full-disclosure - Re: AFS - The Ultimate Sulution?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 20 Sep 2006 13:32:48 +0200
From: "マグロ原子" <atoom.tonijn@...il.com>
To: "Paul Sebastian Ziegler" <psz@...erved.de>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: AFS - The Ultimate Sulution?

On 9/17/06, Paul Sebastian Ziegler <psz@...erved.de> wrote:
> Yes, it would still be possible to root the system, but how would that
> help to get another user?
> Even if the system is rooted you would only have access to your own
> files and could not even crack other user's pws since they aren't in
> your password-file.

Since every machine would run the same image, if your system is
rooted, all others could be.

> As you said this requires that the AFS-Server is being kept up to date.
> But the Images wouldn't have to be.

Yes they would.

> Of course somebody could be hardlogging on a workstation, but it
> wouldn't be possible to sniff pws from the kerberos-session due to
> encryption.

Again if the system is rooted, it's possible to install a modified
"loader", which loads a modified OS image, which can sniff passwords
and do everything else.

Nyoro~n

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/