[Coco] Re: OS Vulnerabilities

[John E. Malmberg]

James Ross wrote:
> John E. Malmberg wrote:
> 
>>Some OSes like OpenVMS/UNIX/LINUX require that the program be run by a 
>>privileged user to cause that type of problem.
>  
> Just because a person is an administrator of their computer does not
> necessarily mean the applications / drivers could not contain a
> Trojan.  Since RPM's are convenient, any admin installing from them is
> just as venerable and as Windows user, especially from an unknown
> source.

There is a limit to how much stupidity that you can defend against.  Any 
Admin that runs or installs programs from unknown sources with 
privileges enabled is easy to target.

That just means that the Administrator is not very smart about security.

There is almost no way to use technology to protect against social 
engineering.

>>1. Cookie exploit.  
> 
> I do not believe this is possible for http://server1/ to read
> http://server2/ cookies with today's mainstream browsers is it?

As far as I can tell, it is the default setting for most browsers that 
accept cookies.  So yes it is possible.  One of the purposes of cookies 
is to track web site referrals.

The only default protection for cookies is having a hard to guess name, 
and encrypted contents.

Most cookies do not have "secret" contents, so do not need any protection.

>>But if your e-mail client will open external pictures automatically
>  
> I have yet to get a no kidding virus from either Outlook or Outlook
> Express from displaying pics.  Of course executables/scripts are out
> of question, but graphics?  If that is ture I would like to read about
> it.

It does not install a virus.  When the web browser connects to the 
remote host to display the graphic, the web server can try to see if it 
can find cookies from other web servers.

If your online bank stores it's cookies with an easy name such as 
"your.bank.info", then any other web site can inspect the contents of 
the cookie, unless you have put restrictions on your browser.

And if you do put the restrictions on, you may find that several sites 
no longer work because they can not read the cookies that others have left.

A search about cookie exploits on http://www.google.com shows over 
40,000 hits.  Once the real exploit was done, people became more careful 
about checking for other exploits, so it may take some refinement to 
find the documentation on the cases where money was actually stolen.

> I still blame the OS.  If and when a modern OS is devised, it should
> be practically indestructible and give control to the PC owner and not
> the programmer / engineer of the software. 
> 
> It is easy to render your OS useless …  why is this possible?  Bad
> design. 

My Operating System in use on this computer is OpenVMS.  It has been out 
there since the 1970's and is still being actively developed.  I am
using Mozilla as a news reader and a web browser.

So it qualifies as a modern OS.

It is also practically indestructible and gives the control to the 
system owner.

But at some point, you have to have trusted software that runs in a 
privilege context.  There is no way around that.

And if the System Owner does not follow good practices, there is really 
not much that can be done about that.

And it is not easy to render it useless.  There is no evidence of a bad 
design at all.

I have full control of it, but yes, at some point I must depend on the 
programming / engineering skills of others.  There is really no way 
around that.  In that case, you have to go with the reputation of your 
suppliers.

So at least one modern OS does exist that meets your criteria, as well 
as it can be met, and has done so for for quite some time.

-John
wb8tyw at qsl.network
Personal Opinion Only