Full Disclosure mailing list archives
RE: No shell => secure?
From: "Deckard, Jason" <jdeckard () webmd net>
Date: Fri, 9 Jul 2004 05:31:52 -0700
It looks like you understand there are difficulties with doing something like this and are really only interested in getting opinions on whether or not it will stop canned exploit code. Assuming a majority of shellcode calls /bin/sh or one of the other common shells, I think your idea of renaming the shells will stop most standard kiddie attacks. It might be worthwhile to put something in place of /bin/sh that will make a log entry when it is executed (time/date, uid, and command-line arguments for example). Download some exploit-code and test your ideas on a test system. Hax is right to call this security through obscurity. If you go through with this, it should only be a small part of a larger, comprehensive defense strategy. -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] On Behalf Of Matthias Benkmann Sent: Thursday, July 08, 2004 5:05 AM To: full-disclosure () lists netsys com Subject: [Full-disclosure] No shell => secure? I can't say I've looked at much exploit-code so far but the POC exploits to gain root I've seen for Linux all executed /bin/sh. I'd like to know if this is true for in-the-wild exploits to root a box, too. If so, would it be a useful security measure to rename /bin/sh and other shells (after making sure that everything that needs them has been updated to the new name, of course)? I'm aware that a dedicated attacker who targets my box specifically will not be stopped by this but I don't think I have such enemies. I also know that DOS is still possible, but that's also not my concern. I'm simply worried about script kiddies using standard exploits against random servers on the Internet rooting my box faster than I can patch it. If renaming the shell is not enough, how about renaming all of the standard Unix top-level directories (such as /bin, /etc,...)? Would that defeat standard exploits to root a box? MSB _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: No shell => secure?, (continued)
- Re: No shell => secure? Matthias Benkmann (Jul 09)
- Re: No shell => secure? Valdis . Kletnieks (Jul 09)
- Re: No shell => secure? hax (Jul 09)
- Re: No shell => secure? st3ng4h (Jul 09)
- Re: No shell => secure? hax (Jul 09)
- Re: No shell => secure? Matthias Benkmann (Jul 09)
- Re: No shell => secure? Kurt Seifried (Jul 09)
- Re: No shell => secure? Seth Alan Woolley (Jul 12)
- Re: No shell => secure? Wall, Kevin (Jul 09)
- Re: No shell => secure? Martin Fallon (Jul 09)
- RE: No shell => secure? Deckard, Jason (Jul 09)
- Re: No shell => secure? John Creegan (Jul 12)
- Re: No shell => secure? Matthias Benkmann (Jul 09)