Re: [PLUG] The 'Penquin' Turla

[Rich Freeman <r-plug@thefreemanclan.net>]

On Tue, Dec 9, 2014 at 12:40 PM, Keith C. Perry
<kperry@daotechnologies.com> wrote:
> I find it hard to believe that perl or any other available "magic" gets
> around a properly configured system that uses Linux capabilities with nosuid
> mounted filesystems.  That would break selinux enhancements, cpusets and
> generally the concept of Linux containers from the security point of view.
> If you have a link to some perl scripts that do this, I'd like to test this
> in my lab to confirm for myself.  You never know but I don't see a practical
> attack vector for this on modern Linux box either.

Without a zeroday you don't need nosuid/selinux/etc to block this.
Just regular kernel security will block non-privileged processes from
listening on low ports, sniffing traffic, and so on.

Now, you can listen and run arbitrary commands as a non-privileged
user all you want to.

--
Rich
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug