Forgot your password?
typodupeerror
Security Software Linux

Malware Threat To GNOME and KDE 348

Posted by timothy
from the turducken dept.
commandlinegamer writes "foobar posted on his blog recently about 'How to write a Linux virus in 5 easy steps,' detailing potential malware infection risks in the .desktop file format used by GNOME and KDE. This is not a new threat, and it appears to still be a risk, as discussions in 2006 did not seem to come to any firm conclusion on how to deal with the problem." There's a followup on LWN.
This discussion has been archived. No new comments can be posted.

Malware Threat To GNOME and KDE

Comments Filter:
  • Solution (Score:5, Funny)

    by Spazztastic (814296) <spazztastic@@@gmail...com> on Tuesday February 17, 2009 @10:49AM (#26887321)
    Use Linux... wait, shit. We need a new answer, guys.
    • Re:Solution (Score:5, Insightful)

      by zappepcs (820751) on Tuesday February 17, 2009 @10:55AM (#26887437) Journal

      The answer is the same one that has been valid for .. well, since the advent of computers. There will always be vulnerabilities. The best you can do is be aware, vigilant, and choose software that has less vulnerabilities and whose writers work hardest to correct the problems fastest. Arguments can be made for or against Linux based on those criteria but it remains a very strong choice over Windows or Apple. The more popular Linux becomes on the desktop, the more chances there will be vulnerabilities. Now is the time for F/OSS coders to start working extra to ensure there are as few as possible.

      If you write code, you know that you've left open areas where an exception will cause a problem for any number of reasons. it happens. period. So far, GNU/Linux has cleaned up quickly and well on most things. The struggle continues. That is the answer.

      • Re:Solution (Score:4, Informative)

        by Ed Avis (5917) <ed@membled.com> on Tuesday February 17, 2009 @11:24AM (#26888085) Homepage

        The best you can do is be aware, vigilant, and choose software that has less vulnerabilities and whose writers work hardest to correct the problems fastest.

        Which in this case is unlikely to be GNOME or KDE, since this attack has been known for several years and absolutely nothing has been done about it (it's "expected behaviour").

        • Re: (Score:3, Informative)

          by zappepcs (820751)

          I tried to make it a choice by the end user as to which is less vulnerable. MS products have/had similar issues by length and criticality. So if any and all of your choices can and will have such vulnerabilities, use other criteria for your choice.

          On a side note: Worse than having a vulnerability in the code base for several months or years is having it left there intentionally, and marginally worse is when users ignore the patch when it is provided. With Linux patches are free. With Windows products you ne

          • Re:Solution (Score:5, Insightful)

            by bigstrat2003 (1058574) * on Tuesday February 17, 2009 @11:45AM (#26888495)

            With Linux patches are free.

            And they are with Windows as well. Come on, it's more than a bit ridiculous to expect Microsoft to supply patches to people who pirate their software. If you've bought your copy of Windows, patches are free. There may be a bug with validating your copy, but that's also a mistake, not by design.

            • Re:Solution (Score:4, Insightful)

              by zappepcs (820751) on Tuesday February 17, 2009 @12:12PM (#26888973) Journal

              My poorly stated point is that those pirated copies are not being patched appropriately and thus represent a larger target for malicious software authors, making Windows a little bit less desirable from that point of view.

              • Re: (Score:3, Insightful)

                by BluenoseJake (944685)
                Actually, it makes people who are too cheap to pay for Windows, but to lazy or uninformed to use OSS less desirable, not Windows.
            • Re:Solution (Score:4, Insightful)

              by Just Some Guy (3352) <kirk+slashdot@strauser.com> on Tuesday February 17, 2009 @02:55PM (#26892067) Homepage Journal

              Come on, it's more than a bit ridiculous to expect Microsoft to supply patches to people who pirate their software.

              Remember that story about vaccinations the other day? Herd immunity is vitally important, and patching illegitimate installations makes the world safer for legitimate users. This in turn goes a way toward improving Microsoft's security reputation to something greater than Swiss cheese.

          • by pipatron (966506)
            Windows security patches are free for pirated versions of Windows. Don't ask me how I know this...
    • Re:Solution (Score:5, Insightful)

      by Lumpy (12016) on Tuesday February 17, 2009 @11:00AM (#26887549) Homepage

      Have a brain when using the PC.

      It works for all operating systems. Viruses and Trojans require the user to not think and execute things willy-nilly. Having a brain reduces the infection vectors drastically.

      Every "expert" I have met that has been infected was downloading and using warez unsafely. Every regular use I have met that was infected simply clicked yes to every dialog box they did not want to bother reading and understanding.

      The OS does not matter, having educated and competent users does. Have to add that competent, I have seen educated users go and click on crap without reading or thinking.. It requires competence.

      • Re: (Score:3, Insightful)

        by Spazztastic (814296)

        Having a brain reduces the infection vectors drastically.

        I forgot sarcasm tags when starting this thread, but there's also many other problems outside of "not having a brain." Unpatched flaws in your operating system, people still running IE6 and opening a JPEG with a script embedded, etc. One can be very intelligent at something completely unrelated to computers and still get infected purely because of a popup and an unpatched system.

        Not everybody knows to run windows update or to update their Ubuntu installation even if it warns them, because it's usually being

        • Not PEBKAC (Score:5, Interesting)

          by TheLink (130905) on Tuesday February 17, 2009 @02:13PM (#26891253) Journal

          A lot of people claim it's a PEBKAC problem, but I STRONGLY disagree.

          If you expect people to figure out whether a file is safe before "launching/opening" it, then you are expecting people to solve something arguably harder than the "halting problem" (which I hear is very hard, but still easier in comparison since you are given both the description of the program AND the finite input!).

          I propose that:
          1) Compliant programs be allowed to _request_ what they want to be able to do (by either using a finite and manageable set of standard sandbox templates, or in special cases a custom sandbox template - which can be audited and digitally signed by 3rd parties).
          AND THEN
          2a) The user be asked whether the request seems reasonable e.g. Fun Screensaver requests "Standard Screen Saver" privileges vs WARNING!! Fun Screensaver is requesting "Full System" privileges!
          AND THEN
          3) If approved, the operating system then enforces the requested template, so the program can only do whatever possible within the template sandbox.

          Do note there's also:
          2b) The request is silently approved if the OS has been told to remember the user's prior approval of the program and template (and the alt/whatever key was not held down while launching).
          2c) The request is silently approved if the program and requested template is signed by trusted parties (e.g. OS vendor), and the alt/whatever key was not held down while launching.

          I have proposed this concept before to Ubuntu and Suse, see:
          https://bugs.launchpad.net/ubuntu/+bug/156693 [launchpad.net]
          (FWIW I've actually also suggested this to apple).

          It'll be hard to implement, but I suspect it's easier than getting "Joe Sixpack" to reliably solve something harder than the "halting problem".

          Lastly, much windows malware REQUIRE a brain to participate in order to spread. It's often harder to write malware that does not require a brain to spread. Many here think they're so smart, but would they really know what a devious binary or perl script actually does? Have they ever looked at the Underhanded C entries?

      • Re:Solution (Score:5, Insightful)

        by Ed Avis (5917) <ed@membled.com> on Tuesday February 17, 2009 @11:19AM (#26887969) Homepage

        Have a brain when using the PC.

        This has very little to do with user stupidity. Indeed, users should not execute things willy-nilly, but it's surely okay to open a file and look at its contents? If you think that is inherently unsafe then users must be prohibited from receiving email attachments (or downloading from web pages) altogether.

        In this case there are no warning dialogues to click through, no unusual steps. All that happens is you save a file and then double-click to open it. There is no way to see in advance that the file is unsafe, and it can adopt any icon and name it wishes, so in the user interface it is *indistinguishable* from a legitimate desktop icon such as the trash can.

        It gets a laugh on Slashdot to castigate 'stupid' users, but if the system does not provide users with the information needed to make an informed choice, then the system is at fault.

        • You are wrong (Score:5, Insightful)

          by SmallFurryCreature (593017) on Tuesday February 17, 2009 @12:28PM (#26889299) Journal

          I am dealing with a user at the moment who just isn't that bright. It is not that she is a moron, she just doesn't think. Somethings she does right, she gets her wallpapers through googles image search and uses firefox after my suggestion.

          But she also wants animated cursors and finds them and happily installes them. Cursor Mania.

          She just doesn't get, yet, that the internet has two kinds of free and that the more something shouts it is free the less likely it is. How do you explain that firefox is free and safe but cursormania is free and not safe?

          The problem is not so much that some people are stupid but that they lack a healthy dose of cynasism, they forget to question things. And that is pretty to stupid.

          The system can't protect against this unless you want to life in the nanny state. Women are free to go with convicted wife-beaters unless you want the state to decide your partner for you. People can install spyware unless you want the system to decide what you can install.

          For some reason people like you want software to do things you would NEVER accept in hardware. Would you really want a powerdrill that constantly checked wether you where drilling in the factory approved substances, at the right angled, under the right conditions? A screwdriver that refuses to be used as a hammer?

          At some point users must accept a responsibilty to operate their equipment responsible themselves and accept that if they make mistakes, they are the ones to blaim.

          You know what my solution has been to fix 99% of friends requests to fix their windows PC? Re-install. Whipe the crap and sooner or later they either figure out that "mmm once I downloaded those free smiley's my computer starts to act like a piece of crap, maybe these two things are connected" or at least find someone else to help with their crap PC's.

          Lets face it, after 30 years I have started to realise that no amount of suggestion is ever going to result in girls actually giving any of the sexual favors they seem to promise when they ask you to fix their laptop.

          • Re:You are wrong (Score:5, Insightful)

            by Ed Avis (5917) <ed@membled.com> on Tuesday February 17, 2009 @12:47PM (#26889679) Homepage

            What you say is all true but it's not relevant to this particular problem, which is that *all* users, even sensible and cautious ones, can be easily tricked into running an executable because the user interface makes it look exactly like an ordinary file. You or I would also be vulnerable.

            And BTW, I suggest you kiss her first, and fix the laptop afterwards.

          • by javilon (99157) on Tuesday February 17, 2009 @01:04PM (#26889977) Homepage

            Lets face it, after 30 years I have started to realise that no amount of suggestion is ever going to result in girls actually giving any of the sexual favors they seem to promise when they ask you to fix their laptop.

            It seems to me that while they are a bit slow with technology you, on the other hand, are a bit slow at making the (lack of) connection between "fixing laptop" and "getting laid" when social interaction is the issue.

          • by erikina (1112587)

            But she also wants animated cursors and finds them and happily installes them. Cursor Mania.

            She just doesn't get, yet, that the internet has two kinds of free and that the more something shouts it is free the less likely it is. How do you explain that firefox is free and safe but cursormania is free and not safe?

            I had exactly one of these sort of people needing to borrow my (linux) computer the other day. A couple hours later I get back and on the desktop there's a couple extra files on my desktop like wallpapers.exe and the like. I really couldn't help but chuckle. I guess security through obscurity works for stupid users. :P

            The problem is not so much that some people are stupid but that they lack a healthy dose of cynasism, they forget to question things. And that is pretty to stupid.

            Eh. I've had enough of these cynic people. Such as "This software isn't free. I might not be into the whole computer scene, but trust me on this one, there's going to be a catch. The only thi

          • Re:You are wrong (Score:4, Insightful)

            by McDutchie (151611) on Tuesday February 17, 2009 @01:57PM (#26890969) Homepage

            She just doesn't get, yet, that the internet has two kinds of free and that the more something shouts it is free the less likely it is. How do you explain that firefox is free and safe but cursormania is free and not safe?

            I think I would try that by explaining the difference between free as in freedom [gnu.org] and free as in "we will sell your soul to our advertisers" [google.com].

      • by Foofoobar (318279)
        PEBKAC. Brains are optional. Just ask any Exchange user.
    • Finally, year of the openbsd desktop!

    • OpenBSD (Score:4, Funny)

      by jgtg32a (1173373) on Tuesday February 17, 2009 @11:12AM (#26887827)
      Linux noobs you should be using OpenBSD from a shell.
    • Re: (Score:3, Funny)

      by jank1887 (815982)
      TRS-80, here we come!
  • Frost piss (Score:4, Interesting)

    by digitalunity (19107) <digitalunityNO@SPAMyahoo.com> on Tuesday February 17, 2009 @10:54AM (#26887405) Homepage

    Interesting article. Cliff notes for those who don't read articles: KDE & Gnome desktop icons can contain malicious commands.

    The common defense that "well at least linux malware can't get root privileges" isn't much of a defense. For many users, the most sensitive documents they have are owned by themselves.

    • You mean Linux users, besides Linus (we all mirror his important files for him), should be backing up their files!?!

      Oh the horror!

      • by digitalunity (19107) <digitalunityNO@SPAMyahoo.com> on Tuesday February 17, 2009 @11:26AM (#26888137) Homepage

        Don't be so shortsighted. The issue isn't you losing your files. It is that others can obtain your files.

        Just because malware doesn't have root privileges doesn't mean it isn't capable of stealing valuable information from you.

        • by ChienAndalu (1293930) on Tuesday February 17, 2009 @12:39PM (#26889527)

          Just because malware doesn't have root privileges doesn't mean it isn't capable of stealing valuable information from you.

          I sometimes wonder how difficult it would be to obtain the root password from somebody. If the PATH variable has a path that the user has write access to, what's stopping the malware to put a "su" wrapper into that directory? Next time you enter su, the wrapper captures your password, logs you in and deletes itself.

          I also think that a keylogger for X11 wouldn't be too difficult to implement.

          • by Knuckles (8964)

            If the PATH variable has a path that the user has write access to,

            then the machine admin (or distro creator) is a moron.

            • Re: (Score:3, Informative)

              by ChienAndalu (1293930)

              On second thought, you don't even need that. The malware just has to do

              echo "alias su=/tmp/evilwrapperscript" >> ~/.bashrc

              and you're finished

              • Re: (Score:3, Informative)

                by Knuckles (8964)

                True. Though just as the first case can be prevented by mounting /home (or possibly /home/) noexec, this once can be prevented by doing same with /tmp

        • by TheLink (130905)
          How about secrets like passwords?

          The other issue is that your computer can be turned into one of those "zombies", just like the thousands of windows machines out there.

          Desktop Linux is just as vulnerable as Windows. The security model is similar if not less secure - by default any program that > 90% of the Linux users out there run, can do whatever that user's account can do.

          Given the same sort of users, the same sort of marketshare, there'd be tons of trojans, rootkits, zombies everywhere. If not more s
    • Re:Frost piss (Score:5, Insightful)

      by Todd Knarr (15451) on Tuesday February 17, 2009 @11:15AM (#26887891) Homepage

      It does make a big difference in clean-up, though. With the malware not being able to get administrative privileges, it can't get into root's environment. That means that you can log in as root and the malware won't get a chance to take over, and then you can safely use all your scanning and clean-up tools without having the malware disable or circumvent them. Contrast this with how thoroughly rootkits can hide on Windows systems.

      It's still dangerous, make no mistake. Once the malware's running locally, it can try local exploits to escalate to root access. But there's a lot fewer of those on Linux systems than on Windows, and they're a lot harder to exploit, and anything that doesn't successfully exploit them will be much easier to detect and remove. This is a significant win compared to Windows.

      NB: nothing will protect a system from it's owner's stupidity. If the user insists on being willfully stupid, they're in a position to bypass any and all protections on the system. The only protection is to keep them away from the keyboard.

      • by Exitar (809068)

        Why I'm still worried by a malware that, even without root privileges, runs

        cd /
        rm -rf *

      • Re: (Score:3, Insightful)

        by Fallingcow (213461)

        It does make a big difference in clean-up, though. With the malware not being able to get administrative privileges, it can't get into root's environment. That means that you can log in as root and the malware won't get a chance to take over, and then you can safely use all your scanning and clean-up tools without having the malware disable or circumvent them. Contrast this with how thoroughly rootkits can hide on Windows systems.

        Really though, especially if we're talking about my personal desktop or laptop

        • Re: (Score:3, Informative)

          by Todd Knarr (15451)

          I advocate the "Don't run as root." position for two reasons. One, it builds good habits from the start, both for users and for software vendors. It gets users used to running as ordinary users, and conditions them to expect the system to function correctly without administrative privileges except when explicitly doing administrative tasks. We've seen on Windows how many problems keep sticking around simply because of habits users have developed over the years. Inertia works, so put it to good use instead o

        • by dc29A (636871) *

          You have a very narrow view of the advantages of not running root. Let's say you get infected by a well written rootkit/stealthy trojan that quietly sends data from your computer to the crooks. Your keyboard is logged, email is scanned and who knows what else is transmitted. But since it didn't touch your downloads or music is no problem right? Not being root prevents most of dangerous malware from instantly hijacking your PC. It's far from being the silver bullet security solution but it's a must, unless y

      • Re: (Score:3, Interesting)

        by psetzer (714543)

        Escaping notice is the most important part of keeping malware on system. After it's found, the question is more about how painful it is to get off the system than whether it's going to get removed. Since modern malware authors want their software to stick around in the background for as long as possible, they just avoid doing anything outrageous and let the zombie send out a trickle of emails.

        Experience with Windows users shows that the average end user who's willing to click on something like the author wa

  • It still requires a user to save an attachment and execute it. The new thing here is that it saves a file in a format Gnome or KDE recognizes as a script (a launcher file) even without the execution bit set. I am unsure about what it demonstrates.

    The "Look! nude pictures of [latest chick seen on a hollywood blockbuster] ! If it doesn't open, save and execute" routine is pretty cross-platform. It relies on the Stupidity 0.99995b RC12 Gold API, and it is here to stay.
    • Re: (Score:3, Insightful)

      by geantvert (996616)

      The first problem is indeed that a desktop file does not require the executable bit to be executed (from Nautilus) by double-clicking it.

      The second problem is that the file content specifies it icon, name and tooltip regardless of the filename of the desktop file.

      For example, a very efficient way to fool people could be to disguise the desktop file into one of the default icons of the desktop (Trash, Computer, Home, ...)

      For the virus writer the only problem is to get the desktop file to be saved in the Desk

    • by AceJohnny (253840)

      It relies on the Stupidity 0.99995b RC12 Gold API, and it is here to stay.

      I'd say it's not so much stupidity than human psychology, and that most people aren't educated to recognize these dangers. I'll refer you to what security and user interface designers refer to as the
      Dancing Bunnies [msdn.com] problem.

      The main workaround is to have users work in a sandbox. That way, if they blow something up, it's just their sandbox. The sandbox could be their home directory, or a virtual machine. Windows historically didn't sand

    • Re: (Score:3, Interesting)

      by extrasolar (28341)

      The "Look! nude pictures of [latest chick seen on a hollywood blockbuster] ! If it doesn't open, save and execute" routine is pretty cross-platform. It relies on the Stupidity 0.99995b RC12 Gold API, and it is here to stay.

      Which is wrong and has always been wrong by the way. And it's not "open, save, and double click" not "open, save and execute".

      When someone double clicks an icon that signifies it's an image file, that action should not execute an arbitrary command on your system. There needs to be some sort of guarentee that the icon chosen to represent a file actually represents the file. There is no guarentee with .desktop files. This is a bug damn it, not a feature!

      And you have a strange definition of "stupidity" whi

  • Virus? (Score:5, Insightful)

    by Carewolf (581105) on Tuesday February 17, 2009 @10:58AM (#26887509) Homepage

    It relies on the user downloading saving and running a shell-script. The only trick here is that in this KDE/GNOME form the user does not need explicitly to add execution rights on the file.
    Still hardly a virus, more like a gun without a safety switch. It is one step easier for someone to shoot themselves this way.

    Interestingly if we wish to reinforce the 'chmod +x' scheme, desktop files should need a +x (or some other non-MIME property) to be treated specially by GNOME and KDE. Might be an idea.

    • by Ed Avis (5917)

      It depends on the user clicking to 'save attachment'. The attachment is not in fact a shell script but a .desktop file. If it goes to the desktop background (as is often the default when saving files) then it can choose any icon it wishes, disguising itself as a plain text file or a JPEG image or even another copy of the 'Computer' icon that launches the file browser.

      Interestingly if we wish to reinforce the 'chmod +x' scheme, desktop files should need a +x (or some other non-MIME property) to be treated

    • The only trick here is that in this KDE/GNOME form the user does not need explicitly to add execution rights on the file.

      Not quite; this "shell script" (desktop file) also has the ability to arbitrarily override its displayed icon and label. One possible scenario:

      1. User saves what appears to be an image to the desktop.
      2. User fails to notice that this "image" has a .desktop extension. (The real filename may not have been visible to begin with.)
      3. On desktop, "image" has a valid icon and a label ending in ".jpg".
      4. User opens the "image", which is actually a launcher for "sh -c 'rm -rf /*'".

      Requiring the executable bit for .desktop laun

      • by tixxit (1107127)
        Well, at least sh -c 'rm -rf /*' wouldn't kill most installs, as most people don't run as root. Would still be super annoying to reload user files from a back up though.
        • Re: (Score:3, Insightful)

          by TheLink (130905)
          Since we're talking about desktop computers, who in their right mind cares about "installs"?

          I care more about user data.

          I can get "install" data from the DVD/CD and Distro update service.

          But I cannot always retrieve the most recent user data from backups.

          Losing a day's work or even an hour's work can be more pain than having to reinstall the OS.

          Of course it's different if you are one of those users that installs an operating system just for the purpose of playing with themes, etc but not doing any significa
  • Great news (Score:5, Funny)

    by AlHunt (982887) on Tuesday February 17, 2009 @11:06AM (#26887665) Homepage Journal

    So we have a long-known, unaddressed vulnerability and easily accessible instructions on writing a Linux virus.

    Does this mean Linux is finally "ready for the desktop"?

    • by Anonymous Coward on Tuesday February 17, 2009 @11:11AM (#26887807)

      No, it means malware is finally ready for the .desktop

    • Re: (Score:3, Insightful)

      by gzipped_tar (1151931)

      I get your humor, but this may be the only way for Linux to claim the "year of Linux on the desktop".

      I mean bug-to-bug, bullshit-to-bullshit compliance to MS Windows. People are fed crap to grow up and they asks for more crap. At least this is what I think I got from GNOME.

      I use to have a sig. saying "so this is how Linux dies -- with thunderous applause." I changed it after being protested by someone as AC (and partly in fear of being sued by LucasFilm ;) I've always feared that the year of Linux on the de

      • by AlHunt (982887)

        I have a test case running right now. A 60-odd year old gentleman, with close to zero computer experience, was given a 3 or 4 year old PC and wanted to use it. Win2000 was installed and password protected. I wiped the disk, installed Ubuntu and gave the machine back without saying too much about MS, Linux or what-have-you. It'll be interesting to see how he makes out.

        I will say that the Ubuntu install was totally painless - it recognized and correctly configued all the hardware without an internet conne

  • Everyone is trying to mimic the brain-dead M$ Way.

    Just think of the idea. You click on the icon (who knows what the picture would suggest) and the file path is passed to an "interpreter" (be it oowriter, emacs or python or ld.so) you may not know. This is a terrible idea to begin with.

    That's why I use file managers almost only for bulk copying / moving. And I still prefer the CLI if the file names are regular-ish enough.

    • You do that. Yet 99.99% of the computer using humans do not. Should they all adapt to the way you do things? Because it is "better"?
  • Lame (Score:3, Insightful)

    by DesertBlade (741219) on Tuesday February 17, 2009 @11:33AM (#26888277)
    It is the equivalent of downloading a Picture.jpg.bat that deletes *.* from windows. Windows hides the extension (.bat) so it would be easy to double click on it and bam no more files. Yes the icon would look different.

    I have previews turned on in Gnome so I can actually see the picture before I run the code.
    • Lame indeed! This basically exploits the fact that you can easily write and execute code - find me an operating system where you can't do this.

      The whole scheme hinges on the user being an idiot in terms of what they open in their email - seems to me there's little in the way of guarding against such 'vulnerabilities'...build a more idiot-proof system and the world will build a bigger idiot.
  • [Desktop Entry]
    Type=Application
    Name=some_text.odt
    Exec=rm -rf $HOME
    Icon=/usr/share/icons/hicolor/48x48/apps/ooo-writer.png

    Oops... you had backups of all your data, didn't you?

    The article has an example of an entry that downloads code off a server and executes it instead.
  • Fast fix (Score:5, Interesting)

    by Todd Knarr (15451) on Tuesday February 17, 2009 @12:26PM (#26889263) Homepage

    Fast, simple fix for this: make .desktop files scripts. Start them with "#!/usr/bin/false" or something so that if just executed from the command line they don't do anything, just fail. Gnome and KDE expect all entries to start with that and be executable. If they're executable, they act normally. If they aren't executable, the contents or their properties are displayed instead. If they don't start with the hash-bang line, the interface prompts the user for whether they want to display or execute the entry.

    A fancy elaboration could register a binary-format handler (similar to the one Wine registers) that would recognize the "[Desktop Entry]" starting the file as a binary format and, if the file was executable, trigger the interface to act on the entry. That could remove the need for the hash-bang first line, but there's some other potential holes I'd have to analyze for impact.

    • Re:Fast fix (Score:5, Interesting)

      by JesseMcDonald (536341) on Tuesday February 17, 2009 @01:24PM (#26890393) Homepage

      Why not just make a proper interpreter for .desktop files, and use that in the first line ("#!/usr/bin/desktop-launcher")? Then the DEs could always run executable files, and always display non-executable files. As a bonus, you could run launchers from the command-line.

      • by Todd Knarr (15451)

        Because you want them to be do-nothing files when you aren't running in a DE (eg. logging in from a text-mode console or via SSH). Or at least that's MHO.

  • Not a virus? (Score:5, Insightful)

    by pyrr (1170465) on Tuesday February 17, 2009 @12:32PM (#26889383)
    I noticed in the TFA that the author claimed that some folks were claiming this didn't meet the definition of 'virus'. It's funny how the definition seems to have changed. I'd have to say this sort of exploit is technically an old-school virus, the sort that is pretty much dependent on a gullible end user to do something stupid, at which point it could dig-in its tentacles. Most modern Windows viruses, including the fake-anti-malware malware that seems to be going around lately, don't require any user interaction whatsoever to get infected.

    When I think of a "virus", well, that's just malicious code, it's something designed to do some form of damage. It's malware-- software that's up to no good. That doesn't describe the delivery method.

    I can see how folks want to draw a distinction based on the severity of the exploit (namely the extent of the potential damage to the system and the level of user interaction), but claiming this isn't a real virus is just silly. Maybe a new definition for the more severe sorts of malware is needed.

    • Most modern Windows viruses, including the fake-anti-malware malware that seems to be going around lately, don't require any user interaction whatsoever to get infected.

      Then they likely aren't viruses, but other things such as worms.

  • Two ways to fix this off the top of my head.

    1. Create some way to register .desktop files. Only .desktop files registered will be executable.
    2. White list all .desktop files in /usr/share.. and any place else apps store their .desktop files system wide. This way they can be executed without a problem since the user shouldn't have write access to that anyway. For all other .desktop files(such as ones in the users home directory) add another parameter which contains the systems signature. If the signatur
  • If I'd be attacked by a virus, my concern would be my personal files, not the OS files. An OS can be reinstalled, personal files not. In non-root mode, ANY program can access my personal files, email them, upload them, delete them, mutilate them, etc... I think the only thing that can protect against that is to only run executables and scripts that come from a source you know is safe. But if the repositories would be hacked, then even that source isn't safe!
    • by Hatta (162192)

      In non-root mode, ANY program can access my personal files, email them, upload them, delete them, mutilate them, etc...

      Not true. Only programs run as your user can access your personal files, assuming you have sane permissions set.

      But if the repositories would be hacked, then even that source isn't safe!

      That's what package signatures are for.

  • Could the respective desktops be set up to prompt the user before a .desktop entry is opened for the first time, a la OS X's behavior when launching apps?

"Well, social relevance is a schtick, like mysteries, social relevance, science fiction..." -- Art Spiegelman

Working...