Messages in this thread | | | From | Steve VanDevender <> | Date | Mon, 27 Dec 1999 21:23:40 -0800 (PST) | Subject | Re: Unexecutable stack |
| |
Richard B. Johnson writes: > On Mon, 27 Dec 1999, Steve VanDevender wrote: > > Either the script kiddies haven't decided that you're a good > > target to probe, or more likely dozens of your machines are > > already owned and you just don't know about it. > > Let's put it this way. "They" must be leaving the cracked systems > in good shape with no changes in any important files. So good for > them. If a tree falls in the forest, and there is nobody there to > hear it.....
Crackers don't crack systems to trash them. They crack systems partly for the ego boost ("I have root on N systems"), to use as relays when attacking other systems so their real base of operations is obscured, and sometimes to run things like IRC bots or network flooding amplifiers. They often do this without noticeably modifying the programs that normal users use on those systems; it's in the cracker's interest to leave the machine up and to avoid detection. So just because your machines haven't crashed doesn't mean they haven't been compromised.
> Most of us use hexadecimal longwords, i.e., 0xfeedface, 0xdeadfeed, > as passwords. They are not alowed to spell anything like these > do. They are easy to remember, but hard to guess because they don't > mean anything.
Oh great. So you all use easily crackable passwords (16^8 ain't much these days; password crackers can burn through 2^32 trial passwords in a day or so). Of course, with the level of security management you've described the intruders don't have to crack your passwords; they probably just sniff them off your network from the machines they already own.
> > I'm a staff sysadmin for two of the largest machines at my > > university and we are a popular cracking target. You aren't > > going to get anywhere by claiming that my machines aren't really > > being probed. > [SNIPPED rest for brevity] > We once had a "staff sysadmin". We also once had a "security manager". > They left sometime ago after turning our tools into rocks. They were > never replaced.
It's too bad your company couldn't hire competent admins or security people. I fail to see how that bolsters your point.
My point is that in practice, for real, running systems with non-executable stack pages buys quite a bit of security; it hasn't eliminated our need for security management on a continuing basis, but it has prevented a lot of potential breakins and let us work on other security improvements. So claiming that running with a non-executable stack doesn't really buy you anything doesn't wash with me. The systems I admin for have 4000 and 16,000 accounts respectively, with over three gigabytes of locally-installed and third-party software, and not one thing broke when we turned on non-executable stack, either. (Yes, I know Objective-C breaks. Show me someone who really uses Objective-C.)
I also understand that for some architectures (like i386) where page permissions don't include an execute bit, it's not easy to provide a non-executable stack. Solar Designer went to quite a bit of work to make his non-executable stack patch, but he did make something that worked. On architectures like the Sparc, it's pretty easy to have a non-executable stack patch.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |