Messages in this thread | | | From | (John Alvord) | Subject | Re: Unexecutable stack | Date | Tue, 28 Dec 1999 16:36:59 GMT |
| |
On Mon, 27 Dec 1999 21:23:40 -0800 (PST), Steve VanDevender <stevev@efn.org> wrote:
>Richard B. Johnson writes: > > On Mon, 27 Dec 1999, Steve VanDevender wrote: > > > Either the script kiddies haven't decided that you're a good > > > target to probe, or more likely dozens of your machines are > > > already owned and you just don't know about it. > > > > Let's put it this way. "They" must be leaving the cracked systems > > in good shape with no changes in any important files. So good for > > them. If a tree falls in the forest, and there is nobody there to > > hear it..... > >Crackers don't crack systems to trash them. They crack systems >partly for the ego boost ("I have root on N systems"), to use as >relays when attacking other systems so their real base of >operations is obscured, and sometimes to run things like IRC bots >or network flooding amplifiers. They often do this without >noticeably modifying the programs that normal users use on those >systems; it's in the cracker's interest to leave the machine up >and to avoid detection. So just because your machines haven't >crashed doesn't mean they haven't been compromised. > > > Most of us use hexadecimal longwords, i.e., 0xfeedface, 0xdeadfeed, > > as passwords. They are not alowed to spell anything like these > > do. They are easy to remember, but hard to guess because they don't > > mean anything. > >Oh great. So you all use easily crackable passwords (16^8 ain't >much these days; password crackers can burn through 2^32 trial >passwords in a day or so). Of course, with the level of security >management you've described the intruders don't have to crack >your passwords; they probably just sniff them off your network >from the machines they already own. > > > > I'm a staff sysadmin for two of the largest machines at my > > > university and we are a popular cracking target. You aren't > > > going to get anywhere by claiming that my machines aren't really > > > being probed. > > [SNIPPED rest for brevity] > > We once had a "staff sysadmin". We also once had a "security manager". > > They left sometime ago after turning our tools into rocks. They were > > never replaced. > >It's too bad your company couldn't hire competent admins or >security people. I fail to see how that bolsters your point. > >My point is that in practice, for real, running systems with >non-executable stack pages buys quite a bit of security; it >hasn't eliminated our need for security management on a >continuing basis, but it has prevented a lot of potential >breakins and let us work on other security improvements.
One interesting point is that Linus was talking about methods of eliminating the need for trampolining a few weeks ago. That would make a non-executible stack trivial to implement.
john
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |