4 ms·

If you are on shared hosting or any kind of machines that depends on the kernel to enforce permissions any kernel hole means ability to rootkit the whole thing,

by nisa 9y ago

If you are on shared hosting or any kind of machines that depends on the kernel to enforce permissions any kernel hole means ability to rootkit the whole thing, set up persistence and access data from root or other users. There is stuff like kerberos tokens for admins, everyting secret in /etc like ldap passwords, private keys or ability to change read-only code to setup a backdoor. You can tap the admin if he uses the machine for SSH hopping - grab backups... the list is endless. Linux is full of local root exploits and while most script-kiddies just exploit your WordPress plugin and mine some coins or setup a DDoS script that works until someone notice it, having root and a rootkit on machines is probably the goal of any serious intruder - especially if it's servers on organisations and stuff like that. It also means depeding on the exploit that you can escape Docker, LXC or even KVM/QEMU - rarely but it has been done.

bcoates 9y ago
I'm honestly surprised that people still bother with multi-user access control. Defense in depth only works if the defenses are actually manned, and it's been pretty clear that nobody's been taking linux local escalation seriously for a very long time. Shared-hosting is, in practice, a high-trust environment, and trying to patch your way around that sounds like the snakeoil logic of Windows security products.
- nisa 9y ago
  Shared hosting is high trust? You are basically one stolen credit card and 5 minutes away from giving strangers SSH access to a host with lot's of customers that often process sensitive data. Might be true that it's not that important for the cloud crowd where you just use an instance for everything but that that's expensive and not the reality outside of certain bubbles and in the end the problem is just invible to you because Google or Amazon are tightening their hypervisors for you. Lot's of Hadoop/HPC clusters or university desktops depend on this stuff. With everyone moving to Docker and Containers the kernel is the only thing that prevents an intruder from owning the host or the cluster - it's a shame that this is not taken seriously - however they still assign CVEs for it. On a modern cluster node you have software defined networking - having root on a node also means access to different VLANs and stuff like that - most distribued applications just blindly trust anything inside their internal network are a pain the secure (try setting up Hadoop with Kerberos, it's not exactly click&play). A normal setup gives you a SSH key and instant shell on every machine in the cluster. Also most machines are identical so if you own one, you most probably have the means to own all. You can also get all the configuration management data as root. It's for sure not a barrier you should use as your last stand but it's something that should be as hard as possible to overcome. Just giving up and saying who cares only makes the job for future intruders easier.
SwellJoe 9y ago
"Linux is full of local root exploits" Prove it.
- nisa 9y ago
  Really? http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33 http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html... - there is at least one big one with public exploit every year - someone experienced can probably write exploits for issues that are critical but where there is no public exploit. Than there are lot's of userspace exploits like the recent sudo issues or mysql root exploits, the list is pretty long for linux in '15 und '16 - if you hotpatch or reboot a few times a month and keep packages updated you are probably save (at least I hope so) but if you are unlucky and lazy in keeping up with updates - not so much. As I've said script kiddies probably fail at exploiting this but if you have valuable infrastructure to maintain and you've got someone talented or bored on the other side or even inside your network i.e. university networks where you can't reboot everything every other day it's not unrealistic.
  - SwellJoe 9y ago
    That certainly sounds pretty bad, but I've browsed through them, and while there have been some doozies, it's also not as dramatic as it seems on the surface. First up, nearly half of this years priv esc bugs in Linux so far are specific to Android (and most of those involve things like nvidia drivers). That's serious, but not "somebody can get root on my server" serious. Another handful of them are specific to some driver, some kernel module, or some kernel feature, that would only be used on a subset of systems. Still bad, but it does mean that at any given time, even systems running theoretically exploitable systems often won't be because the feature needed to exploit it isn't turned on and can only be turned on by root. For example, one of the high scoring vulnerabilities requires a user or process with CAP_NET_RAW capability. That has to be granted by root, and would presumably only be granted to trusted users and processes. But, others are pretty scary and would be exploitable in a lot of cases. It's a reminder to stay on top of updates. And, also a reminder that the kernel is a huge surface area for attacks. It sometimes seems like a miracle that any of this stuff works at all.

by nisa 9y ago

bcoates 9y ago

I'm honestly surprised that people still bother with multi-user access control. Defense in depth only works if the defenses are actually manned, and it's been pretty clear that nobody's been taking linux local escalation seriously for a very long time. Shared-hosting is, in practice, a high-trust environment, and trying to patch your way around that sounds like the snakeoil logic of Windows security products.

nisa 9y ago
Shared hosting is high trust? You are basically one stolen credit card and 5 minutes away from giving strangers SSH access to a host with lot's of customers that often process sensitive data. Might be true that it's not that important for the cloud crowd where you just use an instance for everything but that that's expensive and not the reality outside of certain bubbles and in the end the problem is just invible to you because Google or Amazon are tightening their hypervisors for you. Lot's of Hadoop/HPC clusters or university desktops depend on this stuff. With everyone moving to Docker and Containers the kernel is the only thing that prevents an intruder from owning the host or the cluster - it's a shame that this is not taken seriously - however they still assign CVEs for it. On a modern cluster node you have software defined networking - having root on a node also means access to different VLANs and stuff like that - most distribued applications just blindly trust anything inside their internal network are a pain the secure (try setting up Hadoop with Kerberos, it's not exactly click&play). A normal setup gives you a SSH key and instant shell on every machine in the cluster. Also most machines are identical so if you own one, you most probably have the means to own all. You can also get all the configuration management data as root. It's for sure not a barrier you should use as your last stand but it's something that should be as hard as possible to overcome. Just giving up and saying who cares only makes the job for future intruders easier.

SwellJoe 9y ago

"Linux is full of local root exploits" Prove it.

nisa 9y ago
Really? http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33 http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html... - there is at least one big one with public exploit every year - someone experienced can probably write exploits for issues that are critical but where there is no public exploit. Than there are lot's of userspace exploits like the recent sudo issues or mysql root exploits, the list is pretty long for linux in '15 und '16 - if you hotpatch or reboot a few times a month and keep packages updated you are probably save (at least I hope so) but if you are unlucky and lazy in keeping up with updates - not so much. As I've said script kiddies probably fail at exploiting this but if you have valuable infrastructure to maintain and you've got someone talented or bored on the other side or even inside your network i.e. university networks where you can't reboot everything every other day it's not unrealistic.
- SwellJoe 9y ago
  That certainly sounds pretty bad, but I've browsed through them, and while there have been some doozies, it's also not as dramatic as it seems on the surface. First up, nearly half of this years priv esc bugs in Linux so far are specific to Android (and most of those involve things like nvidia drivers). That's serious, but not "somebody can get root on my server" serious. Another handful of them are specific to some driver, some kernel module, or some kernel feature, that would only be used on a subset of systems. Still bad, but it does mean that at any given time, even systems running theoretically exploitable systems often won't be because the feature needed to exploit it isn't turned on and can only be turned on by root. For example, one of the high scoring vulnerabilities requires a user or process with CAP_NET_RAW capability. That has to be granted by root, and would presumably only be granted to trusted users and processes. But, others are pretty scary and would be exploitable in a lot of cases. It's a reminder to stay on top of updates. And, also a reminder that the kernel is a huge surface area for attacks. It sometimes seems like a miracle that any of this stuff works at all.