Slashdot Mirror
BugTraq's Elias Levy Talks Security
LiquidPC writes: "UnderLinux.com.br has an
interview with the BugTraq moderator, Elias Levy or Aleph1. Questions ranging from what he thinks of 'Hacking Exposed' to whether BSD is more secure than Linux. Kind of short, but interesting nonetheless." He notes the interesting difference between the approaches to security taken by FreeBSD (which he praises) and Linux -- lots of projects vs. a single unified one, and emphasizes that security is ongoing, not defeating any single problem.
Um, just FYI, he said OpenBSD, not FreeBSD. I think most people would agree about the security of OpenBSD.
Geez.
And he doesn't really "praise" anything, although his comments are interesting.
It's very true, Anything can be secured including windows NT/200/xp/zp/ww3p it just takes more time and more money to do it than BSD or linux. but many companies take the stance of hiring a security consultant, get's an audit, fixes what's wrong and then believes that they've done what was needed and that they are secure now. They never think, or dont want to think that security is a moving target that requires full-time attention and trained people to take care of it. Send your IS/It staff to security training and seminars, keep the staff trained.
unfortunately in today's economic world, those programs and positions will be among the first to be cut by the CEO's.
Do not look at laser with remaining good eye.
From the article: While we can place great efforts into teaching people how to avoid buffer overflows in languages such as C it is likely they will introduce them into their programs anyway. It makes more sense from a security perspective to replace the language with one that makes buffer overflows difficult.
This is why you shouldn't use an MS designed languages like VB or C#.
Seriously, I understand what he's saying about C. It allows low level access to a computer's hardware, and can be easily broken at that low level... Thus the need for garbage collection and careful avoidance of Stack-overflow conditions.
On the other hand, we have Java, which trades convenience for security. Sure, it's easy to get started coding in Java, but heaven help you if you want to distribute a Java-based application to everyday (non-hacker) computer users. A webpage is the only medium in which Joe-sixpack is very likely to view any given Java application, giving full-scale Java applications a somewhat more limited potential user base.
Seriously, then, what is the best application and system language in terms of security, power, and convenience?
The next Slashdot story will be ready soon, but subscribers can beat the rush and slashdot the links early!
We as linux/unix/bsd users need to come together and stop blaming security hole on the operating system. While some OSes come more secure out of the box, virtually any OS out there can be made secure with some time and effort. it's not the OS, it's the sysadmin who runs the machine. Corporate America needs to provide admins time and money to cover these bases, rather than just putting it on the 'todo' list, it needs to be made a priority.
Moon Macrosystems. Sun's biggest competitor.
Elias Levy, or Aleph1 is the bugtraq moderator one of the most important security mailing list of the world.
UnderLinux : In a general focus what is more secure Gnu/Linux or OpenBSD ? Or other OS ?
Aleph1 : That is a pointless question without some context. For example, certainly the OpenBSD folks have done an incredible job creating a secure and stable operating system - an effort that should be emulated by others - but the application you are looking to run many not be supported under it. The most secure OS depends on your requirements.
Even with OpenBSD's success the UNIX security model is very simplistic. You can certainly write secure applications - see qmail and postfix for examples - but they require a lot of effort. Linux is interesting because the are so many groups exploring alternative security models: privileges, acls, subdomain, SELinux, etc.
UnderLinux Team.
NT had potential. It has an interesting security model, but the legacy code, insecure defaults, complexity, and lack of security savvy by application programmers used to the Windows and DOS world have left it with a rather bad track record.
You must also take into account how well the people administrating the system knows the technology. You can have the most secure OS but if its misconfigured it will be useless. Conversely, a good admin is capable to hardening a sloppy OS.
UnderLinux: One time surfing on the web I see this phrase : "Wanna defeat hackers..think like a hacker.. work like a security expert". What you think about this ?
Aleph1 : A cliche, but a valid one. When creating defensive security technologies you must test them by attempting to defeat them before others do. Therefore you do not only require a defensive mindset but also an offensive one. Not only that but you must be better and more through than the ones you are defensing from. As a defender you must find and fix all possible avenues of attack. As an attacker you must only find and exploit one.
UnderLinux: Can you tell us something about the book Hackers Exposed ?
Aleph1 : I believe you mean Hacking Exposed. Its a good book. I recommend it. It does a good job at describing the methodology of penetrations. Its a technical book that shows you how to use the tools available for the job. Sadly this means that is likely to become outdated after a while. Luckily the publisher seems to be doing a good job at keeping it up to date. A second edition is out. Nonetheless, the basic techniques it teaches are independent of specific technologies.
UnderLinux : Nowadays what kind of documents and programs cause you more expectative and interest ?
Aleph1:Those that make it difficult for people to shoot themselves in the foot. Security today is to fragile. Take for example buffer overflows. While we can place great efforts into teaching people how to avoid buffer overflows in languages such as C it is likely they will introduce them into their programs anyway. It makes more sense from a security perspective to replace the language with one that makes buffer overflows difficult.
Similarly I am interested in areas that help you encapsulate knowledge about computer security and help users do the right thing instead of letting them guess what is the right thing. For example, configuring a firewall correctly can be quite complicated and the are many nuances. We need to make it easier for folks to configure securely.
UnderLinux: Do you think that problems like spoofing and DDoS will be defeat in the next 10 years ? Can you preview any solution for this problems ?
Aleph1:I believe we'll find and deploy ways to mitigate them but not to do away with them. Denials of service and inherent in any finite system. The Internet architecture has made them even easier by its lack of authentication and resource allocation. In the future we'll have mechanism that make detecting and tracking network based denials of service easier. It's likely that some areas of the Internet will support resource allocation which will minimize some of the DoS effects.
UnderLinux : What suggestions you can give to whom that wanna be a security expert ?
Aleph1:Do a broad survey of the security landscape. They are many areas of interest out there. After you've gained a general understanding of the security world select an area you'd like to specialize in. Repeat ad infinitum. Bonus point of standing back after a while and trying to find ways to fit all the pieces together into a coherent and interoperable whole.
Seen any BadMarketing lately?
FreeBSD is not even mentioned by name in the interview....
Nope. You are incorrect.
Healthcare article at Kuro5hin
Anyone know if something like this might be possible or easy:?
Have a script that reads the Apache log in realtime. Whenever something gets cmd.exe or XXXX or NNNN or something like that, immediately block all communication with their IP with iptables?
This is getting annoying...
http://www.antioffline.com/ has interviews with the following. not as serious in nature, but funny and interesting if you're in the security industry.
Attrition
Dugsong
Ghetto Hackers
Hackweiser
K2
Lance Spitnzer
Mixter
Obecian
Rain Forest Puppy
ShadowVX
s0ft Project
Technotronic
w00w00
-- ken williams
Using UNIX for a desktop is a fricken moronic idea.
I've heard this before and really don't understand it, so I'll take this opportunity to maybe get some clarification.
Maybe it comes down to the definition of desktop... I'm not sure, but I use SCO Unix at work (on my desktop, not on the floor) and a Unix like OS at home (linux), also on my desktop. I've tried using Windows(R)(TM)(C)(!GNU) many times but I always end up frustrated. Surely an OS should be chosen with what you want to do with it in mind, rather than a definition like desktop OS, whether it's on your desk or your fridge or on the floor, or in your ceiling... makes no difference.
and emphasizes that security is ongoing, not defeating any single problem.
I agree this is true on *nix/Windows-like systems. But what about a system where every piece of code runs with a simple environment allowing it only the minimal privelege it needs? (EROS)
What about a system that extends this idea further, and makes sure that all code is compiled from a safe language? A system with no buffer overflows or pointer errors/overruns? (Vapour)
I believe that a system like EROS would make actual breakins/control of a distant computer practically impossible.
I believe that a system like Vapour would make ANY remote malicious operation practically impossible, if implemented right.
Note that if you break into an EROS system's web server and even if you get some of your code to run on the remote host - the worst you can do is read HTML's and distribute content on port 80 (or whatever ports the server had access to), but nothing else.
You can't really get any mailicious code to remotely run on a Vapour system at all.
True Security IS defeating a single problem - that problem is the *nix fail-open design, and the lack of principle of least privelege. (In terms of security, Windows is a very similar design, both using ACL-type security, of attaching lists of "user"-based access to objects).
Apparently Aleph1 never heard of lint, bounds checker, and the like. Changing languages to make your apps more secure just shows your not much of a programmer to begin with. The right tool for the right job. C is often the right tool. Whether you shoot yourself in the foot with a Smith & Wesson or C, don't complain about the quality of the gun. Next time, stop pointing at your foot and you will be fine.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
I just wonder what is different about the training of *nix admins that makes them recognize that vigilance must be eternal, while the admins of other OSes seem to assume everything will go right when that is clearly not the case.
Dave
Is that Hebrew for "steak sauce"?
--
As a matter of fact, I am a lawyer. But I play an actor on TV.
From H.P. Lovecraft's "The Case of Charles Dexter Ward":
Eliphas Levi? Elias Levy? The name is just too similar, sounds like someone who came back from Beyond ye Spheres as his own grandson or something. I bet this Levy guy is over 300 years old.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
...what mailing lists would you recommend?
There aren't exactly any corporate-agnostic mailing lists out there with quite the distribution of Bugtraq. From my posts to Bugtraq (granted, nothing to do with any "powerful, monied" companies' software), there was a minimal lag-time.
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
This is because a web server has to have access to sockets...or how would it communicate via a network? Of course, from what you say EROS has the capability to restrict access to communication facilities. Of coure, it is possible for a webserver to drop root priviliedges after binging to port 80. At this point it is restricted to accessing only those sockets which ALL applications/processes have access to. EROS may be able to go further and explicitly allow access to individual sockets, but that may be a disdavantage .
Can you say CGI? It allows a web server to serve up something other than static content. All of those "security holes" are basically mandatory for CGI. Of course, EROS can probably limit file access and IPC facilities on a process by process basis. However, by running a websrever as a non-root user/group and setting permissions properly, you can prevent a lot of file system access. As far as limiting IPC, only processes which want to communicate would allow communication (or they would be able to communicate) and the same permissions restrictions apply.
Only are uninformed on how to secure the system, be it windows or unix. The problem is not with the systems 90% of the time, but the administrators of said systems.
I have been working on "play hacking" at www.hackerslab.org and the latest challenge is to exploit a buffer overflow. As far as I can gather this involves "stack smashing": overwriting the stack with executable code and having the code jumped to to give something like a root shell for example. An easy solution to this is to make the stack (and all other data segments in a process) non-executable and make code segments read-only (non-modifiable). Some systems HAVE taken such measures and I think one MAY be Solaris. The paper I read states up front that it won't work on all systems, so I expect that there is a unix variant out there that buffer overflows won't work on to gain access and/or execute arbitrary code. No need for Vapour (thats also a good pun). However, those capabilities are great for programmers too lazy/busy to think about buffer overflows when writing their code.
And none of these systems are proven as the original AC commenter was trying to suggest. While some things are proveable secure (as in theory can show that it is secure e.g. some encryption algorithms), sometimes the IMPLEMENTATION is flawed. Now since these systems were written by people in academia and are not in widespread use, no one knows how well implemented they are, even if there are SECURE CONCEPTUALLY.
One question I DO have is this: how does EROS have such fine grained control over EVERY SINGLE thing a process may do WITHOUT lots and lots of overhead? With thousands of processes in a system, ACLs could potentially grow to enormous sizes and incur long delays while verify that the process has access to certain priviledges. Nothing is for free. This is why the UNIX model is simplistic: because security cannot make the system unusable. If the system is too SLOW there is no point in having it at all. Getting rid of said system would be the ultimate security: nothing to break into...but would there be a point?
And what about systems more archaic like: OS/390, OS/400, VMS? Don't they have the same ACL stuff as EROS (wasn't EROS designed as an improvement with os/390 in mind)?
One of the most interesting reads I've ever come across was the PC Week crack. Just cool to see what he went through, his thoughts/ideas, and especially his thought process.
1) Microsoft shipped their OS in a reasonably secure-by-default configuration. Now, I realize that if they did the OpenBSD and shipped with everything turned off their users would scream, but the reality is that MS has enabled a lot of things that the average user really doesn't need.
2) People actually patch their systems regularly. People go to gas stations and pump their own gas (well in most areas of the world), and it really isn't that much more difficult to install security patches. Just go to the MS web site, download, and install. Honestly, part of me feels that people should have to get a computer license to connect a computer on the public Internet, just like driving a car on public streets.
I'll be the first to admit, that neither of these are going to completely solve for the problem, but either would definately make a rather dramatic impact to these sorta things.
Well, I'm the unfortunate user of earthlink [I don't pay for the service, my roomate does, so I don't complain too much]. Here's my situation, which in a way doesn't allow me to do start blocking with iptables. I get a new IP every 12 hours or so, and majority of the infected machines are on earthlink/mindspring's networks. Blocking that would mean I could run into the possibility of blocking an IP which I could get assigned next, or my other machines were supposed to get. Yes, I could flush the iptables everytime I loose an IP, but wouldn't that be a bit pointless?
--- d'oh
Anyone know of a site listing the various linux distro's default settings from a typical install? You know the install I mean, the one performed by newbies that lets inetd fire off multiple servers for no good reason. It should be an interesting comparison, maybe even worthwhile if it is up to date and accurate. I think that would actually be a decision point for newbies who look before they leap, they certainly do not need to run a ton of servers that they do not understand.
Wanna get high?
It was, at least about two years ago. We reported the problem to MS, so it may well be fixed by now. IIRC, by giving a long string to GetHostByName (e.g., working with an e-mail address like "Bob@NoneOfYourDaaaaaaaaaaaaa[lots more "a"s]aaaaamnBeeswax.edu"--I think this was the actual address that did it) you could make it go south for the winter. So far south under Win98 that your screen turned blue. Under NT it just got a belly ache.
It turned out to be a limit of 384 characters or so (don't depend on my memory at this level of detail--I don't), which was easy enough to check for, once we knew about it.
-- MarkusQ
I found his replies a bit contardictory:
"Conversely, a good admin is capable to hardening a sloppy OS."
while
"...we can place great efforts into teaching people how to avoid buffer overflows in languages such as C it is likely they
will introduce them into their programs" anyway.
Instead, your script would have to be a module or proxy that filters all incoming requests. And stops them before the trouble.
-- these are only opinions and they might not be mine.
Win2k is not hard to secure; neither is any other MS system.
OK, I agree all you have to do is remove the modem, network card and keyboard. That is easy, cheap too!
Otherwise, MSJVM, VB and other trash that has full access to your file system as root will trash you. Duh. M$ designed their OS around marketing, so they can shove whatever software they want onto and extract whatever info they want from their users. This is not going to change, ever, and M$ will always be impossible to secure.
Friends don't help friends install M$ junk.
This guy is a fucking retard.
None of my machines have been infected. I follow standard, easy to find methods for securing my systems. Hmmm.....
Many, many people who run the OS have not done *anything, whatsoever* to secure their system out of the box. THey haven't even TRIED.
The presence of this worm is indicative of the average knowledge and aptitude of those running the infected systems... and NOT an indicator of the quality of the OS.
Oh.. I'll agree that it's easier to find information about how to secure unix systems... and the admin generally has a better knowledge of how a new application affects his security.. but in general, this is the case with windows too.
You got me there. I should clarify, for people like you, that we obviously aren't talking about MS DOS here. Or WinCE. I'd imagine you are just in a bad mood or something?
I'd think most readers would find it obvious what we were discussing. Apparently you need some assistance.
Win2k can't hide anything from the administrator if you set it correctly. Neither will it lie about file extensions if you set them correclty. Neither of those has anything to do with network security, either.
And when I say 'system'.. what the hell did you think I meant? I meant a system involving Microsoft products. You can quabble over the exact definition all you like. NT is a product, so is Windows 2000. NT is also a kernel. Linux is a kernel, and also a product. Blah blah blah..
You said, "Win2k is not hard to secure; neither is any other MS system." What you apparently meant was "Win2k is not hard to secure; neither is Windows NT."
The first statement is way too broad for any sane person to make, so I went on a sarcastic rant to show how silly it was.
And in my opinion, an operating system should never hide anything from the administrator, if the administrator tries to see it. I recently tried to determine what was taking up so much space on a Windows 2000 server. I had to resort to an alternative program, because Windows Explorer hid the Exchange subdirectory from me completely.
I also understand that there are some file extensions that are hidden unless you edit the registry. That's just wrong.