Recent problems

Ramen worm attacks RH 6.2 and RH 7.0

In February 2001, a new worm showed up, called Ramen, that attacks unhardened Red Hat 6.2 and Red Hat 7.0 systems. If you are running either of these without all of the security updates, you need to refer to the book's Appendix A immediately to get to Red Hat's security updates pages and install the security updates.

The t0rnkit v8.0 root kit (for Red Hat 7.0) not detected with md8sum

The t0rnkit v8.0 root kit (for Red Hat 7.0) appears to have the same md8sum values ("cryptographic hash") as the correct non-Trojaned versions of system programs. This information is from analysis by the SysAdmin of a victim system and also is claimed in the alleged README file for the root kit. (Posted to incidents@securityfocus.com on 01/01/2001 by Johnathan Curst.)

In view of this development, I consider it no longer sufficient to check if programs are Trojaned via md5sum values. This technique is used in Tripwire (and many similar programs) and by RPM. The book explains a technique to easily use RPM to detect Trojaned utilities.

I now recommend using tar to compare disk files to a trusted backup, using a trusted version of tar copied to a set of boot/root floppies custom made by the SysAdmin. This technique is discussed in the book. It is impervious to all attacks except, possibly reprogramming the CMOS to boot from disk even when asked to boot from floppy.

It is most important to note that you must use a "trusted path" when doing these validation tests. This means that you absolutely trust each component of the "system" from the hardware to every component of software needed for the test. For almost all use, this means to boot the system from trusted floppies or CD-ROMs that you know could not have been tampered with.

See 15.7.1 "Custom Rescue Disks" on page 480 to learn how to make these containing tar (or md5sum). The t0rnkit v8.0 root kit simply may install a Trojan version of md5sum rather than ensure that the actual MD5 sums (hashes) of the Trojan programs match the original programs. [Added 03/12/2001.]

An alternative might be to store and compare the results of multiple hashing algorithms. With effort, a cracker might cause the Trojan to have the same md5sum value as the original program. The effort to have the same of several different hashes as the original becomes geometrically more difficult. Even checking the results of both md5sum and sum would be hard to defeat. The poster did not confirm that he verified that md5sum itself was not compromised. It would be much easier for the cracker to install a Trojaned md5sum than to cause the other Trojaned programs to have the same md5sum values as the original correct programs.

(Recall that a root kit is a set of replacement system utility programs that have Trojans in them that allow the cracker to get back in if the original security hole is fixed.)

GAIM 0.10.[0-3] has remote exploit

GAIM 0.10.x, where x <= 3 has a remote exploit to gain privileges of the user that GAIM is running as. A patch is available.

Vulnerability in xlock -d

There is an exploit for "xlock -d" format string bug on i386 Linux. It is exploitable on Slackware 7.1 and Red Hat 6.2 (though RH 6.2 did not have setuid), and Mandrake 7.0. Red Hat 6.1 won't work because fprintf generates segmentation faults on large precisions.

OpenSSH vulnerability

OpenSSH clients prior to 2.3.0 have a vulnerability if they encounter hostile servers. I believe that this is the forced X11 problem in RH 7.0 and very likely other distributions too.

Internet Explorer 5 vulnerable to malicious web site

For those having users using Internet Explorer, another bug in IE5 was reported in SANS on November 29, 2000. It allows a malicious web site to gain access to all of the files on a browser's machine via the scripting feature. It recommends that this feature always be turned off on networked machines. The bug was discovered by Guninski, who has found a number of bugs in IE.

While it is this author's opinion that IE has many more and more severe security bugs than Netscape, one should take precautions with Netscape (or any other browser) too. Do follow the advice in the book in the section on Netscape. Never run it as root. It is highly advisable to run it as a separate user that does not have access to anything important (and is not your normal user account used for any other purpose). Copy any saved data from this account as a different user (your regular account).

Never invoke su, ssh, telnet, or ftp running as an untrusted user (such as the one that invokes Netscape) because if a cracker has gotten access, he could cause you to invoke a Trojaned version of su, ssh, etc. and then gain the password to a trusted account.

D.B. Cooper seems to have been found

Several references are made in the book to the criminal D.B. Cooper, who hijacked a Boeing 727 many years ago, including section 14.6 "Breaking Into Your Own System with Tiger Teams", on page 467. In very late 2000, after the book went to press, a seeming ordinary man on his deathbed claimed to be D.B. Cooper to his shocked wife.

A subsequent investigation suggests that his claim was true, disputing the suspicion that he did not survive his bailing out of the plane at over 200 MPH or his walk out of the woods where he landed. Most of the ransom money never was recovered. There is an excellent restaurant in Nashua, New Hampshire named after him. His actions cannot be condoned.

Return to Real World Linux Security Home Page.