Slashdot Mirror

← Back to Stories (view on slashdot.org)

Cambridge Researcher Breaks OpenBSD Systrace

Posted by kdawson on from the without-a-trace dept.

An anonymous reader writes "University of Cambridge researcher Robert Watson has published a paper at the First USENIX Workshop On Offensive Technology in which he describes serious vulnerabilities in OpenBSD's Systrace, Sudo, Sysjail, the TIS GSWTK framework, and CerbNG. The technique is also effective against many commercially available anti-virus systems. His slides include sample exploit code that bypasses access control, virtualization, and intrusion detection in under 20 lines of C code consisting solely of memcpy() and fork(). Sysjail has now withdrawn their software, recommending against any use, and NetBSD has disabled Systrace by default in their upcoming release."

12 of 194 comments (clear)

  1. SELinux and the same ... by Gopal.V · · Score: 5, Informative

    James Morris has put up an analysis of the same vulnerabilities.

    And pushing the system code down into lower echelons of execution (i.e kernel), the way SELinux does it, is a valid fix.

    --
    Quidquid latine dictum sit, altum videtur
    1. Re:SELinux and the same ... by afidel · · Score: 5, Insightful

      I wonder what the performance penalty would be for thunking to kernel space would on every such operation would be? If it was well implemented I would guess it would be minimal since you could just pass the call off to the called kernel object directly. I also wonder what if any security vulnerabilities would be exposed by moving that extra code in kernel space. I know for the TrustedBSD tools it would be minimal due to their strict code checking policies, but for other systems having this much extra code in kernel space might be a risk.

      --
      There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
  2. No need for alarm! by Antarius · · Score: 5, Funny

    The tremors that you are feeling are from the sounds of the collective users of OpenBSD all simultaneously shouting "Fuck!" in exasperation.

    1. Re:No need for alarm! by nateb · · Score: 5, Funny
      The tremors that you are feeling are from the sounds of the collective users of OpenBSD all simultaneously shouting "Fuck!" in exasperation.

      All twelve of them. :)

      I like the thought of openbsd, though, having never used it. I'm sure everything will be fine.

      --
      -- Nate
    2. Re:No need for alarm! by peacefinder · · Score: 5, Funny

      All twelve of them. :)

      We yell really loud.

      (And I actually yelled "Wow!". We're not a homogenous lot.)

      --
      With reasonable men I will reason; with humane men I will plead; but to tyrants I will give no quarter. -- William Lloyd
  3. Re:so much for... by MrNaz · · Score: 5, Funny

    Why didn't you just say "I'm scared." ?

    --
    I hate printers.
  4. No released version of sudo affected by millert · · Score: 5, Informative

    The sudo systrace support is part of an experimental feature ("monitor mode") not present in any of the real sudo releases (though the code is available via anonymous cvs). Given the deficiencies of systrace (and ptrace) it is unlikely that this feature will be present in any future sudo release.

      - todd

  5. Brace for impact... by Mattintosh · · Score: 5, Funny

    Theo DeRaadt goes on a rampage in 5... 4... 3... 2...

  6. Re:I'm not worried by eno2001 · · Score: 5, Funny

    You know the old saying... "you get what you stay for". As long as you're logging in as root you will damage your system. It's a known fact. Anyone who logs in as root eventually dostoyevsky's their system. Logging in as root is dangerous. Even using 'su -' is dangerous. 'sudo' provides some level of security and accountability but even that is dangerous. I can't tell you how many times I've seen people type 'sudo bash' and then tool around doing everything as root all the time. The only way to really be safe is to never use any super user abilities whatsoever. The way I've handled it is that any time I run into something that I need root access for, I just give up. So I don't have any new users other than the ones I originally set up when I installed Ubuntu. I also don't have any access to the CD-RW drive built into the system, but that's OK since I'm not an illegal music and software pirate (only pirates use CD-R/CD-RW). I can't use the attached scanner that once worked in Windows 98 but that's OK since there is no need to scan photos or anything in Linux since there are no apps with which to work on them anyway. Whenever the system pops up asking me for the root password I just cancel out and stick with whatever settings the system had. Basically for me, a request for the root password is a threat to the security of my PC, myself and possible the nation or even global security. So in short DO NOT EVER USE root access of ANY kind. It's very dangerous and best left to the experts (bearded and bald scientists in dusty university halls).

    --
    -"...bad old ideas look confusingly fresh when they are packaged as technology" - Jaron Lanier (Digital Maoism on Edge.o
  7. Re:no by Steve+Baker · · Score: 5, Funny

    Exactly, why would anyone want to put a computer on the internet? That's just stupid!

  8. Re:so much for... by EvanED · · Score: 5, Funny

    On my list of the 10 best OSS projects, OpenBSD is in the top 5.

    In other words... it's in your list of the 5 best OSS projects.

    (sorry)

  9. OpenBSD's man page for systrace mentions this? by cgdae · · Score: 5, Informative

    OpenBSD's systrace manpage appears to mention this problem in the BUGS section:

    Applications that use clone()-like system calls to share the complete address space between processes may be able to replace system call arguments after they have been evaluated by systrace and escape policy enforcement.

    Or see http://www.openbsd.org/cgi-bin/man.cgi?query=systr ace&apropos=0&sektion=0&manpath=OpenBSD+Current&ar ch=i386&format=html

    --
    http://op59.net/