full-disclosure - !SPAM! Automated ssh scanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.GSO.4.43.0408261828500.13513-100000@parka.winternet.com>
From: dufresne at winternet.com (Ron DuFresne)
Subject: !SPAM! Automated ssh scanning

On Thu, 26 Aug 2004, Jan Luehr wrote:

> Greetings,
>
> Am Donnerstag, 26. August 2004 16:43 schrieb Ron DuFresne:
> > On Thu, 26 Aug 2004, Richard Verwayen wrote:
> > > On Thu, 2004-08-26 at 15:12, Todd Towles wrote:
> > > >  The kernel could be save. But with weak passwords, you are toast. Any
> > > > automated tool would test guest/guest.
> > >
> > > Hello Todd!
> > >
> > > You are right about the passwords, but guest is only a unprivileged
> > > account as you may have on many prodruction machines. But they managed
> > > to become root on this machine due to a kernel(?) exploit!
> > > Should I then consider any woody system to be insecure to let people
> > > work at?
> >
> > If your uasers are not trustable, then they should not have access to
> > local systems of yours.  Once a person has a shell, then they are 95% to
> > root.
>
> So your point is, there a much already known local root exploits on an
> standard woody system no one cares about?
>

I'm quite sure the debian folks as well as the other dist maintainers
would be as interested as the offending package maintainers in finding out
the what, where and how of the compromise, to mitigates its direct threats
in the future.  Will this make a fullblown installed *nix of any real
flavor secure from a similiar comprise hours, day or weeks in the future?
Highly unlikely.

No, my point is that it is much more likely there is a package installed
that was sploited.  If the system was as up to date and fully patched as
claimed, it's likely not a kernel sploit that got them root.

My point is this was a 'local user' compromise.  There are reasons that
many list 75% and more risk is done from the 'inside' then from remote
roots.

Folks do not seem to understand the implications of 'guest' accounts, or
handing out shells to every person they happen to chat with in IRC and
such.

Thanks,

Ron DuFresne
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
	***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.