Sections

apache Jul 23 apple Jul 26 (4 recent) articles Jul 26 (36 recent) askslashdot Jul 26 (9 recent) books Jul 26 (1 recent) bsd Jul 22 developers Jul 26 (3 recent) features Jul 18 interviews Jul 26 (3 recent) radio Jun 29 science Jul 26 (8 recent) yro Jul 26 (6 recent)

Hacking Linux Exposed

Posted by timothy on Friday September 21, @10:15AM
Reader Bob Johnson wrote this detailed review of Hacking Exposed followup Hacking Linux Exposed -- especially in light of the various color-coded Windows viruses still on the loose, this might be a good present for your your local Windows administrator as well, but both Bob and the authors are clear: GNU/Linux systems may be more resistant, but are not immune to cracking.

Hacking Linux Exposed
author	Bri Hatch, James Lee, George Kurtz
pages	566
publisher	Osborne/McGraw-hill
rating	8.5
reviewer	Bob Johnson.
ISBN	0072127732
summary	The definitive Linux/Unix security and hacking text; follows in the full-disclosure footsteps of Hacking Exposed.

What it is

While the recent Code Red worms and their offspring have taken center stage, it is not time for Linux administrators to sit on their behinds and say 'told you so.' Yes, our Unix systems may have been immune, but let us not forget the flurry of worms that came after Ramen made the scene early this year.

Most folks have heard of Hacking Exposed, the ground-breaking security book that is now coming out with a 3rd edition. One of the HE authors, George Kurtz, teamed up with two leading security experts to bring us Hacking Linux Exposed which was released in April of this year.

Hacking Linux Exposed teaches you about security from the cracker's point of view. to give you all you need to know to protect your own systems. It is written by security experts who have seen these attacks in the wild and have been protecting their own systems from them. It gives many examples of attacks, but it also teaches you how attacks of various forms occur in general, giving you a true understanding of vulnerabilities current, future, and theoretical.

The book itself is organized into four parts, each discussing a specific aspect of system security in depth.

Contents

The authors then move onto proactive measures that can be taken to protect your system, under the theory that you shouldn't be reading the entire book before you start securing your systems. This section primes you with security procedures that will be referenced later in the book multiple times, and keeping it all contained seems a very logical organization. Topics include log analysis, system security scanners, hardening tools and patches. The chapter is ended with a step-by-step discussion of what to do should you suffer a break-in. While they strongly suggest a reinstall, and describe all the problems and pitfalls that brings, they acknowledge when business needs may conflict, and how to deal with differing requirements.

Rounding out the first part we move onto a chapter showing how crackers find out information about your machines and network. Naturally it includes the standard port-scanning tools, ping sweepers, and OS detection software, as well as network (in)security scanners such as SAINT, Nessus, and SARA. New administrators will learn a lot from discussions of information leakage through SNMP, DNS, whois, and even newsgroups. I believe this is the only book I have ever read to start a chapter with a piece of email Spam for educational purposes.

Part II talks about how crackers can get into your machine from the outside. We begin with a chapter entitled "Social Engineering, Trojans, and Other Hacker Trickery." This chapter is dedicated to various methods that are not necessarily code-related. The social-engineering angle is broken down into several categories, explaining the human insecurities that are most effective at getting people to give out inappropriate access or information, complete with frighteningly simple examples. The discussion of Trojans reminds us that everything may not be what it seems, such as the trojaned version of tcpd back in 1999, and explains how not to be taken advantage of by using checksums, pgp signatures, and the like. It ends with a discussion of worms. A discussion of the Ramen worm is included (the book was published very soon after this worm was released) as is a prediction that other worms may be on the horizon, which turned out to be all too true.

Next we move onto physical attacks that are used to gain access to systems, or helpful information. You are reminded how lax your office environment is (yes, we all have at least one sticky note with some password, somewhere) perhaps more than necessary. However when discussing console access, the authors return to instantly-implementable countermeasures to keep folks from walking up, rebooting, and dropping into single user mode, including a bit on encrypted filesystems.

Next comes a chapter devoted to attacks launched over the network. True to the overall style of the book, this isn't simply a list of the various POP/IMAP/Sendmail hacks over the years, but rather examples of different classes of attacks, such as wardialing, X servers, buffer overflows, denial of service attacks, sniffers, and automated password guessers. The information provided should help you prevent the known attacks and those that haven't been written yet that operate on similar principles.

The last chapter of Part II discusses attacks based on abuse of the network and network protocols themselves. We learn about abuses of DNS, routing protocols, and advanced sniffing and session hijacking that can be used to funnel your traffic through an attacker's machine without your knowledge, often without any loss in service. Man in the middle attacks against SSH and SSL are also well explained, and critical for anyone to understand before blindly clicking 'ok' to PKI-based warnings. The chapter ends with a discussion of the hazards IP-based trust relationships, and how to properly implement ingress and egress filtering.

All the topics to this point have been geared to keeping the attacker off of your system. In Part III, the authors move on to how an attacker that has already gotten onto your machine in some way will ultimately hack the root account.

We begin with PATH and permissions problems, insecurities with suid/sgid and custom root-run scripts, and common problems with poor sudo configuration (including a script you could use to allow limited editing of /etc/passwd via sudo safely.) It continues with local buffer overflow, format string vulnerabilities, race conditions, and hard/symbolic link problems. A very good chapter for anyone writing code, in addition to security administrators.

Chapter 9 is devoted to password cracking techniques and programs, such as Crack, John the Ripper, and pointers to useful word lists. Shadow passwords, including expiration information, is explained, as well as other systems that use passwords such as Apache .htpasswd files. Lastly, they describe good methods of choosing and enforcing strong passwords via PAM.

Chapter 10 shows you all the evils an attacker can do to your system after having cracked root. This chapter reads like a ringing wake-up call if you think a machine can be properly resecured once it has been compromised. The authors show some simplistic methods a hacker can use to maintain access, such as modifications of .rhosts, read/write nfs exports, and suid root shells, to more advanced methods such as the use of SSH authorized_keys which are suprisingly still not part of most script-kiddies arsenal. It then moves onto several methods of creating a network-accessible root shell (a wacky custom one is written in perl and netcat). The rest of the chapter is devoted to trojaning a system by replacing/recompiling new versions of system programs (netstat/ls/etc) which can be used to hide an attacker's activities. Loadable kernel modules which can do the same, but are potentially undetectable are discussed, complete with code. This chapter could have been titled 'How to build your own rootkit' given the detail they provide.

The last main part of the book discusses firewalls, web, mail, and ftp servers in detail. The server room is still where Linux is most often deployed, and the authors decided to give extensive detail about how to secure these commonly-provided services.

Chapter 11 discusses mail and ftp security, services that are most frequently run by the buggiest of software. However, the authors don't waste their time listing the insecurities that have existed in each product over the years (which would have taken several books) but instead look at current problems in implementations and the protocols themselves. For the mail section, it was refreshing to see that Postfix and Qmail were given equal air time along with Sendmail The authors described attacks that affect Sendmail, Postfix, and Qmail, showing the necessary fix for each mail server. The FTP section began the actual workings of the FTP protocol in both Active and Passive modes to allow you to understand the problems with the protocol itself and how it can be used for FTP bounce attacks, penetrating poorly-designed firewalls, and how data hijacking can occur.

Chapter 12 discusses both webserver configuration issues (Apache being the most prominent) and server-side dynamic content insecurities. The authors show you how to trim overly-permissive configuration options that are enabled by default, protect your HTTP authentication files, tighten proxy settings, decide where symlinks are appropriate, and more. The CGI (mod_perl, etc) section does a good job of showing you common pitfalls you or the programmers you support make every day that can lead to a compromise.

The last chapter of the book discusses how you can enable access controls and firewall rules to keep the bad guys off of your machine. They discuss TCP Wrappers along with inetd, xinetd, and even how to integrate them into your own daemons. They give detailed examples of how you can implement packet filters on your machine. It was nice to see iptables described as prominently as ipchains, especially since the 2.4 kernel was barely out when they released the book.

The last section of the book is the appendices. The first discusses the package management systems of various Linux distributions (RedHat, Debian, Slackware) and how to install/upgrade/verify your packages. The next details how to see what services you are running and how to turn them off, again describing distribution-specific methods where appropriate. The last appendix consists of three actual-hack case studies. If you've read Hacking Exposed then you're familiar with the 1-2 page case study at the beginning of each chapter. Here they included much lengthier case studies, including the code the attackers used. The increased length works much better, and provides a good view into these attacker's methods.

Presentation

Many security books out there focus on various tools available to attackers, and read like a shopping cart with occasional text interspersed. This book focuses on the attack methods themselves, rather than the tools. As such it contains information about cracking programs where appropriate, and reads more like an educational journey of hacking methods. When many similar tools are available, only a few are described in depth, and eliminating duplication when possible, leaving you with the right information to decide which tool or tools are best for you.

One of the things that I really appreciated about this book is how the authors will start off topics with home-grown examples before discussing advanced security tools. For example, the authors give you a simple shell script that could function as a crude file integrity checker to provide you a clear method of understanding the concept before going onto detailed configuration examples of tripwire, Aide, and others. While they do not take up much space for these primers, usually half a page or so, they are excellent examples of speaking through code, rather than magician wave-of-the-hand explanations.

Conclusion

At many times I wished that the book were more Unix-centric than simply Linux centric. Many of the issues are similar, and the countermeasures would simply be broken down into *BSD vs Linux vs Solaris, etc. However that would have made reading the countermeasures a bit more difficult. As it is, many of the issues have similar or identical countermeasures, regardless of OS, so administrators should be able to extend what is said to their Unix OS of choice without too much trouble.

The Linux focus allows the authors to get much more in depth than they were able to in Hacking Exposed, which was disjointed at times, unable to really probe each issue. However the opposite is also true --- since they wanted to focus on Linux-specific attacks, they do not go into general attacks, such as JavaScript, cross site scripting, and other browser-related problems, for example. For these types of attacks you should look elsewhere. I think keeping the focus clean is very much worth it.

Beginning administrators may find some of the lead-up lacking in places. For example someone who is not very knowledgeable about IP may have trouble understanding some of the sophisticated network abuses and malformed packets described. However this is to be expected. This book is not standalone, nor should it be. If the HLE authors included enough information to adequately describe every nuance of IP packets then that'd be a disservice to those who already have a copy of W. Richard Stevens, and would needlessly add weight to a book that is supposed to stay focused on hacking.

The book has a website that includes all the source code in the book, released under the GPL, as well as some tools they wrote which they didn't feel belonged in the book itself. They also have book corrections on the website, as well as sections they had wished to put in the book that were rejected by the editor, such as their stance on the "Hacking vs Cracking" semantics debate, and why "Linux is Securable" (as opposed to Windows.) Needless to say, these folks won't be employed by Microsoft in the near future.

I highly recommend this book. You'll have ready-to-implement measures that can keep you busy for some time securing your systems. You'll learn a lot on the journey. And I look forward to seeing "Hacking Windows 2000 Exposed" later this year --- I can only assume it'll say "Install Linux."

<  Blaming Encryption | MS FrontPage Restricts Free Speech II (It's True!)  >