Linked by Alcibiades on Wed 4th Jan 2006 18:04 UTC
Windows Like a lot of people who have worked in the business, I find myself in conversations about computer security with people who are having problems or know people who have problems. I wrote this to save me from explaining the same thing over and over again to different people, and to save them the trouble of having to make notes as we talked. It was meant to be something you could give to a 'naive user' and have them be able to read and follow it more or less unaided, and while not being a complete guide, at least be something that made them more secure than before they got it.
Thread beginning with comment 82167
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[4]: Zonealarm
by yawntoo on Thu 5th Jan 2006 19:29 UTC in reply to "RE[3]: Zonealarm"
yawntoo
Member since:
2006-01-04

Windows 9x IIRC had 2Gig of memory space for each user process, and a shared 2Gig space for the system. This is all you would need.

3.x was even weaker.

Protected memory on windows became possible with the i386. This is because the processor had built in components to tie to a VMM.

With Unix, I wouldn't worry about forcing another process to load a shared library. That is just a means to an end. The real goal is to get another process to execute your code. As I said, I haven't really looked into this, but I suspect that one could use the proc filesystem to adjust the memory contents of another process owned by the same user. That could get your executable code into the other process... The trick then is to convice that process to execute it. I'm not sure if there is a way to create a thread in another process on Unix (the way you can on Windows).

If I were to attack a Unix like OS, or Mac OS, I would start by looking for exploits that allow me an elevation in privilage. From there I could load a kernel module and be able to do what ever I want.

The short story here is that _every_ OS is vulnerable to exploits of some sort. CERT has many for MacOS as well as Linux. The trick is to be consious of the risks and to act in a manner that protects you from harm. I would be concened if I had a Mac or Linux user on my network who felt so secure in thier OS that they started doing risky things (like executing random downloads, visiting questionable sites, etc...). Everyone, regardless of their OS, needs to be wary in thier computing practices.

Reply Parent Score: 1

RE[5]: Zonealarm
by ma_d on Thu 5th Jan 2006 20:38 in reply to "RE[4]: Zonealarm"
ma_d Member since:
2005-06-29

-r--r--r-- 1 root root 0 2006-01-05 14:31 maps

I don't think you can manipulate things via the proc filesystem.

Even things which have permissions that look readable and writable I can't even read:
lrwxrwxrwx 1 root root 0 2006-01-05 14:31 exe
[chris@rachelanne 3692]$ file exe
exe: unreadable symlink `exe' (Permission denied)


I think there's a big difference between vulnerabilities from problems in your code and vulnerabilities you designed into the system and documented...

Again, I'm very understanding of exploits. It's unfixed design flaws that bug me.

Reply Parent Score: 1