENERAL USE

Read More

Is it Okay to Disable SELinux or AppArmor?

I am flabbergasted at what some so-called, self-anointed 'Linux Experts' offer in the way of sound technical advice.

Take Igor Ljubuncic (aka Dedoimedo) for example.  He seems to be a smart guy and many look to him for reviews of Linux Distributions.  But, I tend to disagree with him about as much as I agree.

His latest story, Linux Mint vs. Ubuntu Security, spurred me to write this post and as it is more than a bit problematic and misguided, I take exception here to disagree with his security recommendation.

As we, in the IT business, should know, security is a process, not a thing.  The effectiveness of one Distro's security implementation may or may not be as good as another's.  And, how each Distro's developers choose to configure security isn't necessarily guided by good decision making.  In fact, I have written, many cookie-cutter clones, or spins if you will, inherit the bad design decisions of their parent Distro, which is one of my pet peeves for why cloning is not necessarily good for Linux at large.

It was causing problems so we disabled it

A response to resolving Linux Security Modules (LSM) issues often heard is the advice given to disable the 'offending' module entirely, when such errors arise.

Igor writes:

Aha, I knew it. There you go. Linux Mint does not ship with AppArmor or any profiles. Well, interesting, not. The thing is, security tools like Apparmor or SELinux are much like HIPS software in Windows. In other words, not necessary. Moreover, they usually cause more harm than good by blocking legitimate software from running. What we like to call the false positive, or fail publicly (FP).

Here, Igor takes it upon himself, despite the considerable design efforts put forth by Canonical Ltd. to provide enhanced LSM sandboxing technology, to marginalize the importance of such technology.  I find that rather irresponsible, given today's situation, what with world-wide rampant security exploitation and surveillance on the Internet growing by leaps and bounds.

No, I am afraid Igor is giving bad advice and has no business telling readers to disable a service provided by software vendors, backed by good justification and years of experience.  

Igor goes on to say:

Indeed, if I look at the history of my involuntary use of Apparmor and SELinux in various distros, I have seen the former kick in only once, and the latter about three dozen times, and each example was a case of a legitimate program being mislabeled. In theory, yes, they might prevent exploits, but you're not running a commercial Web server, so relax.

So, on the one hand, he's admitting that LSMs do indeed prevent exploits, yet on the other he's suggesting (paraphrasing) there was a bug in mislabeling a legitimate application.

So, why, then, did Canonical choose to include LSM AppArmor with Ubuntu and Fedora choose to include LSM SELinux for their several Desktop spins?  

Evidence like Stuxnet, Identity Theft, Ransomware, Malware, Bots, Keyloggers ought to be good clues as to the gravity of the situation.  This clearly isn't sensational.  It is real and happening to the unwary every day.  Igor, strangely, minimizes the seriousness of the situation.

What should be done in the case of a reproducible LSM sandbox error?

If you are experiencing a reproducible error (verses a 'one-time' intermittent error)  using a signed application in your Distro's software repository, do open a software support call ticket on their website so that the vendor can take immediate corrective action.

Don't disable your LSM sandbox.  Go directly to your software vendor for support.  Your issues will be resolved expediently with revisions to your security software. 

-- Dietrich

Related articles

• Configuring and Managing selinux in Red Hat Linux
• Introduction to AppArmor
• An introduction to security models in Linux

Read More