Sloppy File Permissions Make Red Star OS Vulnerable

An anonymous reader writes: Red Star OS Desktop 3.0, the official Linux distro of North Korea, which recently found its way onto torrents and various download sites in form of an ISO image, is interesting for a number of reasons, including its attempt to look like commercial operating systems (currently OS X, earlier versions mimicked the Windows GUI). Hackers are also poking Red Star for security vulnerabilities. An pseudonymous researcher noted in a post to the Open Source Software Security (oss-sec) mailing list, that the OS has one significant security hole: Red Star 3.0 ships with a world-writeable udev rule file /etc/udev/rules.d/85-hplj10xx.rules (originally designed for HP LaserJet 1000 series printers) which can be modified to include RUN+= arguments executing arbitrary commands as root by Udev. In the post he also mentions how the older Red Star 2.0 shipped with another schoolboy mistake: /etc/rc.d/rc.sysinit was world-writeable.

Comments

Good ol' 777

[MisterSquid]

Whenever I see devs take the stupid shortcut of "chmod 777" I wonder what is the brain drain for these "professionals" that they can't figure out how to enable make use of "chown root:admin" and then "chmod g+x", or whatever's the appropriate level of permissions for the task at hand.

How can developers be so lazy and so security naive? It's like using signal lights when driving. Just do it because it makes for good habits.

Re:Good ol' 777

[MisterSquid]

Unix doesn't help much. I mean if apache can't read /home/me/www/path/to/index.html the OS isn't going to tell you its because of the permissions on /home. Meanwhile you have given up and gone chmod -R 777 /

Actually, both the browser and the Apache log will tell you it's a permissions issue. Go to the root of /home and either add the Apache user to the group that has access to "/home/me/www/path/to/index.html" or change the group access to Apache's user.

Once the group is correct, change the permissions to g+r if necessary.

Taking the 15 seconds to properly set permissions when you know the issue is a permissions issue (otherwise why would chmod 777 fix the issue) really is just too easy not to do.

Also, use your signal lights!

Re:Good ol' 777

[MichaelSmith]

What I mean is that cat /home/me/www/path/to/index.html will say Permission denied but it won't say Permission denied reading /home/me

Re: Good ol' 777

[Megol]

Good thing you don't design user interfaces.

On the other hand, perhaps it was you who designed the Windows 8 metro UI? It would explain a lot...

Re:Good ol' 777

[Jeremi]

Because that would give information to a potential attacker! You don't make security problems easy to diagnose!

Security through obscurity, eh?

No thanks. Either the system is secure (even against an expert hacker), and therefore no security is lost by providing informative error messages.... or the system is insecure, in which case no security is gained by making the error messages hard to understand.

Deliberately obfuscating error messages only makes the system harder to use by its legitimate users (and therefore more likely to be bypassed in ways that compromise security) while doing nothing to keep hackers out.

Master plan

[lucm]

Awesome! At last a way to hack North Korea and steal all their... valuable things?