[aklug] Re: Information Systems Audit

On Wed, 6 Feb 2013, Tim Johnson wrote:

> OK : here is question for you paranoid sysadmins ((not that there's
> anything wrong with that) it's a good thing)
>
> Is there a way to test for compiled-in back-doors to say - a
> python, PHP or a perl interpreter.

Not a good, definitive way, unfortunately. You could do string searches in
the binary for external system calls, but even that's easy to hide for any
hacker worth its salt. So, you're stuck with straces to see what system
calls are doing, looking for sockets being opened, etc., during execution.
Luckily, there are ways to make most of those attempts fail.

> Could any of you sysadmins caught that little hickup in the JVM?
> http://www.pcworld.com/article/2025178/oracle-releases-java-fix-but-security-concerns-remain.html
> I'm old enough to have remembered "The Bomb" as in cold war, duck
> and cover etc.

The Java problem was primarily a desktop problem, not a server problem.
Most server apss are going to downloading and executing foreign jars.
Because of that, it's not the servers that are getting exploited, it's the
clients.

         --Arthur Corliss
           Live Free or Die
---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.
Received on Wed Feb 6 14:32:56 2013