Re: ~/.hosts patch

On 2006.06.21 08:31:36 +0200, Harti Brandt wrote:
On Wed, 21 Jun 2006, Xin LI wrote:

XL>?? 2006-06-21???? 01:54 -0400??Mike Jakubik??????
XL>> [snip]
XL>> > It's useful for cases where you want to add shortcuts to hosts as a user
XL>> > or do interesting ssh port forwarding tricks in some weird cases where
XL>> > you must connect to localhost:port as remotehost:port due to
XL>> > client/server protocol bugs.
XL>> >
XL>> > This patch appears to only support ~/.hosts for non-suid binaries which
XL>> > is the only real security issue. Any admin relying on host to IP
XL>> > mapping for security for ordinary users is an idiot so that case isn't
XL>> > worth worrying about. Doing this as a separate nss module probably
XL>> > makes sense, but I personally like the feature.
XL>>
XL>> Of course relying on /etc/hosts entries for security alone is indeed not
XL>> a good idea, however an Admin may choose to resolve and therefore route
XL>> specified hostnames via /etc/hosts. The user should not be able to
XL>> overwrite these, if this behavior is true, then it seems like a
XL>> reasonable change to me, otherwise it not only seems to be a security
XL>> problem, but also a breach of POLA.
XL>
XL>I think this would be better implemented with a nss module so that the
XL>administrator can choose whether to utilize the feature.
XL>
XL>BTW. I do not see much problem if the feature is not enabled for setuid
XL>binaries because if the user already knows some secret (run under his or
XL>her own credential), nor can the user trick others to utilize the
XL>~/.hosts if the program is a setuid binary. What's your concern about
XL>the "security problem", or could you please point how can we
XL>successfully exploit the ~/.hosts to get privilege escalation and/or
XL>information disclosure or something else, which could not happen without
XL>~/.hosts?

Wouldn't this enable the same kind of phishing attacks there are under
windows? As far as I remember there are attacks where the hosts file
(don't remember how its called under windows) is rewriten by a virus/java
script/whatever to contain a different IP address for a given hostname?
Suppose someone fakes the website of www.foobank.com, then manages to
insert www.foobank.com with the wrong IP address into ~/.hosts?

If an attacker is able to write a ~/.hosts you have already lost and I
really doubt being able to override hosts lookup would make any
difference security wise.

Instead of writing a ~/.hosts file, the attacker could just start a
keylogger on the system either directly by some remote code execution,
or by installing the keylogger somewhere and get it to start on boot,
X login etc. by appending to some startup file.

I really don't see how this would make any real difference security
wise.

--
Simon L. Nielsen

Attachment: pgpwZqx3ZUnN5.pgp
Description: PGP signature

Relevant Pages

  • Microsoft compiler flaw, Cigital responds
    ... Also of interest are various attacks against the ... We never made a claim that the use of the flawed /GS feature exposes code to ... relied on to improve software security. ... a classic criticism against Microsoft is ...
    (Bugtraq)
  • Re: ~/.hosts patch
    ... XL>>> It's useful for cases where you want to add shortcuts to hosts as a user ... XL>>> is the only real security issue. ... XL>administrator can choose whether to utilize the feature. ... (don't remember how its called under windows) ...
    (freebsd-current)
  • RE: Scanning Class A network
    ... Now figure 20 hosts running 20 scan instances at one time it ends up STILL ... and give a way more understandable picture of what the security of this ... Install a distrubuted scanner across the network and segment the networks ... Up to 75% of cyber attacks are launched on shopping carts, forms, ...
    (Pen-Test)
  • ActiveScout (ForeScout) 100%?
    ... I have been using ActiveScout for more than a year. ... as I am a firm believer in the concept of multi-layered security. ... One feature that I particularly enjoy, is the geographical mapping of the ... sources of the attacks. ...
    (Focus-IDS)
  • Re: Pelosi & Reid Will Not Like Progress Cited in Iraq Quarterly Report
    ... This is from 4 pages, less than 10 percent, of the report. ... Reid has called General Petraeus a liar for saying progress had been made in Iraq, and more recently he has called Petraeus and outgoing chairman of the Joint Chiefs,Marine Gen. ... Assessment of the Security Environment— ... the frequency and intensity of attacks on the ...
    (soc.retirement)