full-disclosure - Re: mac trojan in-the-wild

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.NEB.4.64.0711012221090.24196@panix5.panix.com>
Date: Thu, 1 Nov 2007 22:29:14 -0400 (EDT)
From: Jay Sulzberger <jays@...ix.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: mac trojan in-the-wild



On Thu, 1 Nov 2007, Thor (Hammer of God) <thor@...merofgod.com> wrote:

> That's an interesting figure (86% that is).  Can you give us some
> insight into what you define as "user interaction"?
>
> If it is clicking a link or reading an HTML email, then OK.  If it is
> opening an .exe from an email, I'd like to see what client you are
> talking about and what environment (meaning, what OS/email client and
> what did they have to do to get it to run).  But specifically, how many
> were exploits where a user had to visit an untrusted site, download an
> executable, run it, and explicitly give it administrative credentials to
> run?  Not just people running as administrator, but typing in the admin
> account credentials to run it as administrator as one has to do on OSX?
> My guess (and I'd really like to see details on your findings) is that
> most "interactive" issues are the more "trivial" interactive issues
> (like clicking a link and launching a vulnerable version of IE).
>
> But more importantly, let's look at things from the other side.  Let's
> say I'm wrong, and that Gadi is right on target with his "hit hard"
> prediction and that we should be very concerned with this.  Given the
> requirements here, that again being flagrant ignorance where all the
> above steps are executed (including the explicit admin part)-- what
> exactly are we supposed to do?  If people are willing and able to go
> through the motions above what can we as security people do to prevent
> it?  Far too many people in this industry are far too quick to point out
> how desperate the situation is at all turns, but I don't see many people
> offering real solutions.  But you know, I have to say...  If we are
> really going to consider this "serious," and we are really going to
> define part of our jobs as being responsible for stopping people who
> have absolutely no concerns for what they do and are willing to enter
> their admin credentials into any box that asks for it, then I'd say that
> there is a *serious* misunderstanding about what security is, and what
> can be done about it-- either that, or I'm just in the wrong business.
>
> t

Put in a better system of permissions.  Use rolling backup.  Have
independent system activity watchers.  These measures are just
the first moves.

Unix was not designed to be resistant to one million hostile
actions per day by thousands of unknown attacking entities.  But
if you run standard Unix and you have a Net connection, that is
what your Unix instance is exposed to.

oo--JS.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/