- Site menu:
- Latest Discussions
- Latest Newswire
- Archives
- Submit Story
- Story HOWTO
- Syndicate
- E-mail Alerts
Interview with the Vista Pwn2Own contest winners
Now the Question I have is this: Given that the exploit bypassed Windows DEP, and Linux doesn't use DEP, how could they have gained root access in Linux, as they did in Windows Vista? |
|
|
Comments (25)
5 earlier comments in the full thread.
Flash on Linux probably was vulnerable. But I wonder, could they have gained root? Exploiting flash only gives you local user rights.
Sander, they only gained current user access on the Mac and on the Vista machines, and according to the rules that's all they had to do.
True, but gain user privileges on a Windows box and you own the box. Gain user privileges on a *nix box and you own a bunch of mp3 files and a couple of spreadsheets :-)
That would be at the core of my confusion when I was discussing this on the ZDNet site where those blokes were interviewed. I couldn't see how gaining user access on the Linux box (or indeed the Windows box) gained them anything, but of course, gaining user access gained them a lot on the Windows box, I was using Linux thinking, and in response they were using windows thinking.
Think about it- cracking any user account on a Linux box opens the door to all kinds of mischief. A successful intruder can do everything that user can do. If it's a human user then their data are at risk, and the cracker can use them for spamming, filesharing, and whatever else their nasty little minds come up with. If it's a user attached to a service, then whatever that user has access to, such as database or webserver files, are open to the intruder. Modern sploitz don't need root to do a lot of damage.
Quoting:Modern sploitz don't need root to do a lot of damage.
No, but they need root access to hide. If they're not hidden then they're caught pretty quickly by any half-decent admin.
or half decently prepared user, and on a nix system they are so easy to stop and remove.
And using ubuntu is particularly weak in the security department, no set root password and all access done via sudo in a default installation.
Half decently prepared users and admins? Easy? Your faith is touching, young grasshoppers. Seriously, how would you know if you've been successfully cracked? Modern exploits rely on stealth- they don't want to call attention to themselves. Are you running intrusion detection systems? Memorizing file hashes? How would you even know?
Well TC there are no executables in my home directory, So unless they have root access, which patently they didn't get on either the Mac or the Windows machine, and which would be more difficult on a Linux (or at least has in practice been shown to be), there is actually no means by which they can stealth anything. Now there is one means, on my system, by which they can auto execute a script on startup, but I check that regularly, and it is pretty easy remove.
If they have root, then everything above goes out the window.
If they have root, then everything above goes out the window.
Quoting:Seriously, how would you know if you've been successfully cracked? Modern exploits rely on stealth- they don't want to call attention to themselves. Are you running intrusion detection systems?
Of course I run an intrusion detection system. Plus, like tracyanne there are no executabes in my home directories and without root access it's impossible to hide something on my systems. It's simply a matter of knowing what's going on in your system.
With *nix it's entirely possible to know exactly what's going on inside your system and that makes it easy to catch malware running at user level privileges. This is a lot harder on Windows.
Well sander and tracyanne, it's not quite that simple. Maybe your setup is different, but human users have all kinds of executables at their service- email, ftp, all kinds of client software, and other stuff I'm too lazy to think of now, and as azerthoth pointed out, the all-powerful sudo hole on Ubuntu. Which is a biggie. Plus most user accounts have read access to all kinds of configuration and other files. In addition, any service running under its own user (apache usually has the apache user, php and databases and other bits of LAMP stacks each have their own users, and so forth) has its own vulnerabilities. Crack any user, and you have all the powers that user has. (AppArmor and SELinux try to close those holes by strictly limiting services to just the minimum they need to do their jobs, and no more. Which defangs the power of root exploits, because then root is no long all-powerful.)
In addition, what's the point of using a PC? One word: data. So when a human user account is compromised and their data stolen, or a database user that controls all kinds of data, that's a serious loss. More serious than compromising system files, which can easily be replaced.
The article is kind of dim, IMO, since the guys being interviewed were more smart-alecky than informative. Other articles on the contest said that most contestants did a lot of advance homework, and chose to attack the systems they felt they had the best chance of cracking. It's just one contest, but I think it's fairly representative- the winners went with the weakest systems. The ones with the closed code, teehee.
Anyway if there's one point that's really important, it's that root access isn't essential for a successful crack, and plenty of damage occurs by compromising non-root accounts.
In addition, what's the point of using a PC? One word: data. So when a human user account is compromised and their data stolen, or a database user that controls all kinds of data, that's a serious loss. More serious than compromising system files, which can easily be replaced.
The article is kind of dim, IMO, since the guys being interviewed were more smart-alecky than informative. Other articles on the contest said that most contestants did a lot of advance homework, and chose to attack the systems they felt they had the best chance of cracking. It's just one contest, but I think it's fairly representative- the winners went with the weakest systems. The ones with the closed code, teehee.
Anyway if there's one point that's really important, it's that root access isn't essential for a successful crack, and plenty of damage occurs by compromising non-root accounts.
@TC: I'm not saying that a compromised user account on a *nix machine can't do any damage. I'm just saying that the damage will be much shorter lived because the malware can't hide. Of course a user has all kinds of executables to their disposal. It just can't add any new ones outside his home directory where it's easily locatable. And if you are a tad paranoid and mount /home with a noexec flag then it becomes even harder (you could still put a PHP or Python file in the user's home dir and execute that).
The problem with Windows malware its that it takes a long time for someone to find out they've been compromised. Early detection and removal of malware keeps it from spreading too far. It's not about the amount of damage to a single user. It's about the amount of damage to the people that single user comes in contact with.
The problem with Windows malware its that it takes a long time for someone to find out they've been compromised. Early detection and removal of malware keeps it from spreading too far. It's not about the amount of damage to a single user. It's about the amount of damage to the people that single user comes in contact with.
> the all-powerful sudo hole on Ubuntu.
OK, I'll bite - what is this "all powerful sudo hole on ubuntu", and how is that different from the sudo that ships with every linux distro? Or the all powerful root account that the non-ubuntu distros ship with?
Inquiring minds want to know!
OK, I'll bite - what is this "all powerful sudo hole on ubuntu", and how is that different from the sudo that ships with every linux distro? Or the all powerful root account that the non-ubuntu distros ship with?
Inquiring minds want to know!
@herzeleid:
"sudo" on Ubuntu is configured to accomplish admin tasks with minimal hassle. If you can't do it as your unprivileged self, just prefix it with "sudo" and it'll happen.
On most other distributions, "sudo" is configured by default to do few things, if any. On my Slackware and Slamd64 systems, /etc/sudoers contains nothing but comments, meaning "sudo" has precisely zero damage capacity (and I'll get an email if anyone tries anything funny).
"sudo" on Ubuntu is configured to accomplish admin tasks with minimal hassle. If you can't do it as your unprivileged self, just prefix it with "sudo" and it'll happen.
On most other distributions, "sudo" is configured by default to do few things, if any. On my Slackware and Slamd64 systems, /etc/sudoers contains nothing but comments, meaning "sudo" has precisely zero damage capacity (and I'll get an email if anyone tries anything funny).
On Ubuntu, sudo requires you to give the password for the user account. On most other systems, sudo asks for the root password,
If a user account is compromised then you can execute `passwd` and set the user account password to something you know. On Ubuntu you can then use it to execute things with root privileges. That's not possible on most other systems.
If a user account is compromised then you can execute `passwd` and set the user account password to something you know. On Ubuntu you can then use it to execute things with root privileges. That's not possible on most other systems.
@Sander:
No, the whole point of "sudo" is so that users don't need to know the root password. They provide their own password (to authenticate themselves as themselves) to do things with elevated privileges. It is very fine-grained control of root permissions, even to the point of allowing commands only with certain parameters to certain users. E.g. allowing the night-shift operator to run "e2fsck -n" but not "e2fsck -y" while the sysadmin drives to the office, so at least some diagnostic can be ready when he/she arrives.
The problem with Ubuntu is that it takes only slightly more work than Vista to get elevated privs:
Vista: "Are you sure about that? Click Yes or No."
Ubuntu: "Your password will let you do that. Please type it in."
OTOH, try that on any of my computers and I'll be calling your ISP soon.
No, the whole point of "sudo" is so that users don't need to know the root password. They provide their own password (to authenticate themselves as themselves) to do things with elevated privileges. It is very fine-grained control of root permissions, even to the point of allowing commands only with certain parameters to certain users. E.g. allowing the night-shift operator to run "e2fsck -n" but not "e2fsck -y" while the sysadmin drives to the office, so at least some diagnostic can be ready when he/she arrives.
The problem with Ubuntu is that it takes only slightly more work than Vista to get elevated privs:
Vista: "Are you sure about that? Click Yes or No."
Ubuntu: "Your password will let you do that. Please type it in."
OTOH, try that on any of my computers and I'll be calling your ISP soon.
@gus: Point taken, but my main concern is that a user password isn't safe. If you find an exploit to run code under local user privileges then you can get a working password. Executing system administration tasks with a user account password is a big no-no on all my systems.
Is it possible to set a separate sudo password? That would alleviate the problem that running `passwd` gives you a password that can execute system administration tasks and still not disclose the root password to users.
Is it possible to set a separate sudo password? That would alleviate the problem that running `passwd` gives you a password that can execute system administration tasks and still not disclose the root password to users.
Not sure about a separate "sudo" password, but generally "sudo" is configured to run only those things that are explicitly permitted (whitelist policy). It is also possible to deny "passwd" to all "sudo" users.
"man sudoers" for more info.
"man sudoers" for more info.
@sander
Changing own password with 'passwd' requires knowledge of the current password. So this will require that password of one of the "admin" users be known to work (in default Ubuntu configuration).
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
Sign up and post (it is free) or Log in and post