Re: [Full-Disclosure] No shell => secure?

[hax <uberhax@xxxxxxxxx>]

I'm not an expert in shellcode, but that thinking seems flawed in a few ways:
1)  Tons of scripts rely on /bin/sh being present.  It'd be a huge
deal to rework the system so that everything goes to a new path.
2)  That'd stop a lot of skript kiddies, I guess, but it'd be pretty
trivial to just rework the shellcode to call some other command
instead of /bin/sh.  Everything from vi to mozilla can execute
commands these days.
3)  Changing the file system structure is a *bad* idea.  You'd be
breaking standards (http://www.pathname.com/fhs/) and you'd probably
be breaking most applications.  Think about how linking works, for
example, and all the absolute references programs make.

The moral of the story is that security through obscurity is *bad*.
You wouldn't really be making yourself much safer, although you'd stop
some of the mass exploitation scripts, and you'd cause yourself a lot
of problems trying to make your obscurity function.
Besides, if everyone tried what you suggest, shellcode would just move
away from /bin/sh.

Good thoughts, bad idea ;)

Hope that helps,
--hax

On Thu, 8 Jul 2004 12:04:53 +0200, Matthias Benkmann
<msbremove-this@xxxxxxxxxxxxxxx> wrote:
> I can't say I've looked at much exploit-code so far but the POC exploits
> to gain root I've seen for Linux all executed /bin/sh. I'd like to know if
> this is true for in-the-wild exploits to root a box, too. If so, would it
> be a useful security measure to rename /bin/sh and other shells (after
> making sure that everything that needs them has been updated to the new
> name, of course)?
> 
> I'm aware that a dedicated attacker who targets my box specifically will
> not be stopped by this but I don't think I have such enemies. I also know
> that DOS is still possible, but that's also not my concern. I'm simply
> worried about script kiddies using standard exploits against random
> servers on the Internet rooting my box faster than I can patch it.
> 
> If renaming the shell is not enough, how about renaming all of the
> standard Unix top-level directories (such as /bin, /etc,...)? Would that
> defeat standard exploits to root a box?
> 
> MSB
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html