Article - How To Avoid Future WannaCry Style Ransomware Attacks

[TWPonKubuntu]

The author. Greg Laden, goes into some detail in analyzing the differences between the Windows(r) and Linux OS.

I enjoyed his analogies, which make the article easier to read and certainly more enjoyable.

http://scienceblogs.com/gregladen/20...mware-attacks/

The final analogy is worth quoting:

"If a cyber attack is a mugger, Windows is a physically small drunken person with wads of money sticking out of his pockets, staggering down a dark ally near the convention hall during a mugger’s conference, while Linux is a hundred sober and smart well trained Navy Seals each driving a separate armored car in undisclosed locations.

Yes, you can attack the Navy Seals. But if you do that, they’ll make you wanna cry. "

You may want to read through the reader comments which follow, there are a lot of them...

Please remember that I enjoy any opportunity to disparage the Redmond products and this article is worth sending to your Windows(r) users... Sadly, they may be unwilling or unable to wade through a well written article...

[GreyGeek]

From the article:

Linux is an operating system that is already widely used when certain conditions pertain. Since the Android OS is based on Linux, and the majority of servers run Linux, and Linux is becoming the preferred desktop in China, it may well be that Linux is more widely deployed right now than any other operating system, though most Westerners think of it as nearly non-existent on desktops.

[TWPonKubuntu]

GG; If Linux is more widespread outside the "western" world, I call that a good thing.

We have a similar situation in my household, which is a "mixed" home in terms of OS's. I too used to do Windows(r) maintenance on those systems, but finally just gave up, said "you're on your own" and now I just drop the occasional hint that there is a better way...

"But, I can't play all my games on Linux" - The typical reply to my hints. Then we go into a repetition of "playonlinux" and Wine as alternatives...

Taking a wider view, the WannaCry worm may do more to convert "westerners" away from Windows(r) than any amount of harping on my part, at least at the level of individual computer users... We wait and see.

[GreyGeek]

GG; If Linux is more widespread outside the "western" world, I call that a good thing.
.....
Taking a wider view, the WannaCry worm may do more to convert "westerners" away from Windows(r) than any amount of harping on my part, at least at the level of individual computer users... We wait and see.

There is a very summary of how Linux has been and is being adopted around the world at Wikipedia

Despite NetMarketShare's Windows propaganda Linux has made significant inroads into Windows turf. If smartphones are included then Linux took over market share from Windows a month ago.

[TWPonKubuntu]

...
If smartphones are included then Linux took over market share from Windows a month ago.

[GreyGeek]

I just got through reading the PDF manual of the NSA's "Assassin" malware. It is built using Python 3.3 on a Linux machine (obvious from the file pathways) and is used to deploy DLL's and EXE's on Windows machines.

The last date of compile was in June of 2014. Either someone at the NSA was a traitor, or they hired a double agent. Now that the CIA/NSA's stash of cyber weapons have been revealed it is also obvious that deployments of Assassin and AfterMidNight, and other spyware revealed by "Vault 7", will be eradicated by foreign governments, their agents deployed anywhere, and international malcontents. IF they are going to rebuild their cyber weapons within any reasonable amount of time in order to avoid national tragedies, they are going to need access to Microsoft's source code. Microsoft has already given China access to Windows source as a condition for doing business in China, but it remains to be seen if they will deploy that excuse Bill Gates gave to not release the Windows source code to Congress "because it is a national treasure", a year before they gave that "treasure" to China.

[TWPonKubuntu]

"...national treasure", Right. Bill Gates wishes it were so but my opinion is more along the lines of "national disgrace".

And Microsoft(r) has been welcomed into the Linux Foundation. Why was this a bad idea, again?

[Feathers McGraw]

Not sure I agree with the article, but maybe it's because I'm thinking about it in relation to the malware's impact on the UK's National Health Service (NHS). If the problem was constrained to home users then sure, "too bad, should have used linux" would be a fair point. However:

1. The UK government pays Microsoft for extended support for XP. The patches were available, but were not applied by some trusts (local bureaucracies). Other trusts had applied the patches and were not affected.
2. Many of the computers affected were running bespoke applications for controlling medical hardware. It may not have been a simple thing to update these applications if they depended on system libraries, as there are sometimes API changes between library versions.
3. The NHS is chronically underfunded, so even assuming the patch could be applied without breaking the applications running on the machine, there were too few trained staff able to do so. Budget cuts mean that local trusts may have chosen to cut IT spending to protect front line services.

With reference to item 2, note that this can be a problem for Linux too. Go over to https://talk.maemo.org and witness the problems you have on Linux when some parts of the system are proprietary and depend on old libraries (e.g. glibc), so you can't update the system beyond a certain point without breaking key components, and you can't modify the programs either because you don't have any source code. If you think medical hardware is not going to be just as bad as (if not worse than) mobile in terms of binary blobs and proprietary code, then I think you are naive!

Even if source code for these applications was available, updating them takes quite a lot of technical knowledge and skill, which is in short supply (see point 3: no money).

Nowadays, it would be possible to package such applications in a container so that the underlying OS could be updated easily without breaking everything. Problem is, medical hardware is extremely expensive and expected to last a long time, therefore the applications have "old school" packaging. No doubt in 15 years time we'll discover some new problems with containerising everything!