Welcome to Sound Off

12/23 ControlGlobal Dives into the Blogosphere Welcome to Sound Off...CONTROL's entry into the blogosphere. Feel free to respond to me at mailto:[email protected]?Subject=ControlGlobalDives. I'll post interesting responses. --Walt Boyes, Editor in Chief Linux Worm Defaces Websites...What Does that Mean for Process Automation? One of the reasons Linux has been touted for use in embedded control systems is its resistance to attack by worms and viruses. Security consultants have been warning against this complacent attitude for years, but now it is reaching critical mass. Posted on Monday, Dec 20 on Dr. Jerry Pournelle's Chaos Manor blog was a comment by security guru Rick Hellewell: "A new work dubbed Santy or php/chaploit is rapidly defacing web sites running the phpBB discussion forum software. The worm uses a Google search to find web sites running that software; the search string used is inurl:phpbb inurl:viewtopic. A Google search using that string will find over one million hits; so there are many sites using this software. Once a site is found, the worm then uses a vulnerability in that software to overwrite various "php" and "htm" files with a message "This site is defaced!!!" Some reports indicate that the worm may also install a 'root kit', which allows the hacker full access to the server. An MSN search for those text strings will find over 37,000 sites that have been successfully attacked. There is a workaround until a fix is released; web site operators using the phpBB software should immediately enable that workaround, and monitor for updates. I suspect that many of your readers might have this software installed on their personal Linux servers. It does not appear to infect user computers, only Linux servers running the phpBB software. Some anti-virus software is providing detection at this time, but the threat is evolving." As the number of Linux servers and clients increases so too will their vulnerability to the same kinds of attacks currently plaguing Microsoft Windows operating systems. How this will affect process automation is clear. It isn't a solution to say that we should run away from Windows, and embrace Linux. What we have to do is to make computer security so easy to do that people will actually do the things they need to do to make their systems secure. --Walt Comment? mailto:[email protected]?Subject=Linuxworm