Penetration Testing mailing list archives
Re: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME]
From: David Howe <DaveHowe.Pentest () googlemail com>
Date: Tue, 16 Sep 2008 09:44:41 +0100
Alexandru Bradescu-Popa wrote:
Interesting security procedures they have. Help-desk with access on /etc/shadows. No written request for high sensitive files. They'll pass with flying colors any security audit.
Helpdesk often has access to /etc/shadow - admittedly, this should be via privileged executables (passwd and adduser/rmuser etc with the suid bit set) but I imagine the number of sites where they couldn't be bothered to set up a second set of (set privileged) binaries for the helpdesk, per machine, and just gave them root, is quite high - but resetting user passwords is a common helpdesk function. I suspect that most don't know what /etc/shadow is, or why it should be kept secure - after all "passwords are in /etc/passwd, aren't they?" I would also suspect that a request for /etc/passwd would have met with more resistance, purely because of that :) ------------------------------------------------------------------------ This list is sponsored by: Cenzic Top 5 Common Mistakes in Securing Web Applications Get 45 Min Video and PPT Slides www.cenzic.com/landing/securityfocus/hackinar ------------------------------------------------------------------------
Current thread:
- RE: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME], (continued)
- RE: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME] Ashvin Oogorah (Sep 16)
- Questionable Security Policy [WAS: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME]] Veal, Richard (Sep 16)
- RE: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME] Hill, Pete (Sep 16)
- Re: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME] Tim March (Sep 16)
- Re: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME] Pablo Cardoso (Sep 16)
- RE: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME] Oftedahl, Douglas (Sep 16)
- Re: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME] Pete Herzog (Sep 16)
- RE: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME] Alexandru Bradescu-Popa (Sep 15)
- Re: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME] Michael Boman (Sep 15)
- RE: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME] Alexandru Bradescu-Popa (Sep 16)
- Re: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME] David Howe (Sep 16)
- Re: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME] Micheal Cottingham (Sep 15)
- Re: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME] Jorge L. Vazquez (Sep 15)
- Re: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME] M.B.Jr. (Sep 17)
- Re: EXAMPLE: Why OOO is *BAD* [WAS: Re: OOO FLAME] Adam Thompson (Sep 18)
- Message not available
- Re: OOO FLAME natron (Sep 17)