lkml.org 
[lkml]   [1999]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: Unexecutable stack
Date
On Mon, 27 Dec 1999 21:23:40 -0800 (PST), Steve VanDevender
<stevev@efn.org> wrote:

>Richard B. Johnson writes:
> > On Mon, 27 Dec 1999, Steve VanDevender wrote:
> > > Either the script kiddies haven't decided that you're a good
> > > target to probe, or more likely dozens of your machines are
> > > already owned and you just don't know about it.
> >
> > Let's put it this way. "They" must be leaving the cracked systems
> > in good shape with no changes in any important files. So good for
> > them. If a tree falls in the forest, and there is nobody there to
> > hear it.....
>
>Crackers don't crack systems to trash them. They crack systems
>partly for the ego boost ("I have root on N systems"), to use as
>relays when attacking other systems so their real base of
>operations is obscured, and sometimes to run things like IRC bots
>or network flooding amplifiers. They often do this without
>noticeably modifying the programs that normal users use on those
>systems; it's in the cracker's interest to leave the machine up
>and to avoid detection. So just because your machines haven't
>crashed doesn't mean they haven't been compromised.
>
> > Most of us use hexadecimal longwords, i.e., 0xfeedface, 0xdeadfeed,
> > as passwords. They are not alowed to spell anything like these
> > do. They are easy to remember, but hard to guess because they don't
> > mean anything.
>
>Oh great. So you all use easily crackable passwords (16^8 ain't
>much these days; password crackers can burn through 2^32 trial
>passwords in a day or so). Of course, with the level of security
>management you've described the intruders don't have to crack
>your passwords; they probably just sniff them off your network
>from the machines they already own.
>
> > > I'm a staff sysadmin for two of the largest machines at my
> > > university and we are a popular cracking target. You aren't
> > > going to get anywhere by claiming that my machines aren't really
> > > being probed.
> > [SNIPPED rest for brevity]
> > We once had a "staff sysadmin". We also once had a "security manager".
> > They left sometime ago after turning our tools into rocks. They were
> > never replaced.
>
>It's too bad your company couldn't hire competent admins or
>security people. I fail to see how that bolsters your point.
>
>My point is that in practice, for real, running systems with
>non-executable stack pages buys quite a bit of security; it
>hasn't eliminated our need for security management on a
>continuing basis, but it has prevented a lot of potential
>breakins and let us work on other security improvements.

One interesting point is that Linus was talking about methods of
eliminating the need for trampolining a few weeks ago. That would make
a non-executible stack trivial to implement.

john

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [W:0.086 / U:0.280 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site