I'm not an expert in shellcode, but that thinking seems flawed in a few ways: 1) Tons of scripts rely on /bin/sh being present. It'd be a huge deal to rework the system so that everything goes to a new path. 2) That'd stop a lot of skript kiddies, I guess, but it'd be pretty trivial to just rework the shellcode to call some other command instead of /bin/sh. Everything from vi to mozilla can execute commands these days. 3) Changing the file system structure is a *bad* idea. You'd be breaking standards (http://www.pathname.com/fhs/) and you'd probably be breaking most applications. Think about how linking works, for example, and all the absolute references programs make.
The moral of the story is that security through obscurity is *bad*. You wouldn't really be making yourself much safer, although you'd stop some of the mass exploitation scripts, and you'd cause yourself a lot of problems trying to make your obscurity function. Besides, if everyone tried what you suggest, shellcode would just move away from /bin/sh. Good thoughts, bad idea ;) Hope that helps, --hax On Thu, 8 Jul 2004 12:04:53 +0200, Matthias Benkmann <[EMAIL PROTECTED]> wrote: > I can't say I've looked at much exploit-code so far but the POC exploits > to gain root I've seen for Linux all executed /bin/sh. I'd like to know if > this is true for in-the-wild exploits to root a box, too. If so, would it > be a useful security measure to rename /bin/sh and other shells (after > making sure that everything that needs them has been updated to the new > name, of course)? > > I'm aware that a dedicated attacker who targets my box specifically will > not be stopped by this but I don't think I have such enemies. I also know > that DOS is still possible, but that's also not my concern. I'm simply > worried about script kiddies using standard exploits against random > servers on the Internet rooting my box faster than I can patch it. > > If renaming the shell is not enough, how about renaming all of the > standard Unix top-level directories (such as /bin, /etc,...)? Would that > defeat standard exploits to root a box? > > MSB > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
