lkml.org 
[lkml]   [1999]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: Unexecutable stack
Richard B. Johnson writes:
> On Mon, 27 Dec 1999, Steve VanDevender wrote:
> > Either the script kiddies haven't decided that you're a good
> > target to probe, or more likely dozens of your machines are
> > already owned and you just don't know about it.
>
> Let's put it this way. "They" must be leaving the cracked systems
> in good shape with no changes in any important files. So good for
> them. If a tree falls in the forest, and there is nobody there to
> hear it.....

Crackers don't crack systems to trash them. They crack systems
partly for the ego boost ("I have root on N systems"), to use as
relays when attacking other systems so their real base of
operations is obscured, and sometimes to run things like IRC bots
or network flooding amplifiers. They often do this without
noticeably modifying the programs that normal users use on those
systems; it's in the cracker's interest to leave the machine up
and to avoid detection. So just because your machines haven't
crashed doesn't mean they haven't been compromised.

> Most of us use hexadecimal longwords, i.e., 0xfeedface, 0xdeadfeed,
> as passwords. They are not alowed to spell anything like these
> do. They are easy to remember, but hard to guess because they don't
> mean anything.

Oh great. So you all use easily crackable passwords (16^8 ain't
much these days; password crackers can burn through 2^32 trial
passwords in a day or so). Of course, with the level of security
management you've described the intruders don't have to crack
your passwords; they probably just sniff them off your network
from the machines they already own.

> > I'm a staff sysadmin for two of the largest machines at my
> > university and we are a popular cracking target. You aren't
> > going to get anywhere by claiming that my machines aren't really
> > being probed.
> [SNIPPED rest for brevity]
> We once had a "staff sysadmin". We also once had a "security manager".
> They left sometime ago after turning our tools into rocks. They were
> never replaced.

It's too bad your company couldn't hire competent admins or
security people. I fail to see how that bolsters your point.

My point is that in practice, for real, running systems with
non-executable stack pages buys quite a bit of security; it
hasn't eliminated our need for security management on a
continuing basis, but it has prevented a lot of potential
breakins and let us work on other security improvements. So
claiming that running with a non-executable stack doesn't really
buy you anything doesn't wash with me. The systems I admin for
have 4000 and 16,000 accounts respectively, with over three
gigabytes of locally-installed and third-party software, and not
one thing broke when we turned on non-executable stack, either.
(Yes, I know Objective-C breaks. Show me someone who really uses
Objective-C.)

I also understand that for some architectures (like i386) where
page permissions don't include an execute bit, it's not easy to
provide a non-executable stack. Solar Designer went to quite a
bit of work to make his non-executable stack patch, but he did
make something that worked. On architectures like the Sparc,
it's pretty easy to have a non-executable stack patch.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [W:0.122 / U:0.132 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site