Slashdot Mirror
BugTraq's Elias Levy Talks Security
LiquidPC writes: "UnderLinux.com.br has an
interview with the BugTraq moderator, Elias Levy or Aleph1. Questions ranging from what he thinks of 'Hacking Exposed' to whether BSD is more secure than Linux. Kind of short, but interesting nonetheless." He notes the interesting difference between the approaches to security taken by FreeBSD (which he praises) and Linux -- lots of projects vs. a single unified one, and emphasizes that security is ongoing, not defeating any single problem.
Um, just FYI, he said OpenBSD, not FreeBSD. I think most people would agree about the security of OpenBSD.
Geez.
And he doesn't really "praise" anything, although his comments are interesting.
It's very true, Anything can be secured including windows NT/200/xp/zp/ww3p it just takes more time and more money to do it than BSD or linux. but many companies take the stance of hiring a security consultant, get's an audit, fixes what's wrong and then believes that they've done what was needed and that they are secure now. They never think, or dont want to think that security is a moving target that requires full-time attention and trained people to take care of it. Send your IS/It staff to security training and seminars, keep the staff trained.
unfortunately in today's economic world, those programs and positions will be among the first to be cut by the CEO's.
Do not look at laser with remaining good eye.
From the article: While we can place great efforts into teaching people how to avoid buffer overflows in languages such as C it is likely they will introduce them into their programs anyway. It makes more sense from a security perspective to replace the language with one that makes buffer overflows difficult.
This is why you shouldn't use an MS designed languages like VB or C#.
Seriously, I understand what he's saying about C. It allows low level access to a computer's hardware, and can be easily broken at that low level... Thus the need for garbage collection and careful avoidance of Stack-overflow conditions.
On the other hand, we have Java, which trades convenience for security. Sure, it's easy to get started coding in Java, but heaven help you if you want to distribute a Java-based application to everyday (non-hacker) computer users. A webpage is the only medium in which Joe-sixpack is very likely to view any given Java application, giving full-scale Java applications a somewhat more limited potential user base.
Seriously, then, what is the best application and system language in terms of security, power, and convenience?
The next Slashdot story will be ready soon, but subscribers can beat the rush and slashdot the links early!
Anyone know if something like this might be possible or easy:?
Have a script that reads the Apache log in realtime. Whenever something gets cmd.exe or XXXX or NNNN or something like that, immediately block all communication with their IP with iptables?
This is getting annoying...
I just wonder what is different about the training of *nix admins that makes them recognize that vigilance must be eternal, while the admins of other OSes seem to assume everything will go right when that is clearly not the case.
Dave
Apparently Aleph1 never heard of lint, bounds checker, and the like. Changing languages to make your apps more secure just shows your not much of a programmer to begin with. The right tool for the right job. C is often the right tool. Whether you shoot yourself in the foot with a Smith & Wesson or C, don't complain about the quality of the gun. Next time, stop pointing at your foot and you will be fine.
I think Aleph1's approach is a bit more sound. Your approach preaches that all programmers should collectively change their [bad] programming habits and methods. While I agree with you that it's the "best" solution, I have to remind you and anyone else in your camp that it's also the least likely to occur.
IMO, improvements in gcc that help compensate for such buffer overflows (read: improvements in the compiler/language) would go a lot further in clearing up all of these problems.
Again, asking the world to change their methods is about as likely as asking the world to stop smoking cigarettes. The useless slobs ALREADY KNOW it's bad for them and all those around them. They simply do no care.
One of the most interesting reads I've ever come across was the PC Week crack. Just cool to see what he went through, his thoughts/ideas, and especially his thought process.
It was, at least about two years ago. We reported the problem to MS, so it may well be fixed by now. IIRC, by giving a long string to GetHostByName (e.g., working with an e-mail address like "Bob@NoneOfYourDaaaaaaaaaaaaa[lots more "a"s]aaaaamnBeeswax.edu"--I think this was the actual address that did it) you could make it go south for the winter. So far south under Win98 that your screen turned blue. Under NT it just got a belly ache.
It turned out to be a limit of 384 characters or so (don't depend on my memory at this level of detail--I don't), which was easy enough to check for, once we knew about it.
-- MarkusQ
they did the OpenBSD and shipped with everything turned off their users would scream
If they can't even start the web server service on the machine then perhaps they shouldn't be running a web server in the first place?
This is because a web server has to have access to sockets...or how would it communicate via a network? Of course, from what you say EROS has the capability to restrict access to communication facilities. Of coure, it is possible for a webserver to drop root priviliedges after binging to port 80. At this point it is restricted to accessing only those sockets which ALL applications/processes have access to. EROS may be able to go further and explicitly allow access to individual sockets, but that may be a disdavantage .
...).
.
You are missing the point. Sure there are tricks and trickery to make your webserver limit access to things, but there are fundumental problems in the *nix approach to such limitations:
A) You trust the webserver to correctly limit access (fail-open), whereas in EROS you only give the webserver the access it requires (a capability to the specific port/etc).
Even if the webserver is malicious, in EROS its not a problem.
EROS does NOT require a superuser or has such fail-open facility.
B) In *nix boxen, the restrictions are placed and implemented as a chains of if-conditionals (ACL-type security), which are very error-prone (as we all know by reading bugtraq) and very hard to debug, and about 15 if's in a chain are required if you want to get close to correspondence to the principle of least privelege. In EROS, keys identifying objects and the rights to access them are held by processes, and a single test is required for every activation of a facility (if(key-is-valid)
This is because a web server has to have access to sockets...or how would it communicate via a network? Of course, from what you say EROS has the capability to restrict access to communication facilities. Of coure, it is possible for a webserver to drop root priviliedges after binging to port 80. At this point it is restricted to accessing only those sockets which ALL applications/processes have access to. EROS may be able to go further and explicitly allow access to individual sockets, but that may be a disdavantage
In EROS/Vapour/pure cap. systems, each process has a pool of capabilities it can use. A capability is a reference to an object, that allows accessing this object. The only test for an operation's execution is that the capability to operate it is valid. This is very safe, and can be mathematically proven. Try to mathematically prove *nix boxen if-conditional chains.
And none of these systems are proven as the original AC commenter was trying to suggest. While some things are proveable secure (as in theory can show that it is secure e.g. some encryption algorithms), sometimes the IMPLEMENTATION is flawed. Now since these systems were written by people in academia and are not in widespread use, no one knows how well implemented they are, even if there are SECURE CONCEPTUALLY.
These systems are so much simpler, that implementing them correctly is much much easier.
Making flaws in the security implementation of capability protection is much more difficult than flaws in the if-chains of *nix, and even if the implementation is flawed, it shall be fixed in a constant amount of time, as the security system is of a small constant size (the code implementing capabilities, that is), whereas in *nix, security is an ever-lasting huge pile of code that grows with the rest of the code, with new if-chains written for every new piece of code.
One question I DO have is this: how does EROS have such fine grained control over EVERY SINGLE thing a process may do WITHOUT lots and lots of overhead? With thousands of processes in a system, ACLs could potentially grow to enormous sizes and incur long delays while verify that the process has access to certain priviledges. Nothing is for free. This is why the UNIX model is simplistic: because security cannot make the system unusable. If the system is too SLOW there is no point in having it at all. Getting rid of said system would be the ultimate security: nothing to break into...but would there be a point?
This is exactly what you're missing! EROS does NOT use ACL's. ACL's are what EROS is fighting against and trying to replace. EROS uses the capability model, which is of HIGHER performance, of mathamatically provable security, AND much more flexibility!
And what about systems more archaic like: OS/390, OS/400, VMS? Don't they have the same ACL stuff as EROS (wasn't EROS designed as an improvement with os/390 in mind)?
NO. Eros does NOT use ACL's. ACL's are the root of all security problems.
Instead, your script would have to be a module or proxy that filters all incoming requests. And stops them before the trouble.
-- these are only opinions and they might not be mine.
Win2k is not hard to secure; neither is any other MS system.
OK, I agree all you have to do is remove the modem, network card and keyboard. That is easy, cheap too!
Otherwise, MSJVM, VB and other trash that has full access to your file system as root will trash you. Duh. M$ designed their OS around marketing, so they can shove whatever software they want onto and extract whatever info they want from their users. This is not going to change, ever, and M$ will always be impossible to secure.
Friends don't help friends install M$ junk.
1) Microsoft could easily turn services off by default. No user needs a webserver unless they have content to serve. If they don't know where the content goes, they don't need the server. They could have put a 'Web Server' config pluggin in the control panel. People are capable to using the control panel (or the shortcuts) to change the screen background, or at least don't raise hell when they can't. They'd be able to turn on a webserver, or wouldn't realize that it was there...
2) MS's patches are often worse than the hole. Service pack 2(?) for NT was called the SP-of-death. SP6 rendered Lotus Notes unusable (maybe just the notes server...) No admin worth the title would blindly install MS patches without waiting a month or so to see if any problems were reported. Patches released as the result of an exploit are worse... MS code is unstable at best, when rushed, you're trusting your server to alpha-level code.
MS could learn a lot from IBM, or other mainframe makers, before trying to enter the server market. IBM had mainframes with decade-long uptimes, they didn't do that by rushing untested code onto client machines.
I really think someone needs to sue MS for incompotence. Some of their blunders are so bad it's amazing they went through testing. (I don't think MS should be ruined for it, but if they had to pay out anything in this kind of case, they might be more careful to avoid a larger settlement in the future.)
None of my machines have been infected. I follow standard, easy to find methods for securing my systems. Hmmm.....
Many, many people who run the OS have not done *anything, whatsoever* to secure their system out of the box. THey haven't even TRIED.
The presence of this worm is indicative of the average knowledge and aptitude of those running the infected systems... and NOT an indicator of the quality of the OS.
Oh.. I'll agree that it's easier to find information about how to secure unix systems... and the admin generally has a better knowledge of how a new application affects his security.. but in general, this is the case with windows too.
You got me there. I should clarify, for people like you, that we obviously aren't talking about MS DOS here. Or WinCE. I'd imagine you are just in a bad mood or something?
I'd think most readers would find it obvious what we were discussing. Apparently you need some assistance.
Win2k can't hide anything from the administrator if you set it correctly. Neither will it lie about file extensions if you set them correclty. Neither of those has anything to do with network security, either.
And when I say 'system'.. what the hell did you think I meant? I meant a system involving Microsoft products. You can quabble over the exact definition all you like. NT is a product, so is Windows 2000. NT is also a kernel. Linux is a kernel, and also a product. Blah blah blah..