Critical Flaw Found In Backtrack Linux 84
chicksdaddy writes "Threatpost is reporting on a critical security flaw in the latest version of Backtrack Linux, a popular distribution that is used by security professionals for penetration testing. The previously undiscovered privilege escalation hole was discovered by a student taking part in an InfoSec Institute Ethical Hacking class, according to the post on the group's Web site. 'The student in our ethical hacking class that found the 0day was using backtrack and decided to fuzz the program, as well as look through the source code,' wrote Jack Koziol, the Security Program Manager at the InfoSec Institute. 'He found that he could overwrite config settings and gain a root shell.' An unofficial patch is available from InfoSec Institute. Koziol said that an official patch is being tested now and is expected shortly."
Yo Dawg! (Score:5, Funny)
I heard you like pen testing so I put a pen test on your pen test!
Physician–strike that–... (Score:2)
Pentester, hack thyself.
Re: (Score:3)
When the Raspberry Pi comes out we can have a pen test in a teacup.
The preacher said "Repentest!" so his IT guy ran the test again.
(These jokes are like Metro -- not much good but brand new)
D'oh (Score:1)
That's what I clearly heard the admin of the threatpost's web server just exclaim.
From what I heard (Score:5, Insightful)
Re:From what I heard (Score:4, Interesting)
Many other distros also carry wicd
Are other distros also affected?
Re:From what I heard (Score:4, Insightful)
wicd is network-manager without the sucking parts.
Re: (Score:1)
Re: (Score:2)
And as a pen tester, I've yet to use this on an online network. 100% non-issue for me.
Re:From what I heard (Score:4, Insightful)
Unfortunately most of the people (I'd go as far as 95-99%) on the backtrack forums are neither pentesters nor good. They use wicd because they don't know how to edit a config file or run their own wpa_supplicant. Most of them go as far as trying to use BT for their regular day-to-day stuff. Idiots. But the backtrack team put up with them, so something like this becomes massive news.
I didn't see headlines when the wget vulnerability was in Backtrack 3...
Usually you run as root (Score:5, Interesting)
Re:Usually you run as root (Score:5, Informative)
* BackTrack is a Live DVD - when you finish using it, everything is wiped out.
* It's not a server OS
* It's not a desktop OS
* It's an OS for a specific purpose.. you use it for pentesting, and then stop using it.
I don't see what the issue is.
Re: (Score:3)
You're forgetting that it has the ability to mount local hard disks and write anything to them, gather hardware information, etc.
This is significant because most individuals don't disconnect their hard drives when running it.
Re: (Score:2)
Re: (Score:2)
Please see my reply to the other responder to my parent post.
Re: (Score:2)
but nearly every livecd has a default root-pw or sudo set up to work without password.
Re: (Score:2)
That's presuming none of the scanning utilities that require root have any vulnerabilities in them. For example, there have been plenty of Wireshark dissectors that just by merely sniffing on a network can lead to compromise of the live distribution.
Re: (Score:2)
Re: (Score:1)
The issue is, that one would expect a distro specifically built for security and penetration testing would not have a discoverable security flaw. No matter how obscure.
It might make one wonder what else has been missed?
Why would someone have such unrealistic expectations of a complex collection of software packages? Have you somehow managed to develop perfect software with no flaws of any kind?
Re:Usually you run as root (Score:5, Informative)
Why? They do network penetration testing, not priviledge escalation tests; they're totally unrelated.
No-one expects BT to be safe, it's an "offensive" tool, not one used to secure anything.
Re: (Score:2)
AFAICT, this is a local flaw, not one that can be exploited over the internet.
For banking, use something with an up-to-date web browser, otherwise you're still vulnerable to problems in old browsers.
Re: (Score:1, Insightful)
ClueOS GetLive Edition.
I wholeheartedly recommend it to you.
Re: (Score:2)
So what's the problem?
Priviledge escalation means that someone with access to the PC can become root. Only you have access to it while running from the liveCD, no-one can you the exploit but you. Specially not over a network.
Re: (Score:2)
Re: (Score:3, Insightful)
Reading the T
Re: (Score:2)
The issue is, that one would expect a distro specifically built for security and penetration testing would not have a discoverable security flaw. No matter how obscure. It might make one wonder what else has been missed?
Do you really think that's a reasonable standard? Even OpenBSD has had security flaws in it.
Re: (Score:2)
The issue is, that one would expect a distro specifically built for security and penetration testing would not have a discoverable security flaw. No matter how obscure.
It might make one wonder what else has been missed?
No, one would not expect that.
You've probably never done a pen test, nor do you understand how Backtrack works.
Re: (Score:2)
it appears (Score:3, Informative)
Backtrack repository has the fix already.
Re: (Score:1, Informative)
Re:Penetration testing (Score:5, Funny)
Yeah, I can't believe people fall for th
Oh look. It is a picture of two kittens who are playfully romping in the grass. This picture is really cute.
What? No, it's
So cute!
Re: (Score:1)
Next headline: Professional penetration tester got penetrated thanks to a privilege escalation hole.
Re: (Score:2)
news at goatse
Comment removed (Score:5, Funny)
Re: (Score:2)
Actually, a lot of people install Backtrack and run it as the resident install on their hard drives. Not what I would do, but then, not everyone is able to build their own system for pen-testing in the first place.
Re: (Score:1)
So "a lot of" people are stupid. What are the doing pen testing for anyway? They are too stupid to understand what this is for. A security flaw like this, while it needs fixing, is a non issue if you are using the tool properly. This is not a secure linux distro. Its just a bunch of tools. Installing it serves no purpose, other than some teenage c00l factor cause you are a 1337 haxor. Which you are not, if you are using out of the box pen testing tools.
Or, you have an old, beat up laptop that you use just for pentesting, because it's useless for anything else. Or, you installed it on your good laptop as a VM, so you can more easily save some of the information you uncovered. Just because it isn't something you should do as your permanent, regular install (which I did see a number of dolts in a security class I took do) doesn't mean there aren't perfectly legitimate reasons to install it.
That said, I can't think of any good scenario where this bug wou
Re: (Score:2)
Re: (Score:1)
"running entirely from a ramdisk in memory"
As opposed to a ramdisk running not in ram?
; )
(I know, I know... Bla bla bla ramdisk is a misnomer etc. Your sentence still reads funnily ; )
Re: (Score:3)
Re: (Score:2)
Is it sad that I think about my Slashdot comments in the shower?
Only if they don't make +5.... which is the majority of Slashdot comments. :-\
In-band Signaling Considered Harmful (Score:1)
For example (and yes, I realize this has nothing to do with SQL, it's
Re: (Score:3)
Oblivious indeed. All input gets sanitized, even if it's a simple sanity check, for example percentages should be between 1 and 100 (if >100 doesn't make sense). Numeric data should be checked to be sure it's numeric. Null integers and strings should be converted to a NULL database value, instead of an implicit ToString() conversion giving an empty string, depending on the language. Using a pass-through library to connect to the database, allowing nothing to escape unchecked, is what smart programmer
Re: (Score:2)
Instead, you use a data access layer, that always binds parameters.
Kinda like I said above. Only you claim that you will miss sanitizing something. So what if you forget to use bound parameters? Oh that's right, things work perfectly in your view of the world but everyone else is wrong. Use a data access layer, access everything the same way.
I don't so much care how "thick" your data access layer is - a thousand layers of code or just a rule - the important thing is that at the bottom you MUST use bound parameters instead of doubling all your quotes and wrapping it in quotes.
In-band signaling... I'll leave that for others if they want to rip it apart. I assume you mean escape sequences, replacing control characters with escapes specifically. There are common ways of replacing, and common ways to defeat common ways of replacing. It has nothing to do with in or out of band signaling.
Poor choice of words, perhaps - what it really boils down to is, don't let your users write your source code. Seems pretty obvious when you say it that way, but so many things like SQL injection attacks, XSS browser problems, etc, all come down to taking a string of user in
Re: (Score:3, Insightful)
Ummm.. fuck parent straight up the ass for that idiocy.
Validating your inputs is just one of many important parts of a complete security solution.
There is a good reason you'll find "Input Validation" given its own section starting on Page 5 of the OWASP Secure Coding Practices Quick Reference Guide [owasp.org].
But don't be too hard on CapOblivious2010 ... developers like that are the reason you'll still find plenty of work writing security code for decades to come.
Re: (Score:1)
It was a honor to create. Since we had 43 million in venture capital it is only fair we provide the source code for the research we have thus far produced. Entire source below.
int main(void) // not yet implemented
{
FILE* data = fopen ("datafile.bin", "r");
if (!data) return 1;
#if 0
interpretData();
#endif
return 0;
}
datafile: http://pastebin.com/dPQVppAc
Thanks.
Re: (Score:2)
Need local access to exploit it... (Score:5, Informative)
This is a complete (Score:5, Informative)
Re: (Score:2)
Still something that definitely needs fixed
You forgot the infinitive.
Move along, nothing to see here (Score:5, Informative)
From the official response (http://www.backtrack-linux.org/forums/showthread.php?t=49411):
This post is a bad example of a bug report, for several reasons.
1) The title of this vulnerability should probably be "WICD Priv Escalation". As such, it should probably be reported to the WICD developers, as opposed to the BackTrack development team. If you still felt the bug report should be posted to us, the right place to post it would be "BackTrack bugs" (although it is not), or even better, our redmine ticket system.
2) Giving the pre-requisites for the exploit to function would be helpful. In this case, you would need to create a non root user in BackTrack, have a remote attacker access BT with that non privileged account or have an unprivileged shell from a previous attack against another service, and then have that user attempt to connect to a wireless access point (assuming wicd is running as root). This is far from the default configuration in BackTrack, which further negates the title of this vulnerability.
3) Making a mountain out of a molehill for the purpose of promoting a product or service is generally frowned upon by the security industry, especially when one already has a bad reputation.
4) Once this bug is tended to by the WICD developers, we will use their official patch rather than patching our packages using untrusted sources.
Bootable Backtrack (Score:2)
If you're an infosec pro, it pays to use belt and suspenders.
Advanced Pen Testing (Score:2)
1. Advertise 0day on Linux distro
2. Publish unofficial "fix" with trojan payload
3. Pwn all the computers of the world's most paranoid hackers
4. ?
5. Profit!!!!
Misprepresentatoin of Security bugs for fame (Score:1)
Seems to me Infosec are trying to mis-represent this bug in order to get traffic to their website. Calling it it a "Backtrack 0day" is a blatant attempt to make this into more than it is for the sake of self glorification. People who actually understand security see right past this, which sheds a bad light on the Infosec Institute.
This is why... (Score:1)
Re: (Score:1)
If you don't want to partake in our Slashdot Linux-loving group masturbation then leave. No one is forcing you to stay, and there are dedicated forums for WinFags and MacFags too.