Full Disclosure mailing list archives
Re: No shell => secure?
From: hax <uberhax () gmail com>
Date: Thu, 8 Jul 2004 22:34:18 -0400
I'm not an expert in shellcode, but that thinking seems flawed in a few ways: 1) Tons of scripts rely on /bin/sh being present. It'd be a huge deal to rework the system so that everything goes to a new path. 2) That'd stop a lot of skript kiddies, I guess, but it'd be pretty trivial to just rework the shellcode to call some other command instead of /bin/sh. Everything from vi to mozilla can execute commands these days. 3) Changing the file system structure is a *bad* idea. You'd be breaking standards (http://www.pathname.com/fhs/) and you'd probably be breaking most applications. Think about how linking works, for example, and all the absolute references programs make. The moral of the story is that security through obscurity is *bad*. You wouldn't really be making yourself much safer, although you'd stop some of the mass exploitation scripts, and you'd cause yourself a lot of problems trying to make your obscurity function. Besides, if everyone tried what you suggest, shellcode would just move away from /bin/sh. Good thoughts, bad idea ;) Hope that helps, --hax On Thu, 8 Jul 2004 12:04:53 +0200, Matthias Benkmann <msbremove-this () winterdrache de> wrote:
I can't say I've looked at much exploit-code so far but the POC exploits to gain root I've seen for Linux all executed /bin/sh. I'd like to know if this is true for in-the-wild exploits to root a box, too. If so, would it be a useful security measure to rename /bin/sh and other shells (after making sure that everything that needs them has been updated to the new name, of course)? I'm aware that a dedicated attacker who targets my box specifically will not be stopped by this but I don't think I have such enemies. I also know that DOS is still possible, but that's also not my concern. I'm simply worried about script kiddies using standard exploits against random servers on the Internet rooting my box faster than I can patch it. If renaming the shell is not enough, how about renaming all of the standard Unix top-level directories (such as /bin, /etc,...)? Would that defeat standard exploits to root a box? MSB _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- No shell => secure? Matthias Benkmann (Jul 08)
- Re: No shell => secure? hax (Jul 08)
- Re: No shell => secure? npguy (Jul 09)
- Re: No shell => secure? Kevin Ponds (Jul 09)
- Re: No shell => secure? Matthias Benkmann (Jul 09)
- Re: No shell => secure? Ron DuFresne (Jul 09)
- Re: No shell => secure? Barry Fitzgerald (Jul 09)
- Re: No shell => secure? Vincent Archer (Jul 12)
- Re: No shell => secure? daniel uriah clemens (Jul 09)
- Re: No shell => secure? npguy (Jul 09)
- Re: No shell => secure? hax (Jul 08)
- Re: No shell => secure? Nick FitzGerald (Jul 09)
- Re: No shell => secure? Ron DuFresne (Jul 09)
- Re: No shell => secure? Valdis . Kletnieks (Jul 09)