Re: Re[4]: Linux hardening

From: Daniel Margolis (dmargoli_at_seas.upenn.edu)
Date: 09/02/05

  • Next message: Mailing List: "scanning for windows spywear with linux" 
    Date: Thu, 1 Sep 2005 23:34:29 -0400

    On Tue, Aug 30, 2005 at 07:35:02PM +0100, Adam D. Barratt wrote:

    > noexec is almost always bypassable.
    >

    Which is why I mentioned TPE (the security of which may be questionable
    as well; I don't know much about it). Though as someone here previously
    noted, the ld issue has been fixed, though noexec is still not exactly
    impervious to a clever attacker. In mentioning noexec, though, my point
    was that there are perhaps more systematic approaches one can take than
    patching a wget binary here or there.

    >
    >
    >>> Or did I misunderstand you?
    >>>
    >>
    >> You misunderstood. Method above was meant to be used with
    >> wget, that dumps received file into file.
    >>
    >
    > Exactly the same applies:
    >
    > wget http://some.host/path -O - > /tmp/foo
    >

    Right. Original poster claimed to have patched curl and wget, though
    curl doesn't print to a file (at least not my version). It doesn't
    matter, though, because I still think that this is, to be generous, an
    incredibly rough stopgap measure. I, personally, would not be happy to
    have someone able to execute arbitrary commands on my machine, even if
    he has to go out of his way to figure out how to load his rootkit on.
    Even if he, for some reason, cannot download code from the Web, he can
    a) write it to a file bit by bit and then execute it, b) rm -rf / just
    to mess with you, c) copy out all your secret data and then leave, etc.
    Preventing him from using wget doesn't really get you anywhere.

    Like I said, I don't see what this "measure" gets you. Why bother? 

    -- 
Dan
[Edited of profanity at behest of focus-linux moderators. Oops!]
  • Next message: Mailing List: "scanning for windows spywear with linux"