[aklug] Re: Information Systems Audit

* Arthur Corliss <acorliss@nevaeh-linux.org> [130206 14:38]:
> On Wed, 6 Feb 2013, Tim Johnson wrote:
>
> > OK : here is question for you paranoid sysadmins ((not that there's
> > anything wrong with that) it's a good thing)
> >
> > Is there a way to test for compiled-in back-doors to say - a
> > python, PHP or a perl interpreter.
>
> Not a good, definitive way, unfortunately. You could do string searches in
> the binary for external system calls, but even that's easy to hide for any
> hacker worth its salt. So, you're stuck with straces to see what system
> calls are doing, looking for sockets being opened, etc., during execution.
> Luckily, there are ways to make most of those attempts fail.
>
> > Could any of you sysadmins caught that little hickup in the JVM?
> > http://www.pcworld.com/article/2025178/oracle-releases-java-fix-but-security-concerns-remain.html
> > I'm old enough to have remembered "The Bomb" as in cold war, duck
> > and cover etc.
>
> The Java problem was primarily a desktop problem, not a server problem.
> Most server apss are going to downloading and executing foreign jars.
                      ^not ^be ?
> Because of that, it's not the servers that are getting exploited, it's the
> clients.
 I'm aware of that. But it is illustrative of how a resource with
 widespread use can be a problem... Plenty of destkop systems are
 adminstering SKADAs (I'll guess)

-- 
Tim 
tim at tee jay forty nine dot com or akwebsoft dot com
http://www.akwebsoft.com
---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.