Security

Every quarter we got the same news: Linux did it again!

Yes, they DID it again. Many sites became victim during the last scan of awstats vulnerability, the most famous ones are www.phpbb.com, and moto.debian.org.tw, etc. You can Google the cracker organization and find more.

Why Linux is again and again vulnerable to these hack attempts? Why other systems doesn’t have such serious security issues even when an exploit is published? The answer is apparant: Linux did worst ever, among all Operating Systems, even when you include Windows. Imagine, a kernel which can permit normal users to gain root privilege.

What is a privilege elevation? It meant that someone who (maliciouslly) obtain higher privilege through some method that is not predicated by programmer.

In order to prevent it, we should avoid giving unnecessary privileges, and validate all input. However, in a imperfect world, just validating everything is not enough, since there are too many things that can not be validated easily.

On most Unix systems, we have a “set uid” bit that can allow subsequent process to run under other credentials. This, however, opens an window that we can potentially allow malicious code to be injected into the system, to obtain higher privileges.

It seems that there is some keywords in the central cleaning house and I can’t update the blacklist… Maybe we should create a new one!

I have finally got skeljail implemented through the RCng way. After some test I will post the patch for review.

A skel jail is a jail that share essential binaries/libraries with the base system (optionally, other base template if you want) through mount_nullfs.

I’d say I really dislike this feature, it always prevent me from being able to receive attachments and does not actually block virii since I have some carefully designed security mechanisms installed on my computer.

Of course someone may say “Outlook sucks, don’t use it!” but I won’t say that. Outlook is a great product that is very safe if you have configured it *CORRECTLY*. The feature of the attachment blocking, while may be useful for not experienced users, will harm users that is experienced and is highly security-aware when communicating with non-experienced folks.

于是他们又来了。

如果你正在用Linux kernel 2.2.x，2.4.x(从开始到2.4.29-pre3)，2.6.x(从开始到2.6.10)，那么你就有事干了。通过合理地注入代码，任何人都可以拿到root，因为kmem_cache_alloc()的执行过程被打断，则VMA的红黑树可能会在不希望的地方插入一个节点，并进而通过LDT调用门获取CPL0特权。

昨天下午接到通知说这台机器不能往外主动建连接了，本来想说道两句，但后来觉得其实有几个能连出去的端口就足够了，终于等到这一天啦，更何况我觉得那个服务没给我带来任何好处，没有也就没有了，还什么XML RPC，搞笑，traceback是什么呀？申请了没有？

其实不能连出去挺好的，再也不用担心像从前公司的服务器突然被告知「连接了某某网站，根据某某部门的要求，现停闭你公司服务器，特此通知」的事情了。

This should be considered as a “security release” somewhat. I’m building package for it at company’s buildbox, and it would be deployed internally.

And seems that they have re-implemented it… Why netcat… I can’t understand it…

实在是不得已而为之，spammer越来越过分了。comment插件一口气删掉了将近300条垃圾comment。

Kill spam!!