lkml.org 
[lkml]   [1999]   [Dec]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: Unexecutable stack
Richard B. Johnson writes:
> On Mon, 27 Dec 1999, Steve VanDevender wrote:
> > I run a couple of large Solaris 7 systems with the
> > "noexec_user_stack" option enabled. This defeats nearly all root
> > exploits based on stack overflows; I've tried them and intruders
> > have tried them without success. Making the stack non-executable
> > really does help.
>
> So how many root exploits have you actually had? And, how many
> attempts? I have, at last count, 54 Suns, 126 Alphas, a few hundred
> ix86/Linux, plus slightly less than 1,000 Win/Win-NT machines on
> this very site where we have 1,200 engineering employees. Most
> all the Suns, Alphas, and Linux machines are not filtered by
> a firewall.

I've seen dozens of attempted root exploits on my systems (and
had to clean up after a few successful ones). We just had
someone try to exploit /usr/bin/admintool yesterday. When the
Solaris rpc.cmsd exploit was current our /var/spool/calendar
directory was littered with dozens of callog.root files
containing obvious signatures of buffer overrun attempts (lots of
binary gunk with the string "/bin/sh" embedded in it). We have
detectable root exploit attempts every few weeks.

> We have never had a known, provable break-in of any kind, not
> counting the engineers blue-screening the Windows machines
> by throwing funny packets at them.

Either the script kiddies haven't decided that you're a good
target to probe, or more likely dozens of your machines are
already owned and you just don't know about it. Some of the
better script kiddes are good at covering their tracks (root kits
often contain log-wiping tools), and you would have to have some
top-notch sysadmins to have adequate security coverage with
monitoring, logging, and system maintenance to cover the zoo of
machines you describe.

I'm a staff sysadmin for two of the largest machines at my
university and we are a popular cracking target. You aren't
going to get anywhere by claiming that my machines aren't really
being probed. We monitor the hell out of our machines, including
a locally-written program that looks for the root-exploit
signature of a root-owned process whose parent is not owned by
root (with appropriate exceptions for the people we know have
access to root and commonly-run setuid programs). So we do know
about exploits when they happen, unlike many sysadmins who only
find after the script kiddies leave blatantly obvious traces.

I do realize that a non-executable stack only raises the bar for
exploit attempts. But when nearly all security exploits for the
past several years have been stack buffer overruns on root-run or
setuid-root programs, a non-executable stack really does make a
practical difference. I'm really tired of hearing people dismiss
practical security solutions because they don't protect against
everything; no single security technique protects against
everything. The only real way to achieve security is using all
the techniques that you can, and thoroughness in system
management and monitoring, to get as much protection as possible
and detect the things you can't protect against.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [W:0.638 / U:0.136 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site