Unix Trojan Horse Scanner program (Beta)

[barnett () alydar crd ge com (Bruce Barnett)]

In this discussion about Unix and security, I should mention that I
have developed a perl script that examines your searchpath and looks
for vunerabilities (i.e. ways someone may drop a trojan horse in)

That is, it examines each executable, and the group, world and owner
permissions of each file, each directory, each parent directory. It
also examines symbolic links.


Example, if you have /usr/local/bin in your searchpath, and
program abc is a symbolic link elsewhere, and
        /usr/local/bin/abc points to  /xyz/bin/abc
and
        /xyz/bin/abc points to /elsewhere/bin/abc


it examines the following directories for world, group and owner write 
permissions:

        /usr/local/bin
        /usr/local
        /usr
        /
        /xyz/bin
        /xyz
        /elsewhere/bin
        /elsewhere


The reports identifies the vunerability of a system, and measures 
the results.  Most UNIX systems do NOT score well. Does directory /usr/bin
really need to be writable by anyone in group "bin"?



If some of you are interested, I can send you the source. Be aware that it is
        a) Beta
        b) Perl
and
        c) I don't have much time for repairing bugs right now.

In other words, if you have a bug, you should be prepared to fix it yourself, 
and send me the patches.


It's low priority for me. I have to get ready for a paper I'm
presenting at InterOp. Also - this program is not currently supported
by any project. I don't have much free time to improve it.