Re: Installation of software, and security. . .

From: Kerry Thompson (bugtraq_at_security.geek.nz)
Date: 07/19/05

  • Next message: ak_at_red-database-security.com: "Oracle Security Advisory: Overwrite any file via desname in Oracle Reports" 
    To: bugtraq@securityfocus.com
Date: Tue, 19 Jul 2005 15:27:32 +1200

    On Sun, 2005-07-17 at 16:09 -0400, John Richard Moser wrote:
    > Exactly my point. How do you manage or reduce risk when you can't even
    > tell what changes are to be made? An executable has to be run to truly
    > understand its actions; scripts can self-modify (variables run as code),
    > executables can have odd logic that obfuscates things from heuristics
    > examinations. You can't make an auditing tool to list all changes about
    > to be made and actions to be taken by installing the program (aside from
    > a spare machine and a debugger).
    >

    I agree, you really can't do it that way: auditing any non-trivial
    software package is way too hard for anyone ( read: not cost
    effective ). But there are systems which can constrain what the
    installation process can do and, in turn, what the installed software is
    capable of doing on a system.

    SELinux, for example, has a security policy for the rpm package
    installer. In short, it allows the rpm executable to install new files,
    overwrite some files, and set permissions. It permits the execution of
    an installation script, but constrains the functions executed by that
    script to fairly simple operations like chmod, chown, etc. All other
    operations ( eg. network access to download and install the spyware-du-
    jour ) is blocked - and blocked at the kernel level.

    So while you can't audit package xyz directly, you can ( on the SELinux
    system ) constrain what that package is permitted to do. And there are
    tools which will audit the policy rules, so you can audit what the
    package can do and come up with a worst-case scenario if the package
    turned out to be malicious.

    There are also other constraints in play in the real world - if a
    package distribution site was distributing malicious packages then I'm
    sure we would all hear about it, and the repercussions would be swift,
    severe, and probably quite a public spectacle. 

    --
Kerry Thompson
http://www.crypt.gen.nz
  • Next message: ak_at_red-database-security.com: "Oracle Security Advisory: Overwrite any file via desname in Oracle Reports"

    Relevant Pages

    • Re: FreeBSD packaging
      ... I have around 8 executables which should go to various directories as ... part of installation, and around 15 config file which go to config ... distinfo, pkg-descr files, etc. and do a "make package" from there. ...
      (freebsd-hackers)
    • Re: dist-upgrade problem (was Re: /etc/modutils/0keep: line 9: keep: command not found)
      ... Reading package fields... ... i t does not have execute permission ... installation script returned error exit status 100. ...
      (Debian-User)
    • Re: Trying to get PackMan to install GCC
      ... A repository can be tested consistent (ie all dependencies of all programs ... control, but RISC OS shared libraries (which are essentially ready, just ... Additional filecan describe what the package manager ... Readmes after installation, or the app needs to do something sensible on ...
      (comp.sys.acorn.apps)
    • Re: Finding installed package files
      ... >, and who is going to supply this documentation. ... > is a package with the common man pages for the thousand odd common commands ... tell me, as an installation option for some large packages, what was ... >>a set of commands and 'man' pages, could produce such a directory to make it ...
      (alt.os.linux.redhat)
    • Security Update for Microsoft Data Access Components (KB832483)
      ... : An error occurred while setup was trying to ... verify the version of Microsoft Data Access Components ... package returned FALSE, or there was a fatal error while ... installation. ...
      (microsoft.public.windowsupdate)