Linux Unhackable At TippingPoint Contest (eFluxMedia) [LWN.net]

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Mar 31, 2008 15:58 UTC (Mon) by drag (subscriber, #31333) [Link]

Maybe. 

Flash for Linux uses different sorts of things for media playback and such. (ie Alsa support)
so it could or could not work depending on what part of the flash plugin was hacked.

For all we know it could be something to execute a javascript command and run a exploit on IE,
like people have been able to trick Firefox into doing in the past.

but ya certainly likely that nothing inherent in Linux would save us from some proprietary
browser plugin eating our home directories or whatnot.

Flashblock installed by default seems like a cool idea at this point.


It's worth keeping in mind that on both cases, the Vista hack and the OS X hack, both were
taken down with very proprietary multi-media oriented applications that are very high profile
items for their respective companies:

Quicktime from Apple
Flash from Adobe.

Might only PWN a user account, though

Posted Mar 31, 2008 20:44 UTC (Mon) by AnswerGuy (subscriber, #1256) [Link]


 Even if the Ubuntu Flash plugin was vulnerable to a nearly identical
 exploit; we don't know if there was another readily available privilege
 elevation exploit to go from PWN-ing the user to PWN-ing the whole
 box.

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Mar 31, 2008 21:42 UTC (Mon) by eru (subscriber, #2753) [Link]

but ya certainly likely that nothing inherent in Linux would save us from some proprietary browser plugin eating our home directories or whatnot.

You know, I have long wondered if it would be practical to sandbox those plugins into a virtual machine. Of course they all try being sandboxes unto interpreted code themselves, but they often have flaws. Putting the plugin itself into a virtual machine instance (built for the purpose and torn down after the plugin exits) would erect another wall around it. I'm pretty sure this is doable, but whether the performance would suffer too much is another question.

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Mar 31, 2008 22:14 UTC (Mon) by nix (subscriber, #2304) [Link]

Yeah. It's called a JVM.

What you get then is security holes in the JVM.

(They're still turning up, after fifteen years... I suspect anything 
complex enough and with enough interfaces to the outside world to run a 
useful plugin on top of will be complex enough to have a never-ending 
supply of increasingly baroque security holes.)

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Apr 2, 2008 10:57 UTC (Wed) by dvdeug (subscriber, #10998) [Link]

No machine is unhackable once you're sitting at the controls and the hacker has a gun to your
head. The name of the game is never impossibility, it's making it sufficiently difficult that
they give up. If the VM adds an additional layer, that can be a good thing (if it's worth the
cost) without being perfectly free of bugs, so long as those bugs are fixed promptly.

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Mar 31, 2008 23:25 UTC (Mon) by ianburrell (subscriber, #47313) [Link]

A virtual machine isn't necessary.  SELinux can confine processes and only allow them do
things that are specified by the policy.  People are working on policies for browsers but it
is hard because users want browsers to support downloads and uploads.  Plugins would need to
be run in a separate process to be more limited than the browser.  This could be done with
nspluginwrapper.  Some plugins, like Flash, will need access to the network.  Some might need
access to files but probably could be limited to a single directory.  In any case, they could
be prevented from accessing arbitrary user or system files.

X would still be vulnerable to attack since plugins talk to the X server.  There has been some
work on adding SELinux to X.

The Linux kernel can also be vulnerable to root escalation exploits.  Some can be done before
the SELinux hooks or with calls that aren't checked because they aren't normally a security
problem.

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Mar 31, 2008 23:36 UTC (Mon) by zlynx (subscriber, #2285) [Link]

Yeah, SELinux can do it, or a set of alternate user accounts and sudo. On a laptop system,
something like "sudo webuser firefox" can go a long way toward enhancing your browsing
security without getting into anything too complicated.

A virtual machine is overkill.  I also find it a bit funny.  After all, virtual memory and
process isolation was supposed to protect us from all the same problems virtual machines are
supposed to save us from now.  All our current security issues are caused in the name of
convenience, and now in virtualization VMware is already getting into security problems in the
name of convenience (all their cut&paste and remote control options?  potential security
holes).

Intra-application security models

Posted Apr 1, 2008 9:25 UTC (Tue) by skitching (subscriber, #36856) [Link]

Interestingly, Java's security model means that different pieces of code within the same
process can have different security policies. This is possible because instructions in JVM
bytecode do not just address random bits of memory; they are constrained to access only valid
objects. And a code verifier runs at load-time to ensure that they do so.

So a browser implemented in java can apply a different security policy to plugins than to the
IO code that interacts with remote webservers. 

Other languages can do this too; Microsoft's research OS "Singularity" applies a similar
approach, allowing user code to run with the same privileges as kernel code - but the code
must be written in a special "verifiable" language.

Having only per-process security and then using multiple cooperating processes is an
alternative, but has some major impacts on performance and developer convenience.

I don't know why people are so harsh about Java and similar languages. There really are some
nice features available when using a "constrained" language. Ok, it's possible for the VM to
have a security bug; anything can have a bug (splice, anyone?). But I personally don't
remember a major one for a long time in the Java VM.

Intra-application security models

Posted Apr 1, 2008 18:56 UTC (Tue) by nix (subscriber, #2304) [Link]

The verifier has had bugs with security implications, I know that. 
(Whether anyone ever *exploited* these bugs is a different question.)

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Apr 1, 2008 10:40 UTC (Tue) by epa (subscriber, #39769) [Link]

A Linux process already runs in a virtual machine: it sees a virtual address space, a
virtualized processor and no direct hardware access.  The problem is not lack of
virtualization, but too much permissions given to the process running in the virtual machine.
Browser plugins could be run in a sandbox giving them no access to the filesystem and only
limited network access.  I suppose setting up a VMWare instance, etc. is one convenient way to
get this, but it seems like unnecessary extra layering when SELinux, chroot and so on can
achieve the same effect in a more lightweight way.

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Apr 17, 2008 10:38 UTC (Thu) by lgb (guest, #784) [Link]

Yeah, according to launchpad.net for example, one of the loudest desktop bug in ubuntu
development distro is the flash problem (crashes the while webbrowser). In a sandbox, plugin
would not be able to crash the whole browser and of course you would be able to enhance the
security as well with applying verious restrictions to it, eg like my current solution where
flash plugin is runned by nspluginwrapper even on 32 bit machine, it does the "browser crash
protection" and also since plugin is running another process it does not slow down the whole
browser and even cause better utilizition of multiple CPUs/cores of current desktops ...

Sandbox

Posted Apr 3, 2008 21:19 UTC (Thu) by spitzak (subscriber, #4593) [Link]

There were quite a few posts on Slashdot claiming that the Vista Internet Explorer did exactly
that for either the entire browser or for the flash plugin, but apparently it failed to stop
the attack. It sounds like Flash actually ran another executable outside the sandbox that
opened up a communication channel with the sandboxed part and obeyed instructions from it. Not
at all clear whether this outside executable was either setup to autorun as part of the flash
installation, or if somehow the "sandboxed" flash was still able to cause it to run.

If there is any truth to this it is a good indication that reliance on sandboxing to solve
things may be wrong.

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Mar 31, 2008 16:01 UTC (Mon) by MathFox (subscriber, #6104) [Link]

I am not sure what the exact rules for the hacking contest were, so I'll talk about what it
takes to make a flash or other http propagated hack work.
First one has to find a vulnerability, like a buffer overflow, in an application that handles
data from the internet and play with it to get some code running. At that moment you're only
running with user privileges, then you'll have to exploit a "privilege escalation" bug that
will allow you to obtain control of the machine.

Security issues in web browsers, image manipulation programs, video players, etc. are
relatively common, so it is imaginable that a hacker can gain control of a user account.
Privilege escalation bugs are rare and fixed with hight priority. Taking over a machine where
you have a user account should be hard (in the UNIX philosophy). So it will also be hard too
for a hacker to get from a random user account to full system privileges.

bad guys don't need root

Posted Mar 31, 2008 16:13 UTC (Mon) by JoeBuck (subscriber, #2330) [Link]

You don't necessarily need the second attack (privilege escalation to get root). For many purposes, it's good enough for the bad guy to just be an ordinary user. The compromised user account still suffices to send spam, participate in DDOS attacks, or serve as a machine for launching further attacks from, to cover the attacker's tracks. And for a single-user machine, the user's account can read and write all of the user's data, scan it, and send anything interesting over the network to the attacker.

It's true that, without root, it's hard to hide the extra processes, but if the machine doesn't have a skilled sysadmin looking after it, it doesn't matter.

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Mar 31, 2008 17:27 UTC (Mon) by mrshiny (subscriber, #4266) [Link]

Also remember that on Windows XP almost everybody runs as Administrator (i.e. root)

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Mar 31, 2008 19:57 UTC (Mon) by cortana (subscriber, #24596) [Link]

On many systems, you don't need to look for a privilege elevation exploit. You can easily wait
around for the user to authenticate themselves with sudo, and then run whatever you want as
root.

If the user uses su rather than sudo, it's not that much harder; you can wait for them to
authenticate themselves with su, and then stuff characters into their terminal...

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Mar 31, 2008 21:39 UTC (Mon) by drag (subscriber, #31333) [Link]

On my single user machine.. aka Laptop.. I am much more concerned about protecting private
data such as online passwords, financial stuff, and links to banks and that sort of thing. Any
sort of information leakage that can put me in a vulnerable position.

As far as I am concerned what I have in my home directory is much much more sensitive then
what I have in my.. say.. /etc/shadow file. My /etc/password file could be containing plain
text passwords and it wouldn't make any difference.  At that point I don't really care, the
game is already over.

So if they get through my browser and into my main account then I am screwed. There is no need
for a root exploit.. the damage is already done. They got access to the vast majority of my
sensitive information.

The only advantage I have then for protecting my root account is that user applications are
much easier to detect then your average linux kernel module root kit. Even then it's still
better to wipe and reinstall. That approach requires much less effort.

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Mar 31, 2008 16:39 UTC (Mon) by ajross (subscriber, #4563) [Link]

Languages change.  Words acquire new meanings.  I sympathize, but this isn't something we can
fix.  At best, we can preserve the old usage.  But you can't redefine a word that's been in
popular use for 20 years, no matter what meaning it used to have.  You can't hack linguistics,
basically. :)

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Mar 31, 2008 16:42 UTC (Mon) by jake (editor, #205) [Link]

> Considering that many in the Linux community continue to see hacking as 
> honorable, may I respectfully suggest that LWN editorial policy respect 
> the Linux hacker community's usage in the future?

I think you will find that in stories we create, we consistently use hacker in the
traditional, positive sense of that term.  Unfortunately, we have lost that battle in
mainstream usage.  I guess my usage of "hacker-proof" was somewhat ill advised in the blurb,
though an alternative is not so easy to come up with either.

Do remember that the titles are from the website we are quoting.

jake

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Mar 31, 2008 17:01 UTC (Mon) by gtb (subscriber, #3978) [Link]

> Do remember that the titles are from the website we are quoting.

That, indeed, is the part I have missed. I apologize for the misunderstanding.

-- T.

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Mar 31, 2008 18:11 UTC (Mon) by JoeBuck (subscriber, #2330) [Link]

I would suggest that LWN insert something like [sic] occasionally to flag a misleading headline, though.

Not in this case: as others have said, we've already lost the battle on the meaining of hack{er,ing}.

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Mar 31, 2008 20:41 UTC (Mon) by nix (subscriber, #2304) [Link]

I don't know. If someone uses 'hacker' wrong around me, I belabour them 
with an axe, and they soon stop.

;}

Hacking with an Axe

Posted Apr 1, 2008 16:26 UTC (Tue) by GreyWizard (subscriber, #1026) [Link]

So you hack them?  I don't think that's the usage gtb was hoping to promote.

Linux Unhackable At TippingPoint Contest (eFluxMedia)

Posted Apr 1, 2008 3:17 UTC (Tue) by grouch (subscriber, #27289) [Link]

Not in this case: as others have said, we've already lost the battle on the meaining of hack{er,ing}.

I don't buy that. Every time I've talked to someone who uses the moronic media's definition of "hacker", I educate them about the differences between "hacker" and "cracker", "vandal", "script kiddie" and Hollyweird.

'Scuse me for a while; I have to go "hack" an alien mothership to "download" a virus to it and save humanity from teenage phreakers in bad costumes running around acting as "Hackers".