• Welcome to OS2World OLD-STATIC-BACKUP Forum.
 

News:

This is an old OS2World backup forum for reference only. IT IS READ ONLY!!!

If you need help with OS/2 - eComStation visit http://www.os2world.com/forum

Main Menu

OS2 & Vulnerabilties

Started by eilygre, 2008.01.12, 13:37:29

Previous topic - Next topic

eilygre

http://news.bbc.co.uk/2/hi/technology/7183008.stm

Moderators note: Changed topic to more correct topic.

Ben

#1

Greetings, eilygre.

I don't use any versions of Windows myself; all five of our computers here run eCS.

Windows virus' or virii, have been around since day one, malicious or otherwise and are commonplace,
(WRT that OS), expected, and routine. I used to have a  cheap laugh out of it, but even that has been long since, stretched too thin.

While it's nice to know that we,
(meaning OS/2 users), don't suffer from such things, you might call me critical, for this post seems a bit out of place in an OS/2 forum.

Saijin_Naib

^ Its not like OS/2 is not vulernable to Virii and adware, in fact, im sure its far more vulnerable than windows, its just that no one cares enough about OS/2 to even try to hack it.

Ben

Quote from: Saijin_Naib on 2008.01.12, 23:33:35
^ Its not like OS/2 is not vulernable to Virii and adware, in fact, im sure its far more vulnerable than windows, its just that no one cares enough about OS/2 to even try to hack it.
Greetings, Saijin.

For certain all OS' are potential,
(and vulnerable as), targets for virii, however stating that OS/2 is "far more vulnerable than windows" is quite a bold statement.

Now, Windows on the other hand, is by design and intent a sieve.

I could rhyme off many of its security problems that OS/2 does not, and could not have,
(root kits and the NSA back door, for example), however why bother? They are far too numerous, far too well known and far too well documented. The computer mags and rags are filled with them. New ones burst out ever day like the over-ripe-pimples-on-the-teenagers that the M$ POS is marketed too. To say that OS/2 is, or would be worse, is out and out baseless, speculation.

However, security through obscurity is definitely on our side.

8)

Later...

Saijin_Naib

#4
I dont know, I assumed that was the case simply because the core of the OS has not been touched in many years, and I am assuming that there are undocumented holes and exploits within some apps or the network stack. Hell, if Linux has exploits and vulnerabilities and its CONSTANTLY updated, Id bet money that an OS that was mostly made 12 years ago has quite a bit of holes and exploits. Again, If OS/2 had the marketshare that Windows had, Im sure you would find that it would have just as many attacks as windows. As for Windows being marketed towards pimpled teenagers, I happen to take offense to that remark. Being just out of my teens and a satisfied user of Windows, I feel that remark is kinda bull. Much like how I could say OS/2 is only for people who are just as outdated and antiquited as the OS they cling to and defend  as its pushed into the corners of obscurity. Not fair to say is it?

I could go on about how much more I can do with Windows vs OS/2, but its not relevant because OS/2 is used mostly (from what I see here) for Database work. I use my computer primarily for gaming, multimedia, and school work. That is Windows strong suite. I like OS/2 because the WPS has a lot of cool features and usability that the explorer shell doesnt have. I also like OS/2 because it satisfies my nostalgia due to the fact that my first GUI computer was OS/2. Also, OS/2 is being worked on by Serenity and its cool to see the progress and feel like Im part of the development.

Anyway, you are right, It is speculation. But during the time that OS/2 was popular like Windows (early 90s) there were virus for it, hence the creation of AV suites for OS/2. However, I do not know if the attack rates back then were similar or not.

Oh well, and to be perfectly honest, I got my first virus in 6 years two days ago (I dont use AV, just a firewall and common sense). I was going to run a keygen for my Mac using friend so he could install Doom3 on OS 10.5 (he left his copy at home) and I didnt bother to check the keygen (damnit) and ran it with admin priviledges, lo and behold, it was a Trojan. Dropper.Agent.GIT. A nasty little guy, just came out about 5 days ago. Id say beware, some ass is spoofing game torrents with it. Anyway, long story short, it wrecked my install of XP and I had to format my eCS drive and dump all my documents, pictures, and save-games to that drive and then re-install XP again. So virus suck, and I got bit in the ass by one just recently, but again, Its the first time since 6 years ago and Im pretty much "naked". Id say that XP has proven to be damn secure.

Of course, I've never gotten a virus on OS/2, but then again, I can never keep an install functional longer than 2 months at a time... :\

kim

As already said, looking into vulnerability reports for OS2 (Secunias vulnerability report for OS2 Warp and Warp Server for e-business) you will find nothing at all, due to the market share that OS2 has today - but of course there are vulnerabilities in OS2 - they have just not been found, reported and documented. But, looking at applications that you're running on an OS2 system will give you another picture and the most security vendors seldom test applications exploits if they're valid on an OS2 system or not.

Also, I have earlier had discussions with customers regarding claimed OS2 vulnerabilities together with Windows based system and in 99% of the cases the vulnerability was Windows related and not OS2 related even if the customers was told other by consultants.

S.SubZero

Windows gets targeted for these kinds of attacks because it's the platform in use by the vast majority of users, and the vast majority of inexperienced users.

I fully believe that the concept of a completely 100% secure, unhackable, unvirusable operating system that still provides expected functionality to the user is impossible.  At some point the need to provide a function for users becomes the function that allows these things to happen.  I mean you could have Windows absolutely locked down, unable to access the web, no open ports at all, no internet connectivity, no keyboard, nothing, and yeah, it probably won't get a virus.. but then it would be unusable.

Firefox is a perfect example of what happens when you cross the safe line for the sake of functionality.  Firefox was written FROM SCRATCH to be this perfect, unexploitable, 100% safe browser.  It met that goal for a short time, but the minute they added some function that it HAD to have, the security bulletins and updates started.  It didn't help that a zillion people downloaded it Mozilla happily bragged about it, and got the attention of the seedy types looking for new victims.

Windows is a big, porous OS.  This does not necessarily make viruses and trojans unavoidable.  There are measures the user can take to prevent them, both with software and common sense.  Apply those Windows Updates, stick to familiar sites, use ad blockers, learn how to notice subtle changes in the system, and don't run strange EXE's sent from anyone, even people you know.  It's not rocket science.

Saijin_Naib

Kim, I was looking at Secunia to see how Wink2k stacked up to XP, Vista, some linux Distros, and OSX. I saw that it had OS/2 as well, but as you noticed, no information. Do you know of anything like Secunia that did those reports back when OS/2 was in more prevalent use?

kim

#8
Secunia has no "old" information since they rather new company and only been in the business for 5-6 years. You have to check Security Focus vulnerability database..... and I checked there as well and neither Warp Server, Warp 4.5 and OS2 Ftp Server comes up with any hit. Kind of interesting that they actually had OS2 Ftp server as an entry?!

Google actually comes up with some few hits, so guess that we have some readings for the next couples of days since it would be interesting to see what history says about OS2 and vulnerabilities.

To quote one of the hits that came up:

"My (admittedly casual) research into OS/2 vulnerabilities proved inconclusive. I could not find a single OS/2 vulnerability at Semantic. How nice of Semantic to list OS/2 so often under the "Systems not affected" section... Actually, I *could* find an exploit that does affect OS/2 at CERT"

chennecke

#9
Quote from: Saijin_Naib on 2008.01.13, 09:10:31
I dont know, I assumed that was the case simply because the core of the OS has not been touched in many years, and I am assuming that there are undocumented holes and exploits within some apps or the network stack. Hell, if Linux has exploits and vulnerabilities and its CONSTANTLY updated, Id bet money that an OS that was mostly made 12 years ago has quite a bit of holes and exploits. Again, If OS/2 had the marketshare that Windows had, Im sure you would find that it would have just as many attacks as windows.

There are holes in the TCP/IP stack. It's based on an older version of the BSD stack which has known issues. These aren't likely to get fixed. The ability to exploit these is another issue, and I don't feel qualified enough to comment on this.

Vulnerability is also a question of design. There are some things that do have holes and that could be exploited. However, the number of people on this planet who are knowledgable enough to do this is probably in the very low 2-digit range. And I dare guess that it should be hard to find anyone who would create an exploit.

Finally, the number of attacks doesn't say anything about the success rate.

QuoteI could go on about how much more I can do with Windows vs OS/2, but its not relevant because OS/2 is used mostly (from what I see here) for Database work. I use my computer primarily for gaming, multimedia, and school work. That is Windows strong suite.

Well, I'm using OS/2 for office stuff (writing letters, calculation, database, accounting, statistics), www browsing, e-mail, news, web design and development, writing CDs and DVDs, and a bit of DTP. What I'm missing is mostly an easy to use video DVD authoring software, an easy to use audio recording solution with de-noising, and an up-to-date version of Java.

QuoteAnyway, you are right, It is speculation. But during the time that OS/2 was popular like Windows (early 90s) there were virus for it, hence the creation of AV suites for OS/2. However, I do not know if the attack rates back then were similar or not.

Sorry, but that's not quite correct. The number of known OS/2 virii is around 4. IIRC only two of those were ever reported to be seen in the wild, the others were case-studies. The AV suites for OS/2 were created as a precaution and to prevent the proliferation of virii for other systems.

QuoteOh well, and to be perfectly honest, I got my first virus in 6 years two days ago (I dont use AV, just a firewall and common sense). I was going to run a keygen for my Mac using friend so he could install Doom3 on OS 10.5 (he left his copy at home) and I didnt bother to check the keygen (damnit) and ran it with admin priviledges, lo and behold, it was a Trojan. Dropper.Agent.GIT. A nasty little guy, just came out about 5 days ago. Id say beware, some ass is spoofing game torrents with it. Anyway, long story short, it wrecked my install of XP and I had to format my eCS drive and dump all my documents, pictures, and save-games to that drive and then re-install XP again. So virus suck, and I got bit in the ass by one just recently, but again, Its the first time since 6 years ago and Im pretty much "naked". Id say that XP has proven to be damn secure.

Well, it's not. You do need a firewall, don't you? I remember the pre-SP2 area. Did a fresh install of XP, hooked up the machine to the internet to retrieve updates, and 10 minutes later we received a phone call from the central IT department about the machine sending all kinds of requests...

QuoteOf course, I've never gotten a virus on OS/2, but then again, I can never keep an install functional longer than 2 months at a time... :\

I'd really check the hardware of that machine. Try memtest (www.memtest.org) and get a hard drive tool from the manufacturer of your hard disk. OS/2 is quite sensitive to defective hardware. Also make sure that the machine's interior is clean. I've seen dust cause problems even after moving a machine a few meters around.

Since Warp 4, I've only re-installed OS/2 and eCS on my productive system because I upgraded to a new version, except for one time when I changed the drive layout and added networking. The second Warp 4 install was used on 3 machines in a row (K6 200, K6-II 300, K6-III 400). The times I had to restore a backup I had tested beta or alpha software that hooked deeply into the system or a hard drive blew up. I had severe problems with Warp 3 for some time but those were related to defective hard drives and RAM.

Saijin_Naib

Quote from: chennecke on 2008.01.13, 22:30:49
There are holes in the TCP/IP stack. It's based on an older version of the BSD stack which has known issues. These aren't likely to get fixed. The ability to exploit these is another issue, and I don't feel qualified enough to comment on this.

Yeah, I was aware that there are holes, but I also read that the eCS evolutionary sprint plan aims to replace the current stack with an IPv6 stack that is completely re-written. This could be great news for those holes, or bad news. I wouldnt know, I am most certainly not qualified to venture any guess.

Quote from: chennecke on 2008.01.13, 22:30:49
Vulnerability is also a question of design. There are some things that do have holes and that could be exploited. However, the number of people on this planet who are knowledgable enough to do this is probably in the very low 2-digit range. And I dare guess that it should be hard to find anyone who would create an exploit.

Finally, the number of attacks doesn't say anything about the success rate.

^ Again, the lack of knowledge (regarding OS/2 vulnerabilities) I feel is the greatest factor in its lack of attacks and success of attacks.

Quote from: chennecke on 2008.01.13, 22:30:49
Well, I'm using OS/2 for office stuff (writing letters, calculation, database, accounting, statistics), www browsing, e-mail, news, web design and development, writing CDs and DVDs, and a bit of DTP. What I'm missing is mostly an easy to use video DVD authoring software, an easy to use audio recording solution with de-noising, and an up-to-date version of Java.

I use it occasionally for office work, but I dont really like OpenOffice, although 2.3 is much improved over the version we currently have. What is DTP?
Web browsing is mostly good, but we need Java, Flash, and some version of Moonlight/Silverlight would not be amiss IMO.

Quote from: chennecke on 2008.01.13, 22:30:49
Sorry, but that's not quite correct. The number of known OS/2 virii is around 4. IIRC only two of those were ever reported to be seen in the wild, the others were case-studies. The AV suites for OS/2 were created as a precaution and to prevent the proliferation of virii for other systems.

Didnt know that :)

Quote from: chennecke on 2008.01.13, 22:30:49
Well, it's not. You do need a firewall, don't you? I remember the pre-SP2 area. Did a fresh install of XP, hooked up the machine to the internet to retrieve updates, and 10 minutes later we received a phone call from the central IT department about the machine sending all kinds of requests...

Yes, I use the default SP2 firewall and then Windows Defender. This has proven to be a decently safe combo of FREE security that doesn't suck. Anyway, OS/2 has a firewall as well so its just a good precaution to have. To me, every machine should be firewalled, regardless of what OS its hosting.

Quote from: chennecke on 2008.01.13, 22:30:49
I'd really check the hardware of that machine. Try memtest (www.memtest.org) and get a hard drive tool from the manufacturer of your hard disk. OS/2 is quite sensitive to defective hardware. Also make sure that the machine's interior is clean. I've seen dust cause problems even after moving a machine a few meters around.

I do believe all my hardware is fine, I just upgraded my RAM and GPU so that I could play in the current generation of games. My PSU is outputting solid voltage on all rails, my mem has passed WMD and Memtest86. As for my HDD, I did not know i could test it. Ill have to check the western digital site.

Quote from: chennecke on 2008.01.13, 22:30:49
Since Warp 4, I've only re-installed OS/2 and eCS on my productive system because I upgraded to a new version, except for one time when I changed the drive layout and added networking. The second Warp 4 install was used on 3 machines in a row (K6 200, K6-II 300, K6-III 400). The times I had to restore a backup I had tested beta or alpha software that hooked deeply into the system or a hard drive blew up. I had severe problems with Warp 3 for some time but those were related to defective hard drives and RAM.

My issues with eCS stablity seem to be mostly from my need to mess with it. Installing (or trying to install) eSchemes, or other WPS enhancements. Sometimes it will nuke the WPS and the only way I know to fix that is to reinstall. Thats okay, my vital data is on my NTFS XP volume and a flash-drive for all my work documents.

Also, some hard WPS locks due to Innotek Font Engine mess ups or Sound device locks will lead to a corrupted .ini somewhere and thats game-over for me. Also, I did not know that an MPTS crash due to a flooded NIF folder would cause a trap in SOCKS upon the next reboot, making me reinstall various times until I made that connection.

Basically, growing pains. I'm not terribly knowledgeable about OS/2 and I learn by doing/breaking. I couldnt count the Win95/98/ME installs I trashed to learn as much about windows as I currently do :P

kim

Quote from: chennecke on 2008.01.13, 22:30:49There are holes in the TCP/IP stack. It's based on an older version of the BSD stack which has known issues. These aren't likely to get fixed. The ability to exploit these is another issue, and I don't feel qualified enough to comment on this.

Regarding the TCP/IP stack; didn't the stack actually come from AIX (based on UNIX System V with 4.3BSD-compatible command and programming interface extensions) so when looking at vulnerabilities AIX should be the one to look at?

Also, last time I tried to scan the network for system WSFEB came up as Sun servers; would be interesting the newer tools available today does a better job to identify an OS2 system.

Pete

Quote from: Saijin_Naib on 2008.01.13, 22:51:44

My issues with eCS stablity seem to be mostly from my need to mess with it. Installing (or trying to install) eSchemes, or other WPS enhancements. Sometimes it will nuke the WPS and the only way I know to fix that is to reinstall. Thats okay, my vital data is on my NTFS XP volume and a flash-drive for all my work documents.

Also, some hard WPS locks due to Innotek Font Engine mess ups or Sound device locks will lead to a corrupted .ini somewhere and thats game-over for me. Also, I did not know that an MPTS crash due to a flooded NIF folder would cause a trap in SOCKS upon the next reboot, making me reinstall various times until I made that connection.

Basically, growing pains. I'm not terribly knowledgeable about OS/2 and I learn by doing/breaking. I couldnt count the Win95/98/ME installs I trashed to learn as much about windows as I currently do :P


Hi

Just to offer some advice:-

Prior to installing any WPS "enhancements" ALWAYS make backup copies of the existing os2.ini and os2sys.ini files. If the "enhancement" installation fails and "nuke the WPS" it is fairly easy to boot to a command line and copy the backup ini files into position - avoids a re-install.

Also should the os2*.ini files get trashed for any other reason it is handy to have reasonably current copies to hand so you may want to consider implementing a "Desktop Backup" system. The set of modify-able scripts called Desktop Backup may be of help http://www.eracc.com/os2/os2.htm

Innotek Font Engine - if using the old version (build 2.40) supplied with eCS: SACK IT, it is fairly cruddy and much more prone to causing problems than the last beta version release (build 2.60)  http://download.innotek.de/ft2lib/InnoTek_FT2LIB_260_Beta1.exe
Uninstall 2.40 then install 2.60


Hope the above is of help  :-)

Pete


Saijin_Naib

Thanks Pete :) yeah, I have IFE 2.40 right now because I just installed and it is quite picky with Firefox. As for desktop backup, I think eWPS has the auto-archive feature, but I never turn it on for whatever reason -_-;;

I think this install is going to go the distance :p I will put IFE 2.60, already have WPS-Wizard and nice PNG icons, and that should be about all except for my normal suite of programs.

RobertM

From following it for a long time, I can tell you of only one vulnerability found in OS/2 itself. That vulnerability was in the original 32bit TCP/IP stack and related components. A certain kind of attack against an OS/2 machine would lock up the stack. It was reported to IBM on a Friday night and a fix was released the next day. All current stacks, and original WSeB (non CP2 & up release) have been fixed.

There were vulnerabilities linked to various programs under OS/2 - namely Domino and Notes - those vulnerabilities were in the Lotus code - not in the OS - and affected it on every platform... fixes were released for that as well...

And of course, there are various other OS/2 programs as well with such vulnerabilities that pop up from time to time (such as Firefox, etc) which also are not related to the OS itself.

So, since 1998, I've only found one directly related to OS/2 - but would love to hear about any I missed.

-Robert


Quote from: kimhav on 2008.01.13, 21:58:28
Secunia has no "old" information since they rather new company and only been in the business for 5-6 years. You have to check Security Focus vulnerability database..... and I checked there as well and neither Warp Server, Warp 4.5 and OS2 Ftp Server comes up with any hit. Kind of interesting that they actually had OS2 Ftp server as an entry?!

Google actually comes up with some few hits, so guess that we have some readings for the next couples of days since it would be interesting to see what history says about OS2 and vulnerabilities.

To quote one of the hits that came up:

"My (admittedly casual) research into OS/2 vulnerabilities proved inconclusive. I could not find a single OS/2 vulnerability at Semantic. How nice of Semantic to list OS/2 so often under the "Systems not affected" section... Actually, I *could* find an exploit that does affect OS/2 at CERT"


|
|
Kirk's 5 Year Mission Continues at:
Star Trek New Voyages
|
|