Strange command histories in hacked shell history

Bill Vermillion bv at wjv.com
Fri Dec 17 07:36:34 PST 2004


"Ang utong ko ay sasabog sa sarap!" exclaimed Peter C. Lai
while reading this message on Fri, Dec 17, 2004 at 10:03  
and then responded with:

> I thought on BSD, there was no distinction between euid and uid. If you login
> as user 'foo', and su to 'bar', your uid is bar and you gain all of "bar"'s
> privs.
> 

And why should it be that way?  It seems that in this day of
security this isn't the most securre way of doing things.

I never did get an answer in the past as to why this is still being
done this way.

You explanation is exactly the way it work, and it just seems 
wrong to me.


> On Fri, Dec 17, 2004 at 09:53:15AM -0500, Bill Vermillion wrote:
> > > Message: 1
> > > Date: Thu, 16 Dec 2004 20:31:05 +0800
> > > From: Ganbold <ganbold at micom.mng.net>
> > > Subject: Strange command histories in hacked shell server
> > 
> > Just a minor comment on one portion of your message.  
> > 
> > [All deleted except the pertinent part - wjv]
> > 
> > > Machine is configured in such way that everyone can create an account itself.
> > > Some user dir permissions:
> > > ...
> > > drwxr-xr-x  2 root       wheel         512 Mar 29  2004 new
> > > drwx------  3 tamiraad   unix          512 Apr  9  2004 tamiraad
> > > drwxr-xr-x  6 tsgan      tsgan        1024 Dec 16 17:51 tsgan
> > > drwx------  4 tugstugi   unix          512 Dec 13 20:34 tugstugi
> > > drwxr-xr-x  5 unix       unix          512 Dec 13 12:37 unix
> > > ...
> > > User should log on as new with password new to create an account.
> > 
> > > Accounting is enabled and kern.securelevel is set to 2. Only one
> > > account 'tsgan' is in wheel group and only tsgan gan become root
> > > using su.
> > 
> > I've asked others before and never got a real answer on the design
> > of 'su' which to my way of thinking has a security hold that shold
> > be fixed.
> > 
> > su checks the EUID of the user to see if they are in 'wheel' to
> > enable them to su to root.   It would seem to me it should
> > use the UID.
> > 
> > In your case if the 'tsgan' account does not have a secure
> > password, and some breaches the 'tsgan' account in any manner, such
> > as a SUID tsgan as I see it, then that user who cracked the 'tsgan'
> > account can su to root.
> > 
> > So in your case there is the possibility that someone else
> > su'ed to 'tsgan' and then su'ed to root.
> > 
> > Can anyone explain why  su   does not use the UID from the login
> > instead of the EUID ?  It strikes me as a security hole, but I'm no
> > security expert so explanations either way would be welcomed.
> > 
> > Bill
> > 
> > 
> > -- 
> > Bill Vermillion - bv @ wjv . com
> > _______________________________________________
> > freebsd-security at freebsd.org mailing list
> > http://lists.freebsd.org/mailman/listinfo/freebsd-security
> > To unsubscribe, send any mail to "freebsd-security-unsubscribe at freebsd.org"
> 
> -- 
> Peter C. Lai
> University of Connecticut
> Dept. of Molecular and Cell Biology
> Yale University School of Medicine
> SenseLab | Research Assistant
> http://cowbert.2y.net/
> 

-- 
Bill Vermillion - bv @ wjv . com


More information about the freebsd-security mailing list