<html><head></head><body><div style="color:#000; background-color:#fff; font-family:lucida console, sans-serif;font-size:13px"><div id="yui_3_16_0_1_1453534473604_5934">[verify email to mailing list]</div><div id="yui_3_16_0_1_1453534473604_5954"><br></div><div dir="ltr" id="yui_3_16_0_1_1453534473604_5955">Continuing on Rick's bank robber analogy: Many banks do pay for the described "security" service. When Bonnie and Clyde show up, the security man looks at his photos and let's them in. Some number of heists will have occurred before Bonnie and Clyde are recognized and the appropriate pictures are FedEx'd.<br></div><div id="yui_3_16_0_1_1453534473604_6098" dir="ltr"><br></div><div id="yui_3_16_0_1_1453534473604_6177" dir="ltr">Paul<br></div><div id="yui_3_16_0_1_1453534473604_6018" class="qtdSeparateBR"><br></div><div style="display: block;" id="yui_3_16_0_1_1453534473604_5961" class="yahoo_quoted"> <div id="yui_3_16_0_1_1453534473604_5960" style="font-family: lucida console, sans-serif; font-size: 13px;"> <div id="yui_3_16_0_1_1453534473604_5959" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div id="yui_3_16_0_1_1453534473604_6015" dir="ltr"> <font id="yui_3_16_0_1_1453534473604_6016" face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Rick Moen <rick@linuxmafia.com><br> <b><span style="font-weight: bold;">To:</span></b> conspire@linuxmafia.com <br> <b><span style="font-weight: bold;">Sent:</span></b> Friday, January 22, 2016 10:46 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> [conspire] (forw) Re: New Trojan Spies on Linux Users by Taking Screenshots and Recording Audio<br> </font> </div> <div id="yui_3_16_0_1_1453534473604_5958" class="y_msg_container"><br>Redirecting to the mailing list, as I assume Pual departed into private<br>mail by accident.<br><br>Yes, I'm fully aware of the widespread construing of 'malware' to mean<br>'software that does bad things'. Part of my point is that that's a<br>dumb concept that conceals a crucial distinction between security<br>compromise (which is of vital interest and the key to everything) and<br>post-compromise misbehaviour (which ain't).<br><br>Let's put this in non-computer terms.<br><br>Dr.Web basically is sending a salesman around to banks, where the<br>salesman says: 'River City Bank got burglarised by John Dillinger last<br>weekend, who walked into the back of the bank, stole a bunch of cash and<br>jewels, egged the branch manager's office, and poured honey all over the <br>HR records. For the small sum of $500/month, you can buy our<br>anti-malcustomer service, where we post our guy inside yoru bank branch.<br>He'll be clutching a snapshot of Dillinger, and, if he sees the guy,<br>will yell out "Hey, it's Dillinger!" and call the cops. He also has<br>snapshots of Al Capone, Bugsy Siegel, and Baby Face Nelson. As our<br>malcustomer research service hears about other malcustomers, we will be<br>FedExing our guy additional snapshots.'<br><br>You should be saying 'Wait, isn't the point not the damage Dillinger is<br>able to do with eggs and honey, but rather whatever mistake allowed him<br>to waltz into the back of River City Bank in the first place? Why<br>shouldn't I just have elementary branch security and not waste time<br>screwing around with your guy and snapshots?'<br><br>Dillinger's egging and pouring of honey was an irrelevant sideshow.<br>Linux.Ekocms.1 taking screenshots and recording microphone audio is an<br>irrelevant sideshow. What matters is how Dilliger (Linux.Ekocms.1) gets<br>into the back office (system).<br><br>You don't need anti-dillingerware. You need basic security. If you<br>don't have basic security, you have much bigger problems than the<br>carefully unspecified alleged threat of trojans allegedly put onto your<br>system via carefully undisclosed means.<br><br>People keep buying this bullshit, and I have really no idea why.<br><br>(Greetings from SCALE14x, DevOps track.)<br><br><br><br>----- Forwarded message from Paul Zander <<a ymailto="mailto:paulz@ieee.org" href="mailto:paulz@ieee.org">paulz@ieee.org</a>> -----<br><br>Date: Fri, 22 Jan 2016 18:17:38 +0000 (UTC)<br>From: Paul Zander <<a ymailto="mailto:paulz@ieee.org" href="mailto:paulz@ieee.org">paulz@ieee.org</a>><br>To: Rick Moen <<a ymailto="mailto:rick@linuxmafia.com" href="mailto:rick@linuxmafia.com">rick@linuxmafia.com</a>><br>Subject: Re: [conspire] New Trojan Spies on Linux Users by Taking<br> Screenshots and Recording Audio<br>Reply-To: Paul Zander <<a ymailto="mailto:paulz@ieee.org" href="mailto:paulz@ieee.org">paulz@ieee.org</a>><br><br>I would prefer the definition from Wikipedia:<br><br> Malware, short for malicious software, is any software used to disrupt computer operations, gather sensitive information, <br> gain access to private computer systems, or display unwanted advertising<br>Trojans and worms do not spread by themselves, but still have have a malicious intent. <br><br>The basic problem I see with _all_ software intended to prevent malware is that it only works on a data base of <br>known threats. When something new is introduced, it can spread for a period of time before protection softwarecan be updated to recognize the new threat.<br><br>It's rather like human viruses. A flu vaccine is only helpful when you are exposed to a flu virus that matches the vaccine. A flu vaccine doesn't help with colds or measles. You still need to wash your hands.<br>Same with computers. Be careful about unfamiliar websites when downloading. Use NoScript to minimize unknown things from running on your machine. Don't open links from suspicious emails.<br><br><br><br>________________________________<br> From: Rick Moen <<a ymailto="mailto:rick@linuxmafia.com" href="mailto:rick@linuxmafia.com">rick@linuxmafia.com</a>><br>To: <a ymailto="mailto:conspire@linuxmafia.com" href="mailto:conspire@linuxmafia.com">conspire@linuxmafia.com</a> <br>Sent: Thursday, January 21, 2016 12:53 AM<br>Subject: Re: [conspire] New Trojan Spies on Linux Users by Taking Screenshots and Recording Audio<br> <br><br><br>Trojans (and worms) are _post-compromise_ codebases. By definition,<br>they don't 'infect' anything. They are not attack code. They are<br>something the attacker (or automated scripts acting for attackers)<br>implement _after_ gaining access to a system through _other_ means.<br><br>In that sense (they don't attack, they don't 'infect'), trojans and<br>worms are not malware -- if by 'malware' you mean something that<br>compromises the security of your system.<br><br><br><br>----- End forwarded message -----<br><br>_______________________________________________<br>conspire mailing list<br><a ymailto="mailto:conspire@linuxmafia.com" href="mailto:conspire@linuxmafia.com">conspire@linuxmafia.com</a><br><a href="http://linuxmafia.com/mailman/listinfo/conspire" target="_blank">http://linuxmafia.com/mailman/listinfo/conspire</a><br><br><br></div> </div> </div> </div></div></body></html>