lkml.org 
[lkml]   [1999]   [Dec]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Unexecutable stack
On Mon, 27 Dec 1999, Steve VanDevender wrote:

> Richard B. Johnson writes:
> > On Mon, 27 Dec 1999, Steve VanDevender wrote:
> > > I run a couple of large Solaris 7 systems with the
> > > "noexec_user_stack" option enabled. This defeats nearly all root
> > > exploits based on stack overflows; I've tried them and intruders
> > > have tried them without success. Making the stack non-executable
> > > really does help.
> >
> > So how many root exploits have you actually had? And, how many
> > attempts? I have, at last count, 54 Suns, 126 Alphas, a few hundred
> > ix86/Linux, plus slightly less than 1,000 Win/Win-NT machines on
> > this very site where we have 1,200 engineering employees. Most
> > all the Suns, Alphas, and Linux machines are not filtered by
> > a firewall.
>
> I've seen dozens of attempted root exploits on my systems (and
> had to clean up after a few successful ones). We just had
> someone try to exploit /usr/bin/admintool yesterday. When the
> Solaris rpc.cmsd exploit was current our /var/spool/calendar
> directory was littered with dozens of callog.root files
> containing obvious signatures of buffer overrun attempts (lots of
> binary gunk with the string "/bin/sh" embedded in it). We have
> detectable root exploit attempts every few weeks.
>
> > We have never had a known, provable break-in of any kind, not
> > counting the engineers blue-screening the Windows machines
> > by throwing funny packets at them.
>
> Either the script kiddies haven't decided that you're a good
> target to probe, or more likely dozens of your machines are
> already owned and you just don't know about it.

Let's put it this way. "They" must be leaving the cracked systems
in good shape with no changes in any important files. So good for
them. If a tree falls in the forest, and there is nobody there to
hear it.....

> better script kiddes are good at covering their tracks (root kits
> often contain log-wiping tools), and you would have to have some
> top-notch sysadmins to have adequate security coverage with
> monitoring, logging, and system maintenance to cover the zoo of
> machines you describe.
>
We have 9 divisions with 9 sysadmins who do maintenance part-time.
Their main jobs are engineering, not administration. Most of the
other engineers know the root passwords for machines they work with.
The only 'security' feature is that root passwords (we also have
some VAXen -system passwords) are required to be changed weekly.

Most of us use hexadecimal longwords, i.e., 0xfeedface, 0xdeadfeed,
as passwords. They are not alowed to spell anything like these
do. They are easy to remember, but hard to guess because they don't
mean anything.

> I'm a staff sysadmin for two of the largest machines at my
> university and we are a popular cracking target. You aren't
> going to get anywhere by claiming that my machines aren't really
> being probed.
[SNIPPED rest for brevity]
We once had a "staff sysadmin". We also once had a "security manager".
They left sometime ago after turning our tools into rocks. They were
never replaced.


Cheers,
Dick Johnson

Penguin : Linux version 2.3.13 on an i686 machine (400.59 BogoMips).
Warning : The end of the world as we know it requires a new calendar.
Seconds : 353922 (until Y2K)


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [W:0.164 / U:0.012 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site