Re: No shell => secure?

["Wall, Kevin" <Kevin.Wall () qwest com>]

Matthias Benkmann wrote...

> I can't say I've looked at much exploit-code so far but the POC exploits
> to gain root I've seen for Linux all executed /bin/sh. I'd like to know if
> this is true for in-the-wild exploits to root a box, too. If so, would it
> be a useful security measure to rename /bin/sh and other shells (after
> making sure that everything that needs them has been updated to the new
> name, of course)?

No; sometimes they use other shells, such as /bin/bash, /bin/ash,
/bin/zsh, etc. or else execute a single command at a time.

Also, presumably, you'd still have to set SHELL env variable, so
they could presumably just execute $SHELL in many cases.

Worst of all, you now have yourself a maintenance nightmare. Think
of how many shell scripts where you'd have to change the

    #!/bin/sh

to whatever full path name you've switched the shell to. And you'd have
to do this whenever you install a vendor update, an RPM, etc.

Yuck! No thanks!

> I'm aware that a dedicated attacker who targets my box specifically will
> not be stopped by this but I don't think I have such enemies. I also know
> that DOS is still possible, but that's also not my concern. I'm simply
> worried about script kiddies using standard exploits against random
> servers on the Internet rooting my box faster than I can patch it.

Well, it probably would stop the script kiddies--for awhile at least.
But see above.

Also, if you keep on top of patches, have appropriate firewall rules
and other access control mechanisms in place, script kiddies are
not all that hard to keep out.

> If renaming the shell is not enough, how about renaming all of the
> standard Unix top-level directories (such as /bin, /etc,...)? Would that
> defeat standard exploits to root a box?

Man, that would REALLY become a maintenance nightmare. You'd have to
customize almost all RPMs, vendor patches, etc. before installing
them.
---
-kevin wall
Qwest IT - Application Security Team
"The reason you have people breaking into your software all 
over the place is because your software sucks..."
 -- Former whitehouse cybersecurity advisor, Richard Clarke,
    at eWeek Security Summit

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html