3 ms·
I had this stupid idea long ago of using "security by obscurity" and rename some commands that are typically used manually and are favorite ones of exploits lik
by lazyant 12y ago
I had this stupid idea long ago of using "security by obscurity" and rename some commands that are typically used manually and are favorite ones of exploits like this, for ex: curl, wget, gcc -> rename to le_curl, le_wget, le_gcc etc, just for my use. Maybe it wasn't such a stupid idea.
- jewel 12y agoOn a hardened system you remove all unnecessary binaries completely. See, for example, PCI DSS section 2.2.5. https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pd...
- lazyant 12y agoyes, but those commands (wget, curl, gcc and a few others) are unnecessary usually but sometimes needed once in a while, ideally you could uninstall them and then install on demand.
- aortega 12y agoYour idea won't work and also would prevent most scripts in your system to work correctly. I wrote unix exploits for a living for years (All legit, in a pentest company) and for payloads I would normally use echo or printf to upload a binary and execute it. And those are built-in commands in the shell.
- lazyant 12y agoI know, still most of the script kiddy attacks I see (on a honeypot ssh for ex) are of the 'wget download bad script' type. I typically uninstall gcc and my scripts don't use wget/curl/scp, now rsync otoh... can't blacklist all possible tools, you may as well netfilter traffic to block non-root initiated traffic going out.