Leveraging Break Ins of Other Systems

Crackers sometimes take advantage of break-ins of systems other than your own in order to do damage. One method of doing so was already mentioned earlier, in

"Social Engineering." Users frequently employ the same password on multiple systems. A cracker who obtains a username and password for one system may try it on other systems. Therefore, even if your own system's security is otherwise impeccable, it may be compromised through vulnerabilities in other computers.

A second type of leveraged break-in results from trust relationships between computers. One such trust relationship exists between servers and their clients; some servers are configured with a list of trusted clients. For instance, the Network File System (NFS) grants access to systems specified in /etc/exports. If the trusted client is compromised, the server may be compromised in turn, at least to a limited extent. A cracker who breaks into the client may be able to read sensitive data files from all users on the server and be able to plant Trojans in users' directories which might lead to further compromise.

A more subtle variant of this trust problem relates to trusting data provided by other servers. For instance, you can specify computers via hostname in /etc/exports. If you do so, then this means that your server is trusting data provided by your local Domain Name System (DNS) server. If a cracker compromises your DNS server, the cracker can alter those entries to gain access to your NFS server's files even without breaking into any of the trusted clients. Similar problems can exist in other systems, too; for instance, a Samba server that relies on user authentication by a domain controller is vulnerable to a compromise of the domain controller computer.

The usual protection against such problems is similar to the solution to social engineering problems: Trust as little as possible. For instance, whenever possible you should specify other computers by IP address rather than hostname. IP addresses can also be forged, particularly if the miscreant has physical access to your network, but by using IP addresses you've at least eliminated the DNS server as one potential vulnerability in your computer's security.

0 0

Post a comment