Messages in this thread | | | From | Steve VanDevender <> | Date | Mon, 27 Dec 1999 17:28:09 -0800 (PST) | Subject | Re: Unexecutable stack |
| |
Richard B. Johnson writes: > On Mon, 27 Dec 1999, Steve VanDevender wrote: > > I run a couple of large Solaris 7 systems with the > > "noexec_user_stack" option enabled. This defeats nearly all root > > exploits based on stack overflows; I've tried them and intruders > > have tried them without success. Making the stack non-executable > > really does help. > > So how many root exploits have you actually had? And, how many > attempts? I have, at last count, 54 Suns, 126 Alphas, a few hundred > ix86/Linux, plus slightly less than 1,000 Win/Win-NT machines on > this very site where we have 1,200 engineering employees. Most > all the Suns, Alphas, and Linux machines are not filtered by > a firewall.
I've seen dozens of attempted root exploits on my systems (and had to clean up after a few successful ones). We just had someone try to exploit /usr/bin/admintool yesterday. When the Solaris rpc.cmsd exploit was current our /var/spool/calendar directory was littered with dozens of callog.root files containing obvious signatures of buffer overrun attempts (lots of binary gunk with the string "/bin/sh" embedded in it). We have detectable root exploit attempts every few weeks.
> We have never had a known, provable break-in of any kind, not > counting the engineers blue-screening the Windows machines > by throwing funny packets at them.
Either the script kiddies haven't decided that you're a good target to probe, or more likely dozens of your machines are already owned and you just don't know about it. Some of the better script kiddes are good at covering their tracks (root kits often contain log-wiping tools), and you would have to have some top-notch sysadmins to have adequate security coverage with monitoring, logging, and system maintenance to cover the zoo of machines you describe.
I'm a staff sysadmin for two of the largest machines at my university and we are a popular cracking target. You aren't going to get anywhere by claiming that my machines aren't really being probed. We monitor the hell out of our machines, including a locally-written program that looks for the root-exploit signature of a root-owned process whose parent is not owned by root (with appropriate exceptions for the people we know have access to root and commonly-run setuid programs). So we do know about exploits when they happen, unlike many sysadmins who only find after the script kiddies leave blatantly obvious traces.
I do realize that a non-executable stack only raises the bar for exploit attempts. But when nearly all security exploits for the past several years have been stack buffer overruns on root-run or setuid-root programs, a non-executable stack really does make a practical difference. I'm really tired of hearing people dismiss practical security solutions because they don't protect against everything; no single security technique protects against everything. The only real way to achieve security is using all the techniques that you can, and thoroughness in system management and monitoring, to get as much protection as possible and detect the things you can't protect against.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |