Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

RE: No shell => secure?
From: "Deckard, Jason" <jdeckard () webmd net>
Date: Fri, 9 Jul 2004 05:31:52 -0700

It looks like you understand there are difficulties with doing something
like this and are really only interested in getting opinions on whether or
not it will stop canned exploit code.

Assuming a majority of shellcode calls /bin/sh or one of the other common
shells, I think your idea of renaming the shells will stop most standard
kiddie attacks.  It might be worthwhile to put something in place of /bin/sh
that will make a log entry when it is executed (time/date, uid, and
command-line arguments for example).  Download some exploit-code and test
your ideas on a test system.

Hax is right to call this security through obscurity.  If you go through
with this, it should only be a small part of a larger, comprehensive defense
strategy.

-----Original Message-----
From: full-disclosure-admin () lists netsys com
[mailto:full-disclosure-admin () lists netsys com] On Behalf Of Matthias
Benkmann
Sent: Thursday, July 08, 2004 5:05 AM
To: full-disclosure () lists netsys com
Subject: [Full-disclosure] No shell => secure?


I can't say I've looked at much exploit-code so far but the POC exploits to
gain root I've seen for Linux all executed /bin/sh. I'd like to know if this
is true for in-the-wild exploits to root a box, too. If so, would it be a
useful security measure to rename /bin/sh and other shells (after making
sure that everything that needs them has been updated to the new name, of
course)?

I'm aware that a dedicated attacker who targets my box specifically will not
be stopped by this but I don't think I have such enemies. I also know that
DOS is still possible, but that's also not my concern. I'm simply worried
about script kiddies using standard exploits against random servers on the
Internet rooting my box faster than I can patch it. 

If renaming the shell is not enough, how about renaming all of the standard
Unix top-level directories (such as /bin, /etc,...)? Would that defeat
standard exploits to root a box?

MSB

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]