full-disclosure - No shell => secure?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <F21C7C637A79E84783A75AE36EAFE3DE02F30722@zbnalpex002.na.webmd.net>
From: jdeckard at webmd.net (Deckard, Jason)
Subject: No shell => secure?

It looks like you understand there are difficulties with doing something
like this and are really only interested in getting opinions on whether or
not it will stop canned exploit code.

Assuming a majority of shellcode calls /bin/sh or one of the other common
shells, I think your idea of renaming the shells will stop most standard
kiddie attacks.  It might be worthwhile to put something in place of /bin/sh
that will make a log entry when it is executed (time/date, uid, and
command-line arguments for example).  Download some exploit-code and test
your ideas on a test system.

Hax is right to call this security through obscurity.  If you go through
with this, it should only be a small part of a larger, comprehensive defense
strategy.

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Matthias
Benkmann
Sent: Thursday, July 08, 2004 5:05 AM
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] No shell => secure?

I can't say I've looked at much exploit-code so far but the POC exploits to
gain root I've seen for Linux all executed /bin/sh. I'd like to know if this
is true for in-the-wild exploits to root a box, too. If so, would it be a
useful security measure to rename /bin/sh and other shells (after making
sure that everything that needs them has been updated to the new name, of
course)?

I'm aware that a dedicated attacker who targets my box specifically will not
be stopped by this but I don't think I have such enemies. I also know that
DOS is still possible, but that's also not my concern. I'm simply worried
about script kiddies using standard exploits against random servers on the
Internet rooting my box faster than I can patch it. 

If renaming the shell is not enough, how about renaming all of the standard
Unix top-level directories (such as /bin, /etc,...)? Would that defeat
standard exploits to root a box?

MSB

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html