OSNews

Hypothetically a dumb user would save the file, make it executable, and then run it purposefully. I don't know about anyone else but that sounds like a lot more trouble than it's worth for free porn of Miss Lebanon 2006 (alluding to Kama Sutra worm for those who don't know) when porn sites are much easier to get to.

In Windows the process is much easier, get the e-mail with promise of free porn, click the attachment, choose the open option and you're infected.

Really the lowest common denominator in malware is dumb users, the worst security hole is simplifying things to accomodate them because in the end you're just making it easier for them to get their computers infected.

1. How would a *nix user get the virus?
2. How would it excute?

Probably through some application (especially media program) that has some buffer overflow exploit that allows remote execution of code. Either that, or social engineering.

That second one is the one to be most concerned about. In order for Linux to work for the masses, it has to be easy to install and run applications. And once that is possible (it probably is already) and you put Joe Sixpack on it, all I gotta do is send him an email promising him nude pics of J-Lo and all he has to do is execute this file. And presto .. you've got an epidemic on your hands.

Of course, Unix/Linux is more secure than Windows. But keeping a Windows box secure isn't that complicated, as I've said before. If I could spend about 30 minutes with each and every Windows user and install Firefox or Opera for them, Windows security issues would be pretty much non-existant.

Clearly you have not got a clue what you are talking about.

You can send Joe Sixpack an email with malware on it. It will not run. It has been said before over and over, there will be no execution rights on attachments.
Social engineering would work of course, you can get some dopeydick to type rm -f * as root with silly promises, but that is not a fault of the system.....

There is a fundemental difference between Windows and Linux.
Around 1994 Bill Gates & Co. decided that making everything automatic was good for the user. this is the root cause of all the problems with Windows.
You can spend all the time in the world with Windows users, and convert them to Opera and Firefox all you want, however, the problem is just not with the browser.
Windows has problems with email, messengers, browsers and media players, all having access to the system areas and all being able to interoperate with each other.

People do live with their head in the sand. Windows can never be secure if Microsoft are trying to make it as easy to use as possible. Linux and Unix are ultimately more secure because they have been designed with security in mind from the ground up.

1. www.reallycoolsoftware.com/shinythings.rpm
2. double click the rpm

AdamW,

"1. www.reallycoolsoftware.com/shinythings.rpm
2. double click the rpm"

You seemed to have missed some other security points related to package management in Linux distributions. After doing what you said the Linux distribution would first request a Root (Administrator) password prior to opening the package manager such as YAST. YAST would then verify the digital signature is valid for the package, check for any dependencies/conflicts and install the software. Unlike Windows where the user double mouse clicks on the "packagename.exe" and it installs to the system. By defualt installation set-up Microsoft makes all users for Windows have Administrator (Root) access and leaves it up to the end user to create Limited User accounts. This is unlike Linux distributions where users are set up in the beginning to have Limited User rights.

It is typically a Windows system Administrator headache to get applications to run properly on Limited User accounts with out opening to much security. Hopefully when Windows Vista is released Microsoft will hold true to their promise to make the system more secure unlike how it is today. Such as everyone runs as Limited Users by default, except the Administrator account which is not visible and only accessible with the Administrator password.

you still need to be root or have root access as your user.

You've obviously got no idea of how an rpm is installed. A user would have to have administrator level priviledges to install anything. Also, it's a pretty strange *nix system that would actually work by simply clicking on the file... Every setup I have ever seen required the user to follow through with some type of package manager (YAST, ap4rpm, SOMETHING) and that exponentially reduces the chances of this happening. Besides, again we are talking about user abuse of the system, something NO OS, EVEN LINUX, BSD and the rest of the *nix, can ever do and still be a useful tool or toy for the user.

How about this one:

1. A really cool desktop looky thingy that looks and behaves just like Windows XP!!! Oh, boy!
2. Double click the shell script.
3. Oops!

Actaully, it's fairly simple.

1) Use any java version released before 11/29/05 and visit page hosting malicous applet.
2) The java vulnerabilities allow the applet to bypass the java sandbox and execute anything it likes in the context of the java process (usually user).

There are numerous examples of windows java malware utilizing runtime.exec() which could work just as easily on *NIX.